RFI_Questions_and_Answers_Comments_9-18.docx

1) Is there an incumbent for this opportunity?

Answer: No

2) Can the incumbent bid on this opportunity?

Answer: N/A

3) Given the short turnaround from the Questions due date of 9/16 to the RFP response of 9/19, may we request a one week extension for the final proposal?

Answer: The solicitation is extended; please see amendment for new proposal due date.

4) In FBO this project switched form SDVOSB to Hubzone back to SDVOSB. Please confirm this is set-a-side for SDVOSB.

Answer: Confirm SDVOSB

5) Do all key personnel require a Secret clearance?

Answer: See below answer to Question 6.

6) Can a subcontractor be used who does not have a secret facility clearance?

Answer 5) & 6): All personnel working on this contract, whether they are the prime employees or the sub employees will require a SECRET clearance. Also, the contractor and sub-contractor is required to have a SECRET facility clearance.

7) Is prior Navy security experience a requirement for this opportunity?

Answer: Yes

8) Is all CSWF training required to be completed before or after the project commences?

Answer: Before project commences.

9) Do you accept CISSP, CCSP, CISA, PMP as equivalency for the CSWF requirements?

Answer: Yes for baseline CSWF qualification. In addition, OS certification for the applicable OS that is being remediated. Windows and Linux OS are part of the authorization effort.

10) Does the ATO have to have been active FOR the past two years, or can the Offeror submit evidence of achieving the ATO WITHIN the past two years? We recommend the Government change the word "FOR" to "WITHIN" so that this is consistent with the language in Section M.3 Answer: See amendment.

11) We believe that the ATO certification letters may contain sensitive information that our customers may not approve releasing. Is it possible to provide a copy of the eMASS number obtained for these ATO' as proof of the ATO verification?

Answer: Providing the eMASS #, package name and Command is sufficient for verification.

12) Section A States: "3) This will be a one (1) year contract." Request the Government provide instructions for transition period and estimated Period of Performance dates.

Answer: It is anticipated that the four (4) ATOs will be achieved within the one (1) year estimated Period of Performance dates.

13) PWS Para 3.27 states: "The Contractor will be paid upon receipt of an ATO approval by the cognizant Authoring Official."

Recommendation:

Comment: This sentence appears to be a definition of the conditions before payment of CLINs 001 and 002 rather than a definition of a task or subtask within the performance work statement (PWS).

Recommendation: Remove para 3.27 from the PWS. Apply the specific conditions before payment of CLIN 001 and CLIN 002 elsewhere in the RFP (such as in Section B, G, or H).

Answer: See amendment.

14) Would the government please clarify the following statement on page 12 of 48:

3.27 The Contractor will be paid upon receipt of an ATO approval by the cognizant Authoring Official. The scope of work is for four systems. Can the government clarify if the intent to pay the contractor for work performed for up to 1 year after all four systems have received an ATO approval from the AO?

Answer: It is anticipated that the four (4) ATOs will be achieved within the one (1) year estimated Period of Performance dates. Payment is to be made when each of the four ATOs are achieved.

15) Regarding Page: 40, Section: L.3.2.1 Subfactor A:

Requirement: Offeror shall submit evidence of receiving successful Authorization To Operate for Department of Defense/Department of Navy information systems for the past two (2) years by submitting copies of the certification letters received for those systems.

Question/Comment: Request the government reconsider the requirement to submit copies of actual certification letters for the systems that were ATO'd by SDVOSBs and validate the contractor's accomplishments through past performance point of contact verifications. In our experience, such ATO certification letters are the property of the end customer or prime contractor, may contain sensitive information regarding the authorized system possibly necessitating FOUO designations, and in most cases are only provided to the development contractor, not the SDVOSB responsible for ensuring a successful ATO. Accordingly, the sensitive information required by this solicitation is not ours to independently provide NSWCPD and would require additional time beyond the solicitation due date to secure written approval from our historical customers to comply. Verifying this requirement through past performance points of contact benefits NSWCPD through increased competition from qualified SDVOSB bidders that would otherwise no-bid this solicitation.

Answer: Providing the eMASS #, package name and Command is sufficient for verification.

16) Page: 41, Section: L.3.4.1 Volume IV - Price Proposal Requirement: Any signatures required under this section shall be pen and ink. Question/Comment: In recognition of the electronic submittal requirements, please confirm the government will accepted a scanned copy of pen & ink signature.

Answer: The Government will accept a scanned copy.

17) Section L.2 Page 38 of 48, the Font type is 12 Point Times New Roman. Question: Does this font and size apply to the use of tables and graphics for the proposal response or is it possible to use an alternate smaller font type.

Answer: Yes

18) SOW Section 3.27 Page 12 of 48, The contractor will be paid upon receipt of an ATO approval by the Cognizant Authority Official. Question: As this is a small business set aside with a 1-year period of performance can a milestone/performance based payment plan be proposed to reduce the financial burden and carrying cost of the contractor IAW 52.232-16 Progress Payments.

Answer: See amendment.

19) Section L.2 Instructions for Soft Copy Proposals, Page 38 of 48 and Section L.3 Proposal Content and Organization, Table Page 39 of 48. The L.3 table indicates Hard Copies are required for Factor 1, 3 and 4 while the L.2 instructions indicate Email submission of the response. Question: Can you confirm that the submission of the response for this opportunity is via email.

Answer: Email only, See amendment.

20) Section L.3.2.1 Subfactor A, Page 40 of 48. ..submitting copies of the certification letters received for those systems. Question: In support of the gaining a successful Authorization To Operate, many of our customers do not release the formal certification letter to the contractor. Can an alternate approach for evidence be considered for proof of the systems.

Answer: Providing the eMASS #, package name and Command is sufficient for verification.

21) L.2.1. PAGE NUMBERS AND LIMITS – part d. Past Performance References states that Past Performance References are not included in the page limitations. However, L.3. PROPOSAL CONTENT AND ORGANIZATION states there is a 5 page limitation. Is there a page limitation for Past Performance References? If so, what is it?

Answer: Five (5)-page limitation. See amendment.

22) L.3.3 VOLUME III: FACTOR 3 – PAST PERFORMANCE Is there a minimum or maximum number of Past Performance References that should be included?

Answer: There is no minimum or maximum number of Past Performance References. There is a 5 page limitation of the past performance proposal.

23) L.3. PROPOSAL CONTENT AND ORGANIZATION states Hard Copies should be provided for Factor 1: TECHNICAL, Factor 3: PAST PERFORMANCE, Factor 4: TOTAL EVALUATED COST/PRICE, however, no submissions instructions are provided for hard copy proposals. Will the government consider a soft copy only submission?

Answer: Email proposals only, see amendment.

24) Each of the following questions is in reference to section: L.3.2 VOLUME II: FACTOR 1 – TECHNICAL, L.3.2.2 SUBFACTOR B.

· What type of system(s) and/or application(s) (COTS/GOTS) (INTEL, CLASSIFIED, UNCLASSIFIED, LES)?

Answer: The contractor should be cleared to authorize “Secret” classification systems, and to have qualified personnel to remediate both Windows and Linux operating systems.

· What's the system(s) and/or application size (small, medium, large) Answer: Medium sized as defined in the SOW.

· How many users currently & projected scalability?

Answer: Up to the capabilities of a medium sized as defined in the SOW.

· Type users (local/remote) (general, power users, admins, etc...)

Answer: All of the above may be encountered spread across the four systems to be authorized.

· Is the system(s) and/or application(s) accredited, if so, when was the last self-assessment and the authority to disconnect (ATD)?

Answer: There is a combination of expired ATOs and never authorized systems that will be seeking the achievement of an ATO.

25) Are hardcopies of our proposal required to be submitted?

Answer: No

26) Does the 10 page limit include the 5 pages for each Subfactor, or may we provide other technical information outside of the 5 pages for each subfactor in the 10 page limit?

Answer: The 10 page limit for Factor 1 technical does not include subfactor A or subfactor B.

27) There are no instructions for Volume I. Should the following sections be in Volume I and not included in Volume IV?

L.3.4.1 COMPLETED STANDARD FORM (SF) 33 SOLICITATION OFFER AND AWARD DOCUMENT

L.3.4.2 COMPLETED RFP

Answer: L.3.4.1 and L.3.4.2 shall be submitted as part of Volume IV Factor 4.

28) Is the DD254 to be filled in and submitted with our proposal?

Answer: No.

29) Should L.3 Factor 3 and Factor 4 be changed to Factor 2 and Factor 3? Should M2 Factor 4 be changed to Factor 3?

Answer: See amendment.

30) IMRI customers’ letters are marked “FOUO” and others are on a secure system and cannot be accessed by us. May we submit reference information (title, subject, date) vs. the actual letters?

Answer: Providing the eMASS #, package name and Command is sufficient for verification.

31) What is the current status of each system? Do any or all of the systems currently have waivers?

Answer: There is a combination of expired ATOs and never authorized systems that will be seeking the achievement of an ATO.

32) Have the artifacts been collected for any or all systems?

Answer: The contractor is responsible for all artifacts.

33) Are all systems in one location or are they in multiple locations? If in multiple locations is the contractor expected to travel to each location?

Answer: The systems are located in multiple locations, but accessible from the NSWC Philadelphia location.

34) Are all components of the two RDT&E Zone D Information Systems and two unclassified, internet-facing information systems located at the same geographic location? Are there any remote sites that tie into any of these four information systems? If yes, where are those geographic locations?

Answer: The systems are located in multiple locations, but accessible from the NSWC Philadelphia location.

35) Section B CLINs 0001 and 0002 are in a quantity of 2. Is the government expecting this project to be invoiced on a semi-annual basis?

Answer: The contractor is to invoice upon the achievement of an ATO for each of the four systems.

36) May tables, figures and graphs be prepared using Arial Narrow, size 10 font?

Answer: No.

37) How does the requirement for past performance relate to the requirement in L.3.2.1 Subfactor A? Does the government expect the past performance in Volume II: Factor I, Subfactor A to be the same past performance in Volume III: Factor 3?

Answer: It does not

38) If our registration in SAM is current may we submit a screen shot of our SAM registration in lieu of a complete Section K?

Answer: Please fill out Section K accordingly.

39) Will the government consider invoice and payment on an incremental basis?

Answer: No, the contractor may invoice upon the achievement of an ATO for each of the four systems

40) Will the government accept and pay invoices submitted on a monthly basis?

Answer: No. The contractor is to invoice upon the achievement of an ATO for each of the four systems.

41) Is it the intent of the Contracting Officer to put an agreement in place with multiple milestones, tasks and monthly status updates with no interim payments throughout the duration of the contract?

Concerns: There are several concerns. First, “ATO approval” doesn’t qualify whether Interim ATO, Conditional ATO or only a full three-year ATO qualifies as meeting the intent of this SOW. Second, there are multiple milestones, tasks and monthly status updates required as part of this process for four independent systems. The implication of line 3.27 is that there is no value in the process required to complete the work required, when in fact there are costs involved. Last, the Government reserves the right to not implement the security controls required for a successful ATO. It is our opinion that there is an unreasonable level of risk being requested of the Contractor. We request approval to submit for a FFP contract with monthly payments via Wide Area Work Flow (WAWF).

Answer: Your request for approval to submit for a FFP contract with monthly payments via Wide Area Work Flow (WAWF) is denied.

42) The table lists a requirement for hard copy submission but in section L.2., it lists that only Emailed proposals will be accepted. Please clarify.

Answer: Email only, see amendment.

43) Can you elaborate on and clarify how you want each section (volume) laid out in the response? Is each volume a separate file, and if so, does each require its own cover page, cover letter, and/or table of contents?

Answer: Each section must be a separate file. They do not all require cover page, cover letter and/or table of contents.

44) For Subfactor A, the requirements state “Offeror shall submit evidence of receiving successful Authorization To Operate for Department of Defense/Department of Navy information systems for the past two (2) years by submitting copies of the certification letters received for those systems.”

These certification letters tend to be highly sensitive in nature, or even classified, so the government won’t (or can’t) share them with vendors for proposal purposes. Will you consider removing this requirement due to the restrictive nature of these certification documents and their impossibility for prospective vendors to obtain as part of the proposal? An alternative might to be require vendors to provide the official name(s) the systems they provided such support to, which can then be verified in eMASS or other such tool(s).

Answer: Providing the eMASS #, package name and Command is sufficient for verification.

45) Will any of this work be done on the SIPR (classified) side? We see where the work is marked as CUI and some are even NMPI, but we just wanted to confirm.

Answer: Some work will be performed on the SIPRNet.

46) “NSWCPD requires RMF package creation and RMF/DIACAP ATO” Will the vendor be supporting DIACAP or strictly RMF documentation? Will the vendor be responsible for updating/converting package(s) from DIACAP to RMF?

Answer: Some of the previous accreditation effort for data center packages were done under DIACAP. All authorization efforts for this contract will be RMF.

47) “The Contractor will be paid upon receipt of an ATO approval by cognizant Authoring Official” Given the above and, as the contract is FFP, does this indicate that no payments will be made until the entirety of the project is completed? Or may the vendor invoice based upon proposed milestones? For example, (1) completion of the eMASS self-assessment checklist, (2) completion of all ATO documentation and POA&Ms, (3) submission of the full ATO package and, finally, (4) receipt of the full ATO?

Given that a significant percentage of the timeline for this work is outside of the control of the prospective vendor, only providing for payment upon completion of the entire task may impose too high of a risk for some businesses. This is because there are many tasks and prerequisites that are dependent entirely upon government support, input, pre-work/documentation status, and backlog(s), which the vendor will have limited to no control over.

Answer: The Government will not allow milestones. The contractor is to invoice upon the achievement of an ATO for each of the four systems.

48) “Perform monthly remediation actions, to include patching and implementing STIG requirements” Will the vendor be required to patch the operational systems, as well as apply STIGs to the operational systems? Most often there is an operational team responsible for such, while the Security team/validators ensure they relevant patches and STIGs are indeed applied correctly. This may set up a conflict of interest, where the ones responsible for patching/STIGS also verify the patching/STIGS.

Answer. The contractor will be required to patch and apply STIGs to the systems identified for the ATO efforts. The Government will provide separate qualified Navy Validators outside of this contract to perform the A&A package validation.

49) Will we be updating DIACAP documentation and artifacts? Or possibly taking DIACAP packages and updating them to RMF in eMASS.

Answer: Some of the previous accreditation effort for data center packages were done under DIACAP. There may be some updating of DIACAP artifacts to RMF. All authorization efforts for this contract will be RMF.