Questions and Answers 1 Sept 2021.pdf

Question 1: Are offerors still required to provide a price/CLIN for obtaining an ATO for this contract? Or, in the alternative, does the OIG plan on leveraging an existing HHS ATO the offeror has, if available. The additional language for H.2 states, “Security Documentation should include as a minimum, the System Security Plan, contingency plan, incident response plan, Plan of Action and Milestones, and the Security Assessment Report from the third-party independent assessment.”

Answer: If an offeror does not have a current ATO, then yes, they need to provide price/CLIN for obtaining an ATO for this contract.

OIG could potentially leverage the documentation from the HHS ATO, but OIG would still need to assess and provide an internal OIG ATO.

Question 2: Understanding these are sensitive documents, when is the successful offeror required to submit the minimum-Security Documentation to the OIG? Within 15 calendar days of contract award?

Or is this a topic of discussion during the On-Boarding Meeting?

Answer: OIG would discuss beforehand and try to get the documentation as soon as the awardee is willing to provide it. A delay in receiving the documentation would delay the ATO, which will delay the start of work.