NND16588197Q_Amendment003.pdf

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing items 8 and 15, and returning or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment your desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT 1. CONTRACT ID CODE

2. AMENDMENT/MODIFICATION NO. 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQ. NO. 5. PROJECT NO. (If applicable)

7. ADMINISTERED BY (If other than Item 6) CODE

STANDARD FORM 30 (REV. 10-83)

Prescribed by GSA FAR (48 CFR) 53.243

FACILITY CODE

9A. AMENDMENT OF SOLICITATION

NO.

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NO.

10B. DATED (SEE ITEM 13)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended, is not extended.

12. ACCOUNTING AND APPROPRIATION DATA (If required) copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO.

IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15C. DATE SIGNED

15A. NAME AND TITLE OF SIGNER (Type or print)

16C. DATE SIGNED

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

PAGE OF PAGES

6. ISSUED BY CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code) (X)

CODE

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

16B. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

NSN 7540-01-152-8070

Previous edition unusable

The purpose of this amendment is to answer questions received from interested vendors. Questions and answers can be found on page 2.

NASA Armstrong Flight Research Center P.O. Box 273 M/S S323 Edwards, CA 93523-0273

All offerors

NND16588197Q

1 3

09/02/2016

08/25/2016

NND16588197Q Amendment 0003 September 2, 2016

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

1) How many of the MODERATE-impact security controls stated in NIST SP 800-53 Rev. 4 are currently being implemented and therefore in scope for this assessment?

Of the 261 controls in SP 800-53 Rev 4 that were reviewed and implemented by the team managing this IT System, some are Marked Not-Applicable. It is the job of the assessor to validate the rational for choosing to implement or not implement the controls. So all 261 controls are in scope.

2) Just to confirm - The new deadline date is September 9th. Please what time on this day is the cutoff time?

Yes, see amendment 2.

3) Is there a sampling standard/policy (i.e. NASA's policy/ standard governing the size of and the methodology used in selecting samples from populations for assessment)?

Yes, see the Pricing and Sizing document that was provided, look on page two for the instructions, the FIPS 199 standard is available publically.

4) Does NASA expect all the phases/tasks of the assessment performed on-site at NASA's facility or is the Vendor allowed to perform some of the tasks that do not require that the Vendor's assessment team be on-site at the NASA facility?

No, the first phase is normally done with remote collaboration, to reduce costs many aspects could be done remotely. NASA will provide remote collaboration tools if needed. (Webex and call in number and the large file transfer service to share documents)

5) We are going with the expectation that the NASA's current system security plan (SSP) contains all NASA's implemented MODERATE-level security controls for the system. When will this document be shared with the selected vendor? .....Pre kickoff meeting/during kick off meeting or post kick off meeting?

Yes, the System security Plan documented with the Moderate NIST 800-53 Rev 4 controls will be one document of many required documents that will be provided to the Vendor selected to perform the assessment. The delivery method of the SBU documents will be discussed after the award. (Large file transfer or encrypted email)

NND16588197Q Amendment 0003 September 2, 2016

6) Can we submit our response before the new deadline of September 9th if we are done?

Yes

(END OF AMENDMENT)