Amendment_003.docx

NAMA-17-R-0003, Amendment 003

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

National Archives & Records Administration Same as Block #6

8601 Adelphi Road - Room 3340

College Park, MD 20740

9B. DATED (SEE ITEM 11)

04/07/2017

10A. MODIFICATION OF CONTRACT/ORDER NO.

10B. DATED (SEE ITEM 13)

CODE

FACILITY CODE

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

[X ]The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers [X] is extended, [] is not extended.

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing Items 8 and 15, and returning __1__ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGEMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor [ ] is not, [ ] is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

Solicitation: NAMA-17-R-0003 for Logic Access Control System (LACS) Integration services.

1. The RFP is hereby amended as follows: See Attachment 1, Contractor Questions and Answers below.

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

Contracting Officer

(Signature of person authorized to sign)

(Signature of Contracting Officer)

NSN 7540-01-152-8070

PREVIOUS EDITION UNUSABLE

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA FAR (48 CFR) 53.243

ATTACHMENT 1

CONTRACTOR QUESTIONS AND ANSWERS

Question 1: In Attachment 8, item 2.b., the RFP indicates that the Past Performance Questionnaires must be returned by the proposal due date and time (7 April 2017, 3:30 PM). However, on the Past Performance Questionnaire form (Attachment 10), the return date is shown as 31 March 2017, 3:30 PM. Can you please clarify the required Past Performance Questionnaire return date and time?

Answer 1: Past Performance Questionnaires are due on April 24, 2017.

RFP Change: In Attachment 10, Past Performance Questionnaire, is amended to read: “Please take a moment to complete the enclosed questionnaire and email the completed and signed questionnaire to the contact listed below by 3:30 PM ET on April 24, 2017.”

Question 2: After review of the Solicitation requirements there is a slight discrepancy where we needed some additional clarification before preparing our response. We noticed that the scope of work in the Sample Task Order exceeds what is being requested to be priced out in Proposal Submission Instructions Enclosure 1 Sample Task Order Pricing on page 64 and 65 of the Solicitation.

For example, in Attachment 2 Sample Task Order PWS page 2 includes PWS Section 3.2.2.1, but there is no indication that this portion of the PWS needs to be priced out in the Proposal Submission Instructions Enclosure 1 Sample Task Order Pricing.

Was it NARAs intention to leave out certain sections of the Sample Task Order PWS in the Pricing instructions or should responses Price out every PWS section listed in the scope of work?

Answer 2: Not every PWS section listed requires separate pricing in the sample task order. For the example listed, the Vendor should include those costs as part of the monthly O&M. The Vendor can assume that either the costs for not separately priced PWS sections must be included as part of O&M. i.e. every deliverable listed with “as needed” is to be priced as part of O&M.

RFP Change: NONE

Question 3: To allow sufficient time to review the Answers to questions and adjust our proposal response accordingly, can NARA extend the due date for receipt of proposals until two weeks after the date the Answers are provided by NARA?

Answer 3: Response time has been extended to April 24, 2017. Please refer to Amendment 002.

RFP Change: None

Question 4: Is the page count for the Draft Quality Control Plan included in the total proposal page count?

Answer 4: Yes, Volume I should be no more than 25 pages. See Attachment 8, Paragraph 6, Submission

RFP Change: NONE

Question 5: Are there existing systems that will need to be taken over for O&M on Day 1?

Answer 5: Yes.

RFP Change: NONE

Question 6: The solicitation posted on FBO states that this is an Unrestricted full and open RFP. Therefore, can FAR 52.219-14, Limitations on Subcontracting, be removed from Attachment 6, page 48 (since it should not be applicable)?

Answer 6: Yes, this clause is for small business set-aside and has been removed.

RFP Change: Delete FAR Clause 52.219-14.

Question 7: Is there an appetite to move away from the current tool suite?

Answer 7: No, NARA does not have any plans to move away from current tool suite.

RFP Change: NONE

Question 8: "NARA’s objective is to obtain professional services for the design, testing, implementation, deployment, and continuous operational support for NARA’s HSPD-12, Personal Identity Verification (PIV) 2, LACS, and overall IDMS." Do any of the IDMS systems currently exist within Production/Operations?

Answer 8: Yes.

RFP Change: NONE

Question 9: "The Contractor must support the implementation of technical mandatory authentication to the network for all NARA users." Ultimately, will the O&M for this contracted effort include the "ownership" (and O&M) of all authenticating systems/technologies? Or will the underlying authenticating platforms remain on their existing, "external" contracts? In other words, are underlying technologies like "e-Directory, with subordinate Active Directory domains used by specific applications" (specified in Section 1.2) within the support and maintenance boundary of this contracted effort or will they be external to the contractor's scope (assuming Tier 3 support coordination with existing "NARA Contractors" is limited to IDMS interface)?

Answer 9: O&M for underlying technologies like e-Directory and Active Directory is not a part of this contract.

RFP Change: NONE

Question 10: "Provide Tier 3(**) level of support of the Enterprise eDirectory, Active Directory, LDAP, Public Key Infrastructure (PKI), and Sentinel SIEM systems." "Provide Tier 2 and Tier 3 level of support for NARA-wide PIV authentication deployment." Can NARA further define Tier 2 and Tier 3 support as it relates to this contracted effort? The definitions will support creation of a staffing plan that meets NARA's needs.

Answer 10: Tier 2 support relates to work needed to troubleshoot Identity Management issues once Tier 1 has confirmed that the cause is not related to Information Systems that Tier 1 staff directly supports (endpoint workstations, Active Directory, eDirectory, infrastructure devices, etc..). Tier 3 is the top level support tier provided by the specialists who can provide support to Tier 2 staff in case troubleshooting needs to be escalated.

RFP Change: NONE

Question 11: In the last two sentences, what is the difference between NARA's Identity and Access Management (IAM) system and the NARA Identity Management System (IDMS)?

Answer 11: These are the same system.

RFP Change: NONE

Question 12: What is the FIPS 199 security categorization of the NARA IAM systems? Low, moderate, or high?

Answer 12: Moderate.

RFP Change: NONE

Question 13: For on-call support, will remote access to NARANet be available and GFE (laptop & mobile phone) be provided?

Answer 13: NARA can provide a laptop and mobile device for each contractor.

RFP Change: NONE

Question 14: Why are desktops included in the requirement for derived credential LACS?

Answer 14: Desktops should not be there.

RFP Change: PWS and Sample Task Order PWS delete “and desktops”.

Question 15: Does NARA have a current ICAM architecture and/or general security segment architecture that defines the boundaries and interfaces for IAM? If so, can NARA share the current ICAM architecture?

Answer 15: See the GFI. GFI access will require a request to view and further require a Non-Disclosure by all parties or individuals wishing to view the GFI. After which point, a link will be provided to access the information. Please send requests for viewing GFI to Scott Cox at scott.cox@nara.gov.

RFP Change: NONE

Question 16: What are the eight Micro Focus Drivers in the current IDMS configuration?

Answer 16: The eight MicroFocus drivers are US Access SIP driver, NARA PACS Consolidated Interface driver, NARA HR IBC connector, NARA e-Directory Services driver, NARA Active Directory drivers, Micro Focus Identity Management systems, SecureAuth Web Based SSO driver, and Gmail Directory Services and System Authentication and Access Controls

RFP Change: NONE

Question 17: What programing language(s) are the current IDMS drivers written in?

Answer 17: XML

RFP Change: NONE

Question 18: Does the development of a “driver” also include Provisioning Request Definitions (PRDs) and associated workflow modeling and definition?

Answer 18: Yes.

RFP Change: NONE

Question 19: What type of interface is the IBC interface (web-services, socket, JMS)?

Answer 19: See GFI.

RFP Change: NONE

Question 20: What type of interfaces are supported by the HR Driver (e.g., web services SOAP based, java based, etc.)? Are there additional details on the requirements for the IBC interface that NARA is looking to implement?

Answer 20: DOI’s IBC accepts java based interfaces. See GFI for additional details.

RFP Change: NONE

Question 21: Are there additional details around the provisioning and workflow for new Contractor accounts? Are there default privileges and roles to be assigned to the base account information being created?

Answer 21: Current contractor provisioning and workflow are similar to standard user account creation, with no significant differences. Contractor supervisors need to have a NARA Government sponsor supply the request for a new contractor.

RFP Change: NONE

Question 22: Is there an existing identity proofing solution used to validate PIV users? If so, can NARA provide further information?

Answer 22: Identity proofing is provided by US Access General Services Administration Managed Service Office (GSA/MSO) for PIV card issuance.

RFP Change: NONE

Question 23: Does NARA use its own OCSP or SCVP devices to perform validation of PIV certificates or is validation provided by the GSA MSO SSP?

Answer 23: GSA MSO

RFP Change: NONE

Question 24: What are the counts of the numbers of Windows, Mac, and Linux systems to be managed under this contract?

Answer 24: There are approximately 5,000 Windows workstations, 200 Windows server, 400 SuSE Linux servers, and about 25 Mac workstations.

RFP Change: NONE

Question 25: Does NARA support the use of PIV cards issued by other government agencies and/or the use of PIV-I from trusted organizations?

Answer 25: No.

RFP Change: NONE

Question 26: Are there additional details on the remote access repository and product versions of the Citrix components? Can NARA provide the production versions of Citrix components for the remote access repository?

Answer 26: NARA’s production remote access environment uses a Citrix XenApp 6.5 farm and VPN access is on Citrix Access Gateway 10.5.

RFP Change: NONE

Question 27: Is there an existing PSS? If so, Is the PSS a public (internet-facing) web portal?

Answer 27: Yes, there is an existing PSS and it is internet facing.

RFP Change: NONE

Question 28: Can NARA provide details around the NARA user population and technical mandatory two factor authentication requirements? We would like to distinguish whether this is PIV authentication to Desktops and Windows network, or whether external users accessing NARA systems without PIV / PIV-I, etc.

Answer 28: NARA’s user population is approximately 5,000 NARA staff and contractors and NARA wants to make two factor authentication a requirement for them to log into NARANet. Additionally, as requested we will want these same NARA users to access NARA based application using two factor authentication with PIV cards.

RFP Change: NONE

Question 29: What is the current state of MFA at NARA? What is the current percentage use of PIV for logon?

Answer 29: Approximately 200 users currently use PIV for logon.

RFP Change: NONE

Question 30: Can NARA further define what it means by the "resolution" of revoked certificates?

Answer 30: PWS paragraph 3.3.1 deals to do with process reviews, including the certificate revocation process and verifying whether or not a certificate being used for authentication has been revoked or not. This includes ways for NARA Certificate Revocation List (CRL) will be regularly updated and cached by the IDMS in order to provide a service for quickly checking at the workstation and application level for valid certificates.

RFP Change: NONE

Question 31: What percentage of windows workstation users will be required to use PIV for logon?

Answer 31: 100%

RFP Change: NONE

Question 32: What percentage of workstations and servers have the required PIV reader hardware/software to support PIV-enabled authentication?

Answer 32: All workstations have PIV reader software, including NetIQ Enhanced Smart Card Method v3.1.

RFP Change: NONE

Question 33: To achieve compliance with PIV mandatory requirements, is NARA using machine based enforcement or user based enforcement, or a combination of the two?

Answer 33: NARA has not yet made PIV mandatory for all users. NARA is currently using user based enforcement for PIV logins by privileged users.

RFP Change:

Question 34: What is the current reporting interface used by system owners?

Answer 34: NetIQ Sentinel v7.4

RFP Change: NONE

Question 35: Does NARA currently have a program/tool in place for managing privileged users? If so, can NARA provide the details of this solution?

Answer 35: NARA policy is that all users with elevated privileges must use their PIV cards to log into their workstations.

RFP Change: NONE

Question 36: Aside from Lenel, how many other PACS/vendor implementations need to be supported?

Answer 36: Lenel is currently the only PACS vendor used by NARA but we would require support for any other PACS implementation at any future NARA facilities.

RFP Change: NONE

Question 37: Does NARA currently have a PIV mandatory solution for accounts with elevated privileges?

Answer 37: See answer to question 35.

RFP Change: NONE

Question 38: Please define "technical mandatory conversion" and breakdown on the scope of this effort?

Answer 38: Technical mandatory conversion refers to the implementation of forced PIV card multifactor authentication for all NARA users to access NARANet.

RFP Change: NONE

Question 39: What is the estimated number of infrastructure devices that need to support PIV 2-factor authentication? Is there a list of infrastructure device products and versions that are included in the PIV enabled authentication requirement?

Answer 39: There are approximately 350 infrastructure devices. For details, including make, model, and version please see the GFI.

RFP Change: NONE

Question 40: For PIV SSO enablement of applications, what types of applications would be PIV-enabled in the base year (web apps, thick-client, mobile, mainframe)?

Answer 40: Primarily Web-based applications.

RFP Change: NONE

Question 41: What is the existing SLA around availability of application and infrastructure that is included in the PWS boundary? Are there existing requirements around return to operation after failover or disaster recovery events? Is the redundancy (clustering the NARA-PASS servers with servers at Archives II and ABL) to be configured and integrated as Hot – Hot, or failover capacity?

Answer 41: NARA does not yet have full requirements for this redundancy of IDMS. We expect it to be planned and implemented under this contract.

RFP Change: NONE

Question 42: Does NARA maintain its own PKI encryption key escrow for PIV encryption keys?

Answer 42: NARA does not have a PKI environment.

RFP Change: NONE

Question 43: What Level of Authentication (LOA) is required for derived credentials?

Answer 43: LOA-3.

RFP Change: NONE

Question 44: Does NARA require the contractor to enable and enforce PIV-enabled login for users of its GoogleMail or other email services? How about for Citrix logins? Further, what is required for mobile devices?

Answer 44: NARA requires the contractor to enable and enforce PIV-enabled logins for the Citrix environment. NARA may ask for an implementation plan to enforce PIV-enabled login for GoogleMail which is the current NARA email service. NARA is asking for a design of Derived Credential (PIV-D) LACS solution for all of the NARA mobile devices.

RFP Change: NONE

Question 45: What product(s) is/are being used, or planned to be used for mobile device management?

Answer 45: NARA uses AirWatch for mobile device management.

RFP Change: NONE

Question 46: Does an internal CA already exist, or does this need to be built? Are there details on the internal CA and interfaces that are available for integrating MDM solution for Derived Credential?

Answer 46: No internal CA exists.

RFP Change: NONE

Question 47: What products(s) is/are being used to provide Federated Identity Management

Answer 47: See GFI

RFP Change: NONE

Question 48: What products(s) is/are being used for the smartcard middleware?

Answer 48: All workstations have PIV reader software, including NetIQ Enhanced Smart Card Method v3.1, See question 32.

RFP Change: NONE

Question 49: Due to OCI, is the vendor that worked on the Roadmap and architecture precluded from working on this deal?

Answer 49: No, NARA has reviewed potential OCI.

RFP Change: NONE

Question 50: Does the National Archives and Records Administration (NARA) have any draft Strategic or Implementation plans for achieving HSPD-12 compliance, including LACS Integration? If so, can those be made available for consideration and use in response to the RFP?

Answer 50: See GFI.

RFP Change: NONE

Question 51: Has NARA piloted any single sign on (SSO) capabilities using NetIQ technologies? If so, what were the results of the pilot and what challenges to enterprise-wide LACS Integration were identified?

Answer 51: No pilots have been implemented.

RFP Change: NONE

Question 51 (a): What was the scope of the pilot, including applications and NARA facility locations involved?

Answer 51 (a): N/A

RFP Change: NONE

Question 51 (b):Was the pilot run on development environments that simulated NARA Production environments? If so, how did these environments mirror the existing NARA systems in terms of multiple instances, firewall settings, and software versioning of COTS components?

Answer 51 (b): N/A

RFP Change: NONE

Question 51 (c): Which vendors and NARA personnel were involved in the pilot, and will the NARA personnel involved be available to participate in the architectural analysis and LACS Integration implementation planning?

Answer 51 (c): N/A

RFP Change: NONE

Question 52: Many NARA systems use private authentication systems, such as a private LDAP that mirrors NARA centralized authentication systems and maintains application role(s) information for users. These private authentication systems are not integrated to NARA's central authentication systems, and are maintained concurrently. Given the mission critical nature of many of these systems, how will NARA coordinate application development and testing to support these systems through LACS Integration and SSO implementation?

Answer 52: NARA will ask for technical guidance to implement PIV logins for these systems.

RFP Change: NONE

Question 52a: At what level does NARA expect support of testing and refinement of these systems within the LACS Integration IDIQ?

Answer 52a: We expect testing and refinement for all systems in the PWS.

RFP Change: NONE

Question 52b: How will NARA support NetIQ license procurement, installation, and maintenance in development environments for testing of required changes to these applications?

Answer 52b: NARA will provide licenses. Contractor will install and maintain development and testing environment.

RFP Change: NONE

Question 52c: To what extent will NARA coordinate business unit (e.g. EOP, CRA, FOIA, etc.) involvement in the customer acceptance testing (CAT) verification of these systems before production?

Answer 52c: See GFI: SDLC process.

RFP Change: NONE

Question 53: NARA works with all federal agencies to schedule and legally transfer government records using NARA’s enterprise systems (e.g. ERA BOM); how will NARA support coordination of SSO for these applications with outside federal agency stakeholders?

Answer 53: NARA will ask for technical guidance to implement PIV logins to systems with external federal users as one of the 5 to 10 apps to add.

RFP Change: NONE

Question 53a: Will SSO capabilities be extended to non-NARA users of NARA enterprise systems?

Answer 53a: NARA will ask for technical guidance to implement PIV logins to systems with external federal users.

RFP Change: NONE

Question 53b: If so, how will outside federal agency users of NARA enterprise systems coordinate and update user authentication?

Answer 53b: NARA will ask for technical guidance to implement PIV logins to systems with external federal users.

RFP Change: NONE

Question 53c: What level of guaranteed access and support will the HSPD-12 compliant LACS provide these users? Are there Service Level Agreements (SLA) currently in-place with these federal agencies?

Answer 53c: No SLAs are in place. NARA will ask for technical guidance to implement PIV logins to systems with external federal users.

RFP Change: NONE

Question 54: Can the Government provide the data on the service desk calls related to this implementation?

Answer 54: Unknown because the system is not fully implemented.

RFP Change: NONE

Question 55: What is the On-boarding frequency per quarter?

Answer 55: Approximately 200 users per quarter.

RFP Change: NONE

Question 56: How many independent directory service enclaves are in the scope? Is classified (secret/top secret) and unclassified directory services?

Answer 56: Yes, NARA will ask for technical guidance to implement PIV enabled logins on classified systems. For details see GFI.

RFP Change: NONE

Question 57: What is the total number of current users?

Answer 57: Approximately 5,000 users

RFP Change: NONE

Question 58: How many applications are in the scope?

Answer 58: See PWS paragraph 3.2.2

RFP Change: NONE

Question 59: How many environments cannot be accessed through DMZ/external access points?

Answer 59: All classified environments are inaccessible through the DMZ.

RFP Change: NONE

Question 60: How many POAMS around IDMS/IAM/LACS systems?

Answer 60: None.

RFP Change: NONE

Question 61: How many external agencies users are currently authenticated to access NARANET & ERA?

Answer 61: Approximately 750 external agency users have accounts to ERA; none have access to NARANet.

RFP Change: NONE

Question 62: Is ERA instances considered to be within the scope of this implementation

Answer 62: It is within the scope of the IDIQ contract.

RFP Change: NONE

Question 63: What is the level of ITIL maturity level implemented at NARA?

Answer 63: NARA has not been formally audited under the ITIL framework.

RFP Change: NONE

Question 64: Who is current incumbent for IDMS/IAM/LACS systems?

Answer 64: The system is currently supported in O&M only (no development) by NARA Information Technology and Telephone System Support.

RFP Change: NONE

Question 65: Are there any other off-premises cloud services in place besides from Gmail?

Answer 65: See GFI for further details, however, among them are AWS, ADAPT, and the Security Clearance Tracking System

RFP Change: NONE

Question 66: Is the HA and DR infrastructure for current IDMS/IAM/LACS systems in place?

Answer 66: No

RFP Change: NONE

Question 67: What is the maturity level for current Single Sign On and 2Factor Authentication?

Answer 67: Currently PIV 2Factor Authentication (2FA) is enforced for NARANet access for all privileged users. All regular users and privileged users use 2FA through SecureAuth for Citrix Remote Access and remotely accessing Google Email.

RFP Change: NONE

Question 68: What authentication method is used for Data egress and ingress from external agencies?

Answer 68: The users are authenticated using LDAPS.

RFP Change: NONE

Question 69: What is the current state of HSPD12 compliance maturity level?

Answer 69: Currently PIV 2Factor Authentication (2FA) is enforced for NARANet access for all privileged users. All non-privileged NARA staff have the ability to log into NARANet with their PIV cards but this is not currently mandatory.

RFP Change: NONE

Question 70: Which organization with OCIO is responsible for managing the current IDMS/IAM/LACS?

Answer 70: Information Services

RFP Change: NONE

Question 71: Is the directory services (eDirectory) connects with the subordinate directory domains in ll enclaves?

Answer 71: Yes.

RFP Change: NONE

Question 72: Is the enterprise Password Self Service Portal in place?

Answer 72: Yes.

RFP Change: NONE

Question 73: How many distinct internal/external organizations the vendor is expected to establish the OLAs?

Answer 73: One.

RFP Change: NONE

Question 74: Can the Government provide access to the NARA access control guide?

Answer 74: See GFI.

RFP Change: NONE

Question 75: For FFP TOs, will the Government provide clearly defined Acceptance criteria?

Answer 75: Inspection and acceptance will be in accordance with FAR 52.212-4(a), unless otherwise stated within individual task orders.

RFP Change: NONE

Question 76: Can the government clarify that the iOS iPAD Application Updates are driven by IDMS/LACS team?

Answer 76: They are not expected to do those updates.

RFP Change: NONE

Question 77: What are the Hardening guidelines for mobile devices and remote access?

Answer 77: NARA is unable to provide this information.

RFP Change: NONE

Question 78: Can the Government clarify the period of transition?

Answer 78: There is no period of transition.

RFP Change: NONE

Question 79: There is a maximum number of five past performances. Is there a minimum number as well?

Answer 79: No

RFP Change: NONE

Question 80: Is there a particular format and page limit for the other proposal responses? Understanding that there is a 25 page limit for the task order response?

Answer 80: Unless there are specific page limits or restrictions listed in the RFP , formatting of other proposal responses is up to the offeror. See paragraph 6(a). for details.

RFP Change: NONE

Question 81: Is it possible to get an extension for submission-ATTACHMENT 10 RELEVANT PAST PERFORMANCE QUESTIONNAIRE?

Answer 81: The Past performance is due concurrently with the proposal submission, which has been extended to April 24, 2017.

RFP Change: See RFP change in Question 1.

Question 82: Is there currently an incumbent for this work? If so, can you provide the name, period of performance and size of current contract?

Answer 82: There is no incumbent.

RFP Change: NONE

Question 83: Does NARA have a target timeline or any specific deadlines that will drive your program schedule?

Answer 83: Refer to Sample Task PWS 6.0, Deliverable due dates.

RFP Change: NONE

Question 84: Will the government provide the expected on-call hours of operation for the IDMS including Weekday, Weekends, and Holidays?

Answer 84: PWS paragraph 2.3

RFP Change: NONE

Question 85: Please clarify if NARA intends to use the existing architecture outlined in 3.2.1 or if you would like the vendor to provide an evaluation and recommendation for a new architecture?

Answer 85: We intend to use the existing architecture with modifications.

RFP Change: NONE

Question 86: Is NARA using Office 365 as a platform or planning to in the future?

Answer 86: NARA does not currently use Office 365. NARA cannot comment on future use.

RFP Change: NONE

Question 87: Please provide a list of cloud services that NARA is using or planning to use.

Answer 87: See GFI.

RFP Change: NONE

Question 88: Can you describe the CA being used by NARA? Do you have full management control of your environment?

Answer 88: see GFI.

RFP Change: NONE

Question 89: Are there any existing external IDP or any plans to implement an external IDP?

Answer 89: No.

RFP Change: NONE

Question 90: Does NARA have different requirements for Secret and non-Secret access?

Answer 90: NARA will ask for technical guidance to enable PIV logins for classified systems.

RFP Change: NONE

Question 91: If system support includes existing systems, will we be performing transition from incumbent?

Answer 91: There is no incumbent to transition from.

RFP Change: NONE

Question 92: NARA references 5 high value applications. What are these applications? Are these legacy applications?

Answer 92: See GFI.

RFP Change: NONE

Question 93: PWS Section 3.9.5.3, This section references 'Desk side support response' in the service levels. What is meant by 'Desk side support'?

Answer 93: Working with Tier 1 helpdesk to resolve tickets related to IDMS.

RFP Change: NONE

Question 94: Would NARA add a requirement for change management support services to the IDIQ list of possible scope of services?

Answer 94: See GFI for NARA’s existing Change Management support information.

RFP Change: NONE

Question 95: CLIN 001, 0013, 0015, 0017, 0019; In order to provide accurate FFP pricing for O&M, we request that NARA provides a detailed set of requirements and list of applications requiring O&M services broken out by year.

Answer 95: Based off the deliverables list in the Sample Task Order, all deliverables that are to be delivered “as needed” are to be considered O&M.

RFP Change: Relevant CLINs formerly listed as O&M now read O&M & Ad Hoc Work/Deliverables to account for miscellaneous tasks.

Question 96: CLIN 001, 0013, 0015, 0017, 0019; For each existing/legacy application requiring O&M support, please provide the following information:

Question 96a: Name of vendor providing O&M support, as well as number of FTEs and location of resources.

Answer 96a: The system is currently only supported at Tier 1 by the NARA Information Technology and Telephone Systems Support desk. We are unable to provide the number of FTE’s.

RFP Change: NONE

Question 96b: Number of environments broken out by non-production vs. production. Where are these environments being hosted?

Answer 96b: One in production, hosted locally at A2

RFP Change: NONE

Question 96c: Number of 'named' users (total users) of the application(s) and number of 'active' users of the application(s)?

Answer 96c: There are 5,000 NARA users

RFP Change: NONE

Question 96d: Average monthly ticket volume.

Answer 96d: average 60/mo related to account creation

RFP Change: NONE

Question 96e: Is there a Level 1 Help Desk? What percentage of tickets does the Level 1 Help Desk resolve?

Answer 96e: Yes. Currently, 100% of tickets are resolved by Level 1.

RFP Change: NONE

Question 96f: Tools currently used for service management (help desk ticketing).

Answer 96f: Remedy

RFP Change: NONE

Question 96g: Volume of third party technical support requests. Do these support requests go through Remedy?

Answer 96g: Yes, all tickets go through Remedy

RFP Change: NONE

Question 97: CLIN 002-0011; The STO document appears to have almost the same scope of IDIQ PWS; however the STO Pricing (IDIQ PWS Enclosure 1, page 64) has CLINs for only particular PWS requirements. Can you confirm that the STO response should only include the scope identified on the IDIQ STO Pricing (IDIQ PWS Enclosure 1, page 64), not the full set of STO requirements listed in the separate document?

Answer 97: Yes

RFP Change: NONE

Question 98: CLIN 002-0011; If the STO response should only include those PWS requirements listed on the STO Pricing (Enclosure 1, page 64), should the all sub-requirements be included for the PWS Requirements listed as applicable (e.g. 3.3.3.1-3.3.3.3, 3.6.1)?

Answer 98: The sample task order is a basic order for O&M and additional requirements, i.e. several implementation plans. 3.3.3.1-3.3.3.3 falls under the requirement of 3.3.3 or CLIN 0005. 3.6.1 follows 3.6 (CLIN 0007). You should build your proposal accordingly.

RFP Change: NONE

Question 99: Can the government describe the software development environment expected to be used to develop the drivers outlined?

Answer 99: NARA has a test lab that include eDirectory, IDM Vault, and Active Directory environment similar to the production NARANet for software development and testing.

RFP Change: NONE

Question 100: Is it the government’s intention that after development of an IDMS driver for the new Active Directory environment that the contractor would conduct the bulk import of those identities, desktops, OS servers, and any other legacy AD objects?

Answer 100: No.

RFP Change: NONE

Question 101: Can the government provide high level parameters to the Citrix remote access system including number of servers and/or integrated server appliances including NetScalers?

Answer 101: NARA’s production remote access environment uses a Citrix XenApp 6.5 farm and VPN access is on Citrix Access Gateway 10.5.

RFP Change: NONE

Question 102: Can the government provide the current PKI architecture including current Certificate Authorities being employed?

Answer 102: See answer to 46.

RFP Change: NONE

Question 103: Can the government outline an example system that is expected to be integrated into the IDMS?

Answer 103: See GFI

RFP Change: NONE

Question 104: Requirements 3.6 and 3.6.1 (Standard User Management) are included in the STO but not in the IDIQ. Can NARA please confirm and update as appropriate?

Answer 104: Added to the IDIQ level PWS.

RFP Change: Attachment 2, has been amended to include Standard User Management 3.6 and 3.6.1. Original paragraphs have been rearranged as follows:

3.6 change to 3.5

3.5 change to 3.8.1

Question 105: Can the government provide an estimate on how many systems will be required to be configured?

Answer 105: One system

RFP Change: NONE

Question 106: Can the government either outline the current MDM solutions being used by NARA or limit the integration of PIV-D LACS capabilities to one specific MDM solution?

Answer 106: NARA’s existing MDM solution is VMware AirWatch

RFP Change: NONE

Question 107: Is the current IDMS solution stack being used for the NARA Public Access Security System (NARA-PASS) or is there a separate system that is expected to be supported by the contractor?

Answer 107: No separate system.

RFP Change: NONE

Question 108: Can the government explain what its expectation of a generic NARA-PASS interface would constitute?

Answer 108: NARA-PASS will be a full registration system for external users (Researchers). Deliver first application integration with the application yet to be determined. The interface should be 508 compliant.

RFP Change: NONE

Question 109: Requirement 3.12.5.1.9 for End User Training Documentation is included in the STO but not the IDIQ. Can NARA please confirm and update as appropriate? We would also encourage NARA to add change management support under the list of possible services within the IDIQ.

Answer 109: Added to IDIQ PWS 4.2.5.6

RFP Change: Attachment 2, PWS, adds Para “4.2.5.6 Provide end user training documentation.”

Question 110: The solicitation includes an Attachment 2 which closely resembles the Sample Task Order PWS (also referenced as Attachment 2) provided as a separate document. Which Attachment should be considered when preparing the required Sample Task Order technical and price submission?

Answer 110: This should be built off of the Solicitation Attachment 2 PWS Sample Task Order.

RFP Change: NONE

Question 111: Attachment 4, "Performance Requirements Summary (PRS)" identifies RS-5 as the requirement for Quality Control. However, the referenced PWS paragraph refers to the requirement for a Project Management Plan. Please confirm the stated purpose of this Requirement Summary Item with a correct PWS reference.

Answer 111: Quality Control is Paragraph 8.0. The PRS paragraph has been updated to 8.0.

RFP Change: Attachment 4, Performance Requirements Summary (PRS), change to “(RS-5) Quality Control PWS paragraph 8.0”

Question 112: Attachment 5, "Additional NARA Terms and Conditions" part 13.(b) states that personnel assigned to fixed-price task orders are precluded from working on Time-and-Materal and/or Labor Hour task orders. Please define the purpose associated with this condition as greater flexibility will likely be required. For example, a particular engineer may have a specialized skill that is needed to complete a portion or all of a fixed fee requirement. At the same time, this engineer may also have skill sets needed to address requirements on Time-and-Material and/or Labor Hour task orders during a similar period. As long as the product associated with the fixed fee task order is being delivered within stated timeframes and budget allowances why does this preclude an individual from working on a Time-and-Material and/or Labor Hour task order - especially if their commitment on the fixed fee task order is less than a full time commitment?

Answer 112: This is a billing concern.

RFP Change: NONE

Question 113: Attachment 8, "Proposal Submission Instructions" includes Enclosure 1 which establishes the pricing template for the Sample Task Order as well as the option years. The following questions stem from this enclosure.

Question 113a: Is is possible to better define the specific PWS tasks included in CLIN 0001, Operations and Maintenance (O&M)? For instance, there are many PWS tasks that are excluded by specific reference in the enclosure. Is each of these tasks part of the O&M CLIN? Examples include the majority of the tasks in 3.2.2 "Development, Testing, and Release of New Architecture(s) or changes to the IDMS", 3.4 "Implementation of improved reporting from US Access…,", 3.9 "System Support Tasks", or 3.12 "NARA Public Access Security System". Again, please define which PWS tasks should be included when pricing CLIN 0001

Answer 113a: Based off the deliverables list in the Sample Task Order, the “as needed paragraphs” are to be considered part of the O&M CLIN.

RFP Change: NONE

Question 113b:Related to question above, if the PWS tasks not specifically identified in Enclosure 1 and are not included in CLIN 0001 (depends on the Answer to the above question) - are these tasks considered optional for the Sample Task Order? If optional, how should these tasks be priced?

Answer 113b: All “as needed” should be included in O&M CLIN.

RFP Change: NONE

Question 113c:CLIN 0004 references PWS 3.2.2.2.8.1 which is a child to task 3.2.2.2.8 requiring the integration of Digital and Encryption certificates into the IDMS in support of the NARA initiative to digitally sign all documents using PIV Card Signing Certificates. Should the effort to integrate the required certificates be included in this line item as well as creating the referenced implementation plan?

Answer 113c: The Sample Task Order has been amended for clarity. They should be two separate tasks under the broader heading of 3.2.2.2.8.

RFP Change: RFP Sample Task Order, Pg 3 has been amended:

3.2.2.2.8 PIV Card Certificate Authority

3.2.2.2.8.1 Create implementation plan for Internal NARA Certificate Authority (CA) for all users to sign all documents using PIV Card signing certs

3.2.2.2.8.2 Integrating the Digital Signature and Encryption certificates into the IDMS in support of the NARA Initiative to digitally sign all documents using PIV Card signing certs

Question 113d:CLIN 0005 references PWS 3.3.3 requiring a Contingency Plan for backing up and restoring configurations of the IDMS. The PWS includes three child tasks (3.3.3.1, 3.3.3.2, 3.3.3.3) associated with this effort. Should these child tasks be estimated and priced as part of this CLIN?

Answer 113d: Child Tasks should be rolled up into the the total cost of CLIN 0005.

RFP Change: NONE

Question 113e:CLIN 0009 requires an implementation plan for all PAC systems. How many different PAC systems are utilized by NARA?

Answer 113e: One.

RFP Change: NONE

Question 113f:CLIN 0010 references PWS 3.11 requiring the design of a Derived Credential (PIV-D) LACS solution for all NARA mobile devices. PWS 3.11 includes five child tasks (3.11.1, 3.11.2, 3.11.3, 3.11.4, 3.11.5) associated with this effort. Should these child tasks be estimated and priced as part of this CLIN?

i. If the child tasks are included, we are required to integrate with existing Mobile Device Management (MDM) solutions. Please define which MDMs are currently in use by NARA.

Answer 113f: Child Tasks should be rolled up into the total cost of CLIN 0010. NARA’s existing MDM solution is VMware AirWatch.

RFP Change: NONE