N66001-17-R-0066 QA.pdf

N66001-17-R-0066 Questions and Answers

17 Jan 2018

Q1. We have TS facility clearance. We have TS/SCI resources but will the agency sponsor the SCIF for access to SIPRNET and JWIC?

A1. SIPRNET/JWIC connectivity is not a requirement at this time, only a facility to process/store classified materials generated from tasks listed in the SOW and utilization/training on toolsets.

Q2. The facility requirements in the synopsis and solicitation documents seem to contradict each other as stated below. Can the Government define the distance requirements as it relates to the facility? With the traffic patterns surrounding Philly, there is a big difference when proposing 50 miles vs 1-hour. Will the Government approve a 1-hour distance requirement?

A2. The synopsis document is no longer current and was inadvertently left as an attachment to the posted RFP. The Synopsis document has been removed. The RFP language of “radius of 50 miles” is what is required for this solicitation.

Q3. The Government also states the contractor has 90 days of contract award to stand up a local secured facility and then states the facility must be available upon contract award? Can the Government clarify the timeline? Can the Government clarify if the facility of a subcontractor can be utilized?

See page 10, section 7.0 of the synopsis: “the contractor must have a facility located within approximately one-hour commute time of the 700 Robbins St. location within 90 days of contract award.” See page 14 of solicitation: “The prime contractor must have a facility located within a radius of 50 miles (see H-TXT-26A(c)(1)) of the 700 Robbins St. location at time of award.” Request that the requirements be restored to allow for the 90 days post contract award and the utilization of qualified subcontractor facilities within the 50 mile radius.

A3. The synopsis document is no longer current and was inadvertently left as an attachment to the posted RFP. The Synopsis document has been removed. The RFP language of “available upon award” is what is required for this solicitation.

Q4. The solicitation states “Key Personnel Security Requirement: Identified key personnel performing C4ISR Cybersecurity duties are required to possess current and active TS/SCI clearances.” Will the Government allow candidates with an active TS who will obtain the SCI portion once assigned to the contract?

A4. Expectation at time of contract award is that there will be individuals with current and active TS/SCI clearances to support existing work. The Government cannot afford to wait for a new background check for a Key individual whose SCI clearance has expired.

Q5. The solicitation package states that “the Government will not directly evaluate personnel experience or resumes” prior to award or during the proposal review process but should personnel be substituted post award there is a defined evaluation process. Will the Government consider making the candidate vetting process uniform across both pre and post award?

A5. The Government will not make changes to the evaluation process for this RFP.

Q6. The SOW does not appear to state whether any of the systems undergoing T&E are classified systems. If they are, doesn't the T&E network need to be housed in an accredited SCIF? If the systems being tested aren't classified, please provide clarification as to what constitutes a 'T&E network'.

A6. The systems undergoing T&E will be classified depending on the Task Order supported (USCG IA deals with classified systems). A SCIF is by definition a Secure Compartmented Information Facility which differs from a Collateral Top Secret Facility. Having an SCI accredited facility is not the requirement.

Q7. Section 3 of Attachment 5, Oral Presentation Guidelines, states, "Each offeror will have two

(2) hours in which to caucus and prepare a presentation following receipt of the sample tasking...From the time of receipt of the sample task through the end of the sample task presentation, the offeror's presentation team (participants and attendees) shall have no contact with anyone other than Government personnel.

If we don't know the topic of the sample task order beforehand, at least in general terms, how is the offeror expected to ensure that the proper mix of key personnel are in attendance to best represent the capabilities of the company?

A7. The makeup of the team will not be evaluated nor compared to the makeup of other offeror’s Oral Presentation team. See sections 6 and 7 of the Oral Presentation Guidelines.

Q8. The first paragraph of Section 5 of Attachment 5, Oral Presentation Guidelines states, "The offeror (from the prime and/or subcontractors) may have up to five (5) personnel, on the Oral Presentation Team, all of whom must be identified by name in accordance with Section L-TXT- 20 for a minimum of 940 hours per year. Respectfully request the Government remove this requirement and allow representative candidates that satisfy key labor categories that are a current W2 employees of the prime or subcontractor? This demonstrates that the offeror team has the requisite experience, knowledge, and expertise to hire for, and manage, the work.

A8. The Government’s requirement stands as written.

Q9. The first paragraph of Section 5 of Attachment 5, Oral Presentation Guidelines states, "The offeror (from the prime and/or subcontractors) may have up to five (5) personnel , on the Oral Presentation Team, all of whom must be identified by name in accordance with Section L-TXT- 20 for a minimum of 940 hours per year. Some or most qualified candidates that will be presenters at orals will be billable to another customer and may not be able to leave to attend the orals presentation due to workload or distant location.

Request a change that allows orals presenters to call in remotely to support the orals presentation if unable to physically attend.

A9. Oral Presentation Team members must be in attendance. No remote access to the oral presentation is permitted.

Q10. Will you use the Seaport-E IDIQ for this effort?

A10. No.

Q.11. Can you provide us a breakdown of the amount and type of labor categories required for each location? Given that: 75% of all the labor categories will be on-Government-site (50% at the Philadelphia, PA location and 50% at Government sites listed in section 6.0 of the Statement of Work), with the remaining 25% at off-Government-sites.

A11. A breakdown of labor categories and hours per location cannot be given at this time.

Q12. Please clarify the T&E system required in 6.0, as it would depend on the equipment tested and the location. Is this task order specific and not required at award of the base contract?

Section 6.1.5, for example, requires a test and evaluation network, with two dedicated servers. Do you have any more insight into the next level of detail down for that?

For example, is this a closed network with no internet access? Servers range widely in cost and capability. Do we know more about what the specs need to be for these? What kind of data connectivity, phone service, and amount of personnel are anticipated to be in the Philadelphia, PA office?

A12. The requirement would be for a “closed” network. Requirement for servers will be to support ACAS/NESSUS, and SSC-PAC-developed software and storage for scan results.

Reference Defense Intelligence Systems Agency (DISA) ACAS Server installation hardware requirements for specific requirements. Storage space will increase as contract continues.

Place of performance depends on Task Order supported. Expectation is that the majority of personnel supporting Cybersecurity Vulnerability scans will be located in the Philadelphia area to prevent travel/per diem costs for personnel supporting post-scan reporting and mitigation reviews. Additionally, Contract Program Manager(s) and Senior personnel should be located in Philadelphia to allow for strategy meetings, Task Order kick-offs, etc. Other Task Orders support operations as identified in Places of performance.

Q13. Can you please clarify whether the Oral Presentations will be held at SSC Pacific Integrated C2I Engineering Division, 700 Robbins St., Philadelphia, PA or at SSC PAC 538 in San Diego, CA?

A13. See RFP Attachment 5 Section 2.

Q14. RFP Page 93 states: (e) The offeror shall facilitate the submission of a Past Performance Questionnaire for each reference or submit a statement that past performance information for an individual contract resides in the Past Performance Information Retrieval System (PPIRS).

If our CPARS is grouped under our Prime Contract, containing two Prime Task Order Numbers, can we break them down between the two in our write up?

A14. The Government does not understand the question.

Q15. RFP Page 95 states: (b) Key Personnel Security Requirement: Identified key personnel performing C4ISR Cybersecurity duties are required to possess current and active TS/SCI clearances.

a. Does this mean that the five Key Personnel for the Oral Presentation are required to possess current and active TS/SCI clearances?

A15. See question 4 above.

Q16. Can a subcontractor to the Prime own/lease and operate the facility and T&E network within 50 miles of 700 Robbins St. Philadelphia, PA? Or, must it specifically be the Prime who owns or leases and operates the facility and network?

A.16. IAW section 6.0 of the SOW, the Prime.

Q17. What is the anticipated manpower requirements (FTEs and quals) at each on-site tenant location stated in Section 6.0 of the RFP? It is understood the Prime will work with Government PM or the COR on actual requirements and desired level of effort at each location after contract award, but for the purpose of planning and thoroughly understanding the requirement is there an estimate for each site?

A17. See question 11.

Q18. Are all the hours assigned under KP labor categories for KEY personnel? Or is only 1 of those FTEs supposed to be Key?

A18. The 940 hours in section (4) (a) are the minimum hours required to be proposed for key personnel within the total provided level of effort for the labor category.

Q19. Please identify an exact effective contract award date (1 July 2018 or 30 July 2018).

Currently states July 2018.

A19. If there is an internal need to have a specific day within that month identified, the Government leaves it to the contractor’s discretion to assign that day.

Q20. In RFP Section L 3.0 VOLUME III – PAST PERFORMANCE INFORMATION paragraph a, it states we are to provide a summary explanation not to exceed two pages.

Additionally, in the RFP Section L 3.0 VOLUME III – PAST PERFORMANCE INFORMATION paragraph b, an additional summary of two pages is referenced. Can the government please clarify if we are allowed to provide two or four pages for our contract summary?

A20. Two.

Q21. On RFP page 99, section M-TXT-06, item (b), the following is the text:

(b) Proposals will be rated using a four-step methodology. Step One is an evaluation of: (a) acceptability of the offer. Step One(a) is an evaluation of Past Performance and the Software Development Plan. Step Two is an evaluation of the Oral Presentation. Step Three is an evaluation of the proposed cost. Step Four is a cost/technical trade-off analysis in order to determine the best value source selection decision. The question is in the third sentence should “Step One(a) is an evaluation… “, be “Step One(b) is an evaluation…” since (a) is the acceptability of the offer?

A21. The RFP is sufficiently clear as written.

Q22. On RFP page 19 under SOW section 6.1.5, is it assumed the “test and evaluation network” is an unclassified standalone system? Can you provide the highest security level expected for this system?

A22. Top Secret

Q23. The documents listed on the SPAWAR e-Commerce website included a Synopsis N66001 document. Is this document still relevant for the official RFP since it contains some conflicting information compared to the details within the RFP? This may have been a document that was released with the draft?

A23. See answer 2.

Q24. Confirm that personnel required to have IAT2 will satisfy this requirement during the proposal process by possessing the required certifications and experience that qualify for IAT2 designation by the government upon contract award. The basis for this question is that our experience in that the Cyber Security Workforce (CSWF) certifications – i.e. IAT2 – can only be issued by the government to personnel who are actively engaged on work requiring the designation.

A24. The requirements necessary to satisfy CSWF IAT Level II must be possessed by personnel. CSWF certification will be done by respective Contract Officer Representatives through the SSO to the SSC-PAC CSWF responsible office.

Q25. The synopsis referred to the “contractor facility” as a DCMA approved facility. Please clarify or define what “DCMA Approved Facility” means.

A25. The synopsis document is no longer current and was inadvertently left as an attachment to the posted RFP. The Synopsis document has been removed.

Q26. Regarding Section 6.0 Place of Performance for the contractor’s facility. If the Prime Contractor does not account for facility costs within any of the indirect labor rates, can the Prime Contractor propose direct facility costs associated with the performance of this effort under the ODC CLIN since facilities are required in performance of the contract?

A26. No.

Q27. Regarding Section 6.0 Place of Performance, if the Prime contractor is using a subcontractor facility for the place of performance and the subcontractor does not account for facility costs within any of the indirect labor rates, can the Prime Contractor propose direct facility costs associated with the performance of this effort under the ODC CLIN since facilities are required in performance of the contract?

A27. See Question 16.

Q28. Section C, para 6.1.5 Resources states a “minimum of five dedicated workstations”. It would be better to know the maximum space or “up to” some government defined required amount. Using the term “minimum” leaves the potential amount unlimited and thus a risk and burden for the Contractor. Can the government define the space accordingly also using maximum (or minimum and maximum) requirements?

A28. The Government will not provide a maximum.

Q29. Why are key positions only listed for 940 hours per year?

A29. See question 18.

Q30. To be able to identify and hold staff available, what are the tentative date(s) for the Oral Presentations?

A30. The Government is not able to identify tentative date(s) for the Oral Presentations at this time. Although at this time the Government estimates that Orals will be held in March, there are many variables that could cause delay.

Q31. Do the two additional individuals permitted to attend the Oral Presentation for the 10 minute introduction but not in the presentation team need to be listed in the level of effort and pricing information and have hours assigned to them?

A31. No, they do not need to be proposed individuals.

Q32. Regarding Patra C-TXT-18 Key Personnel. Does sub para (f) apply to all personnel assigned to the contract or just the four required key personnel?

A32. Section (f) of C-TXT-18 only applies to proposed key personnel.

Q33. L-TXT-38 states the Prime Contractor electronic submission shall contain only 5 files, (4 PDFs, and 1 excel file for the cost proposal. In order to include the cost build-up with functioning formulas in the Price/Cost submission, as required in Section L, para 2.5 Cost Proposal Format, can the contractor add tabs to the “Attachment 6 Rate Sheet” MS excel file to show the cost build-up and information required?

A33. Yes.

Q34. Does the Government have a specific file naming convention other than the details provided in Section L-TXT-38(b)?

A34. No, the Government does not have specific naming convention identified in L-TXT-38.

Q35. Regarding Attachment 6 submission from the Prime Contractor. Should the Prime Contractor also include the proposed subcontractor labor categories in its submission? If so, can it leave columns “E” and “F” blank and only include the information as required in column “G”?

A35. Modifications to Attachment 6 Rate Sheet are permitted.

Q36. In L-TXT-20 - ESTIMATED LEVEL OF EFFORT (JUN 2017) – and specifically in the first table of (quantity of hours for each labor category) - for labor categories Hardware Engineer, Software Engineer, Systems Engineer there is no associated Labor category description in N66001-17-R-0066 RFP Attach 04 Desired Personnel Qualififcations.pdf file. But there is Senior Hardware Engineer, Senior Software Engineer, Senior Systems Engineer labor descriptions. Should the quantity of hours for each labor category table in L-TXT-20 of the solicitation be updated to include Senior to these three labor categories so that it matches Attachment 4?

A36. A revised Attachment 4 will be provided.

Q37. In L-TXT-20 - ESTIMATED LEVEL OF EFFORT (JUN 2017) – and specifically in the first table of (quantity of hours for each labor category) - for labor categories *Cybersecurity Specialist, *Validator, and *IT Specialist there are associated Labor category descriptions in N66001-17-R-0066 RFP Attach 04 Desired Personnel Qualififcations.pdf file. However, in file N66001-17-R-0066 RFP Attach 04 Desired Personnel Qualififcations.pdf, there are also Senior Cybersecurity Specialist, Senior Validator, and Senior IT Specialist Labor Descriptions, but there are no associated hours listed in L-TXT-20’s quantity of hours for each labor category table.

Should hours be added to L-TXT-20’s quantity of hours for each labor category table for Senior Cybersecurity Specialist, Senior Validator, and Senior IT Specialist? Or should these labor category descriptions be disregarded or removed from file N66001-17-R-0066 RFP Attach 04 Desired Personnel Qualififcations.pdf?

A37. A revised Attachment 4 will be provided.

Q38. Should potential bidders assume the 180 day no substitution requirement for Key Personnel begins upon initial contract award (and not first task order award (in the case that these two events do no occur simultaneously)?

A38. The key personnel requirement IAW C-TXT-18 begins upon initial contract award.

Q39. Did the Government provision of the Solicitation.pdf file, after the provision of all other solicitation documents on 12/28/17, constitute a formal amendment/modification by the Government?

A39. No.

Q40. Part 15 of the Reference Information Sheet requires offerors to provide a summary description of contract work, not to exceed two (2) additional single-sided pages in length, for each cited reference. In completing these summary descriptions, offerors must explain the relevance of each cited reference with respect to this RFP’s SOW.

Will the Government allow 8-point font for this portion, Part 15, of the response given that Attachment 2 is 8-point font?

A40. Yes this is allowable.

Q41. Is it the Government's intention to not include a volume addressing the remaining task areas and management sections? If you want us to include these sections, where should we address them?

A41. The Government does not understand the question.

Q42. How many individual (unique) RMF/DIACAP packages are under the C4ISR? Are the requirements in this section for one over-arching network, or for multiple systems/networks?

A42. C4ISR is an over-arching term for a subset of Information Systems type; C4ISR systems make up only a portion of the RMF/DIACAP systems that would be supported under this contract. Currently support for USCG C4ISR consists of multiple systems/networks. This contract will support a myriad of RMF/DIACAP packages for existing and new business opportunities for all DoD and DHS entities.

Q43. When discussing security control assessments and validations, is it safe to assume that these are unofficial and for internal preparation purposes only? It is our understanding and experience that official security assessments or validations must be completed by independently appointed teams.

A43. These are not "unofficial". We currently support independent verification and validations (IV&Vs) for the USCG, and are identified as such. Our results are utilized to populate RMF packages in pursuit of an Authority To Operate (ATO). We also support Command Cyber Readiness Inspections (CCRIs) for other DoD entities and fill the role of "independent" evaluation teams. Winning respondent will integrate with SSC-PAC Teams to conduct "official" Security Control Assessments and IV&Vs.

Q44. What steps in addition to the OCI clause will the Government take to ensure that no proposed bidder has an unfair competitive advantage resulting from unequal access to information, biased ground rules, or impaired objectivity?

A44. The Government takes appropriate steps to ensure a fair competitive environment exists.

Q45. Section 2.1.4 Risk states, "Although risk is not a separate evaluation factor, it is a consideration throughout the source selection process. Consideration of risk is inherent in the evaluation of deficiencies and weaknesses at the evaluation factor level, and in the trade-off analysis." Risk will not be evaluated, but considered. Should we include Risk in our proposal response?

A45. The inclusion of risk in a proposal response is at the discretion of the offeror.

Q46. Section 2.2 Past Performance Factor states, "…Past Performance relevancy will be rated as follows: Very Relevant, Relevant, Somewhat Relevant, or Not Relevant." and "...The Government will review this past performance information and determine the quality and usefulness as it applies to a performance confidence assessment as follows: Substantial Confidence, Satisfactory Confidence, Neutral Confidence, Limited Confidence, or No Confidence." What is the Government’s definition for the relevancy and confidence ratings?

A46. The Government will follow the DoD Source Selection Procedures, to include the standard definitions.

a. Does this mean that the five Key Personnel for the Oral Presentation are required to possess current and active TS/SCI clearances?