N65236-16-R-0032 Cyber Red Team Industry Day Q&A.pdf

PDF 255 KB Posted Apr 26, 2018

Attached to: N65236-16-R-0032 - Cyber Red Team Support
Solicitation number: N65236-16-R-0032
Issued by: Department of the Navy Information Warfare Systems Command

About this file

Written by GovTribe AI · Dec 31, 2023

This document summarizes questions and answers from an industry day held to discuss a forthcoming solicitation. The solicitation will seek contractor support for cyber red team engagements to evaluate Computer Network Defense Service Providers and Department of Defense networks. Support will also be required to participate in cyber exercises simulating adversarial forces and conducting cooperative vulnerability and adversarial assessments. The solicitation is expected to have an indefinite-delivery, indefinite-quantity ceiling of approximately $99 million. The contract type will be cost-plus-fixed-fee. The opportunity is set aside for service-disabled veteran-owned small businesses. The Navy is currently the incumbent for this requirement.

View the file

Other files

File	Type	Posted
Draft RFP_Sections L & M_ECC Posting (19 June 2018).docx	DOCX document	Jun 19, 2018
Industry Day Q&As_dtd 08 June 2018.pdf	PDF	Jun 8, 2018
N65236-16-R-0032 Cyber Red Team Industry Day Attendee List.pdf	PDF	Apr 26, 2018
N65236-16-R-0032 Cyber Red Team Industry Day Presentation.pdf	PDF	Apr 26, 2018
Sources Sought_16-R-0032_ECC Posting 18 May 2017.docx	DOCX document	Mar 27, 2018
PWS draft_ECC Posting 18 May 2017.docx	DOCX document	Mar 27, 2018

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

SPAWARSYSCEN Atlantic CYBER RED TEAM AND OPERATIONAL TEST SUPPORT N65236‐16‐R‐0032

1 | P a g e

Pre‐Acquisition Planning Industry Day Q&As

1. Will

the

attendee

list

published

e‐Commerce/FedBizOpps?

Yes,

will

provide

list

companies

that

attended

this

event.

This

has

been

included

separate

attachment

this

posting.

2. Will

the

Government

consider

non‐DCAA/CPFF

contract

format?

No.

Based

the

unknown

and

undefined

nature

the

individual

task

order

requirements,

utilization

cost

type

(i.e.

CPFF)

contract

required.

3. Will

there

any

restrictions

how

many

proposal

submissions

company

can

listed

subcontractor?

No.

However,

the

tentative

RFP

will

include

the

requirement

for

offerors

submit

written

teaming

agreement

disclosure

form

signed

both

parties.

4. Is

there

possibility

the

$5M

invoicing

requirement

may

relaxed?

The

$5M

invoicing

requirement

currently

under

review.

The

final

RFP

will

identify

the

Government’s

final

decision

regarding

this

invoice

threshold

requirement.

5. Can

you

describe

depth

the

past

performance

evaluation

(specifically

how

many)?

The

past

performance

references

are

based

solely

the

contract

references

submitted.

this

time,

the

Government

estimates

that

eight

(8)

past

performance

references

will

permitted.

This

number

(of

past

performance

references)

subject

change

and

therefore

you

will

want

refer

the

formal

solicitation

that

posted

for

specific

information.

6. Why

this

procurement

Service

Disabled

Veteran‐Owned

Small

Business

(SDVOSB)

and

not

Small

Business

(SB)

Full

and

Open?

Based

the

Sources

Sought

Notice

responses

and

the

market

research

findings,

was

determined

that

least

SDVOSBs

were

capable

performing

the

requirements.

7. Is	this	work	truly	$50	‐	$100M	in	value?
Yes.	The	Government	anticipates	the	IDIQ	ceiling	to	be	approximately	$99M.

8. Are	you	still	accepting	market	research	input?		Who	is	the	POC?
No.		The	period	to	accept	market	research	is	closed.

9. Will	résumés	be	required	at	submission?
The	final	evaluation	factors	are	in	development	and	may	include	résumés.	The
Government’s	decision	will	be	reflected	in	the	final	RFP

SPAWARSYSCEN Atlantic CYBER RED TEAM AND OPERATIONAL TEST SUPPORT N65236‐16‐R‐0032

2 | P a g e

10. Who

the

incumbent

Which

vendor(s)

are

currently

supporting

the

SPAWAR

Red

Team

now?

KSH

Solutions,

Inc.

(now

ECS

Federal)

has

performed

small

subset

this

requirement.

However,

this

new

requirement

and

therefore

there

incumbent

for

this

requirement.

11. Can

use

CLASSIFIED

contract

references

UNCLASSIFIED

proposal?

The

Government

currently

reviewing

the

potential

for

the

submission

classified

contract

references.

The

Government’s

final

decision

will

identified

the

final

RFP.

12. Is

SPAWAR

using

the

SeaPort‐e

contracting

vehicle

for

this

effort?

believe

the

mandated

NAICS

for

SeaPort

541330.

No.

The

Government

will

NOT

utilizing

SeaPort‐e

for

this

effort.

stated

the

Pre‐

Acquisition

Planning

Industry

Day

presentation,

the

solicitation

will

released

the

SPAWAR

e‐Commerce

website

and

FedBizOpps.

The

NAICS

code

chosen

for

this

specific

requirement

was

based

the

appropriate

Product

Service

Code

(PSC)

‐

D310.

The

corresponding

and

applicable

NAICS

code

541519

–

Other

Computer

Services.

13. For

joint

ventures,

will

the

past

performance

both

companies

taken

into

account

just

the

past

performance

that

the

joint

venture

has

done

the

joint

venture

(i.e.

the

joint

venture

SBA‐accredited

mentor‐protégé

JV)?

accordance

with

CFR

§125.18

(b)(5),

states

that

when

evaluating

the

past

performance

and

experience

entity

submitting

offer

for

Service

Disabled

Veteran

Owned

(SDVO)

contract

joint

venture

established

pursuant

this

section,

procuring

activity

must

consider

work

done

individually

each

partner

the

joint

venture

well

any

work

done

the

joint

venture

itself

previously.

14. Can

joint

venture

prime

they

50%

the

work?

answer

this

question

forthcoming.

The

Government

working

with

the

Deputy

Director

for

Small

Business

Program

provide

this

response.

Please

continue

monitor

e‐Commerce

and

FedBizOpps

for

additional

updates.

15. Is this “as required” work or will the staff be 100% tasked during the contract?

The

staffing

requirements

will

identified

the

individual

task

order

level.

However,

there

may

requirement

for

Key

Personnel

the

time

award.

The

Government’s

decision

will

identified

the

final

RFP.

16. The

Pentagon

has

embraced

Secure

Crowd‐Sourced

Penetration

Testing

(hack

the

Pentagon)

well

the

Army,

Air

Force,

and

DiSA.

the

Navy

Red

Team

open

this

approach?

SPAWARSYSCEN Atlantic CYBER RED TEAM AND OPERATIONAL TEST SUPPORT N65236‐16‐R‐0032

3 | P a g e

Yes;

however,

must

meet

the

requirements

the

RFP

(i.e.

provided

was

done

support

certified

Red

Team).

17. What

size

team

Full‐time

Equivalents

(FTEs)

will

this

be?

anticipated

that

the

size

the

team

will

8‐10

per

task

order

but

could

also

increase

100

FTEs

based

the

requirements

individual

task

orders,

concurrently

executed.

18. Can

penetration

testing

experience

count

Red

Team

experience?

Yes,

only

was

done

support

accredited

Red

Team.

19. Please	confirm	if	the	Government	will	accept	examples	of	experience	from
commands	outside	the	9	NSA‐certified	Red	Teams	as	relevant	experience
The	Government	requires	that	all	contract	reference	examples	of	experience	identify
experience	supporting	a	DoD	accredited	Cyber	Red	Team.

20. What

risk

management

framework

support

required

the

Red

Team

operate

the

infrastructure?

varies

based

upon

the

number

and

types

system

necessary

conduct

and

sustain

the

Red

Team

operations.

21. Is

level

CMMI

certification

required?

so,

what

level

and

what

capabilities?

Must

the

Prime

hold

the

CMMI

certs?

The

CMMI

certification

not

requirement,

but

may

considered

benefit

the

Government

certified

level

3 or higher.

22. How

are

you

handling

OCI

with

DT/OT

services?

For

example,

there

may

situation

where

contractor

could

designing

software

for

the

Navy

under

another

contract

(OT)

and

then

testing

their

own

work

under

this

contract.

The

Government

evaluating

this

potential

and

will

include

any

necessary

organization

conflict

interest

clauses

the

final

RFP,

warranted.

23. Do you expect to expand into close access operations to access physical security?

Yes. It is anticipated for this to occur no later than the next inspection (March 2020).

24. Must

the

Prime

have

facility

clearance

(FCL)?

Yes.

This

FCL

clearance

level

required

the

time

award.

25. Please

confirm

the

Government

will

allow

team

members

who

have

valid

capabilities

outside

the

NSA‐certified

Red

Teams

join

prime

who

has

experience

with

certified

Red

Team.

SPAWARSYSCEN Atlantic CYBER RED TEAM AND OPERATIONAL TEST SUPPORT N65236‐16‐R‐0032

4 | P a g e

All	submitted	contract	reference	experience	shall	cite	experience	supporting	a	DoD
accredited	Cyber	Red	Team.

26. What

are

the

local

off‐site

requirements,

any?

The

local

off‐site

requirements

will

determined

the

task

order

level.

this

time,

the

Government

anticipates

this

3,000

–

5,000

square

feet.

27. What internal training is conducted or expected to be conducted on the Red Team?

There

are

SPAWARSYSCEN

Atlantic

Red

Team

operator

levels

that

individual

team

members

can

attain

participating

the

Red

Team’s

formal

training

program.

Individuals

must

attain

and

maintain

“Level

1”

conduct

operations

the

team.

There

are

currently

four

(4)

levels.

Each

Red

Team

service

area

assessed

uniquely

(e.g.

local,

remote,

wireless,

etc.).

28. What are the minimum and expected individual certifications for Operators?

Developers?

The minimum and expected individual certifications that an Operator and Developer shall possess is CSSP Auditor defined in DOD 8570.01-M and found here: https:// iase.disa.mil/iawip/Pages/iabaseline.aspx.

29. What	is	the	nature	of	the	infrastructure	support	required?
The	nature	of	the	infrastructure	support	required	includes	the	security	of	operations
and	support	of	the	infrastructure	(hardware,	software,	laptops,	servers,	testing	gear)
used	by	the	Red	Team	operators	to	safely	conduct	assessments.

30. Will	you	have	infrastructure	in	the	cloud?
Yes.	Infrastructure	will	be	in	one	or	more	cloud	service	providers.

File details come from the government source that posted it. Updated Dec 31, 2023.