Q and As_Part 2 of 2_OPM32-11-R-0018.pdf

SOLICITATION: OPM32-11-R-0018 QUESTIONS AND ANSWERS (PART 2 OF 2) AMENDMENT #000004 Dated: 10/19/2011

76Q Please clarify that the subcontracting goal for large businesses is 25% and no specific sub-category breakdowns by SBA small business categories (e.g., WOSB, HUBZone, SDVOSB). If the subcontracting goal is not 25%, please indicate the correct subcontracting goal.

76A See Amendment #3, Attachment II for OPM subcontracting goals

77Q Please verify our assumption that a QASP is not required with an offeror’s BPA proposal. On the other hand, if it is required, please specify where it should go in the technical volume and if it counts against the 60 page limit for that volume .

77A QASP may be required at the BPA Call level. The format in the RFP is a sample that a BPA Holder will be required to submit, if applicable to the Call.

78Q Ref.: Amendment 2, Attachment 1, D.3.2.3 Disaster Recovery and Continuity of Operations (page 57). In D.3.2.3, OPM requests technical support staff for Disaster Recovery and Continuity of Operations, but D.3.2.6.j makes no mention of providing technical support staff. Please clarify which section is correct.

78A Technical support from the staff is required during a declared disaster event when the processing is hosted at the out-of-area Disaster Recovery location. In the event of a total destruction of the TRB facility and the loss of all staff, provisions are in place to reconstitute operations in the Disaster Recovery location using procedures which are initially accomplished by the hosting facility. What would be needed is out-of-area staff available who are trained z/OS Sysplex Systems Programmers.

79Q Ref.: Amendment 2, Attachment 1, D.3.2.4 Environment (page 57). Please provide a list of the software products currently developed for, leased by, or commercially purchased for the Environment that the contractor may need to have expertise using. Also, how many years of experience is required to effectively maintain these products?

79A Response :

(a) : IBM products such as: z/OS, JES2, ESCON Director Support, Resource Access Control Facility (RACF), EREP, High Level Assembler, ICKDSF, ISPF, TSO/E, High Level Assembler, 3270 PC File Transfer Program, First Failure Support Technology, TIOC, HCD, SMP/E, Language Environment, TCP/IP, z/OS UNIX System Services, GDDM, RMF, SDSF, Secureway Security Server, Communications Server, Tivoli Workload Scheduler for z/OS, Tivoli Workload Scheduler for Applications, Tivoli NetView, Software Diversified Software’s VIP & VSV, Tivoli System Automation for z/OS, Tivoli Storage Manager for z/OS and USS, Tivoli Storage Manager for DBS, CICS Transaction Server, WebSphere Application Server, IBM HTTP Server, IBM Telnet Server, SNAPSHOT, SNAPSHOT Space Efficient, Workload Manager, FORTRAN, Enterprise COBOL for z/OS, Ditto/MVS, DFSMSdfp, DFSMSrmm, DFSMSdss, DFSMShsm, DFSort, CICS VSAM RECOVERY, OSA/SF, Host Integration Services (Host-on-Demand, PCOM, Host Access Transformation Services), JAVA/J2EE, Host Access Transformation Services (HATS), WebSphere CL/Supersession, DB2 for z/OS, DB2 Utilities Suite, Tivoli Composite Application Manager, Tivoli Tape Optimizer, WebSphere Message Broker, WebSphere Message Queue. .

z/VM, RACF/VM, Dirmaint, z/VM Performance Monitor, z/VM Realtime Monitor, ISPF/VM, RedHat Linux, SuSe Linux, IBM Tape Manager for z/VM, IBM Backup and Recovery Manager for z/VM, Tivoli System Automation for Multi-platforms, Tivoli Storage Manager for Application Servers WebSphere Application Server for zLinux, Tivoli Access Manager for eBusiness, IBM UDB/DB2, Oracle DBMS, Rational Application Developer, Rationale Application

SOLICITATION: OPM32-11-R-0018 QUESTIONS AND ANSWERS (PART 2 OF 2) AMENDMENT #000004 Dated: 10/19/2011

Developer for WebSphere, Rational Web Developer for WebSphere, Rational PurifyPlus, Rational Robot, Rational SoDA, Rational Rose, Tivoli Management Framework, DB2 UDB Enterprise Server, DB2 WEB Query, IBM DB2 Connect, IPTABLES, JAVA/J2EE,

(b) Software AG products such as: z/OS ADABAS for CICS & TSO, ADABAS Cluster Services, ADABAS Cache Facility, ADABAS SAF Security, Predict, Predict Application Control, Predict, NATURAL CICS & TSO, Natural Security, ADABAS Native SQL, ADABAS Online Service, Natural Construct, Natural Connection, Natural Optimizer Compiler, ADABAS Review DB, Review & Natural Monitor, Natural Construct, EntireX Communicator, Entire Systems Server, Entire Network, Entire Connection (PC product), SuperNatural.

(c) Compuware Corporation products such as: File-Aid/MVS, FileAid-Data Solutions, File-Aid RDX. Hiperstation for VTAM, AbendAid/MVS, AbendAid/CICS, Xpediter/MVS, Xpediter/CICS, Xpediter/Xchange,

(d) McKinney products such as: Adhoc Report Writer, CICS/Message, CICS DP Manager, CICS NEWS, CICS/OLFU

(e) Allen Systems Group products such as: TMON for MVS, TMON for CICS, Naviplex, Naviplex Client for Windows, Life Cycle Manager, Life Cycle Manager

Natural Predict

(f) BMC Software product: Control-D

(g) CapitalWare – zMQ Authenticate

(h) Cheryl Watson Software product: GoalTender

(i) ChicagoSoft product: MVS/Quick-Ref

(j) Computer Application Services products: JES2FTP, Report Splitter

(k) Computer Associates product: CA-VisionResults

(l) Computer Services International product: Data Miner/VSAMEasy

(m) Decision Technology products: Decision Analyzer, Decision Analyzer ADABAS Interface, Decision Analyzer Windows Client

(n) EMC Products such as: EMC ResourcePak Base for OS/390 and z/OS, EMC Symmetrix Host Component for OS/390 and z/OS, EMC Timefinder / Mirror

SNAP Facility, EMC Timefinder / Consistency Groups, EMCSPE, EMC SRDF / Data Mobility, EMC SRDF / Asynchronous

(o) Pitney Bowes software products such as: Code1Plus & USPS Database

(p) Innovation Data Processing products such as: FDR/CPK/ABR, FATS-FATAR

(q) IS Management Strategies: LPAR Usage and Capacity Analysis (LCS)

(r) Levi, Ray, and Shoup, Inc. Products such as: VTAM Print System, VTAM Print System / TCPIP, VTAM Print System / LCDS, VMCF/Web Access, Dynamic

Report System, and PageCenter

(s) Mainstar products such as: Catalog Recovery Plus, FastAudit 390, Tape Management Catalog (RMM) Audit, Audit Media Controls

(t) Merrill Associates – MXG

(u) MVSSolution products such as: ThruPut Manager Automated Edition (AE)

(v) Net-Q products such as: APPN-EE Firewall Basic, APPN-EE Firewall Advanced

(w) NewEra product: SAE

(x) Novell product: SuSe Linux

(y) Oracle Corporation product: Oracle DBMS

(z) Phoenix Software International product: MVS Falcon/DE

SOLICITATION: OPM32-11-R-0018 QUESTIONS AND ANSWERS (PART 2 OF 2) AMENDMENT #000004 Dated: 10/19/2011

(aa) RedHat – RedHat Linux & Satellite

(bb) SAS Institute, Inc. products such as: SAS Base, SAS Stat, SAS FSP, SAS Graph, SAS Connect, SAS Access for Oracle

(cc) Starnet Communications product: X-Win32 Client

(dd) Sterling Commerce Software (IBM) products such as: Connect:Direct for z/OS, Secure+, FTP+ Server and Clients, Connect:Direct for PC’s.

(ee) Thought Inc: CocoBase

(ff) VanGuard products such as: VSA System Administrator, VSA Analyzer, VSA Enforcer, VSA Advisor

(gg) Velocity Software – zVPS/ESALPS

80Q Ref.: Amendment 2, Attachment 1, D.3.2.4 Environment (page 57). Please provide a list of the hardware and telecommunications products currently developed for, leased by, or commercially purchased for the Environment that the contractor may need to have expertise using. Also, how many years of experience is required to effectively maintain these products?

80A Response:

Enterprise Server Platform

IBM 2096-X02 zSeries Parallel Enterprise Server IBM 2096-X03 zSeries Parallel Enterprise Server IBM Internal Coupling Facility (ICF) Processor IBM Integrated for Linux (IFL) Processor IBM zApplication Assist Processor (zAAP) IBM Cryptographic Assist Processor IBM Cryptographic Co-Processors IBM Server Time Protocol (STP) IBM Capacity Backup Feature IBM 9032-003 ESCON Director IBM 3494 Virtual Tape Server Model B20 IBM 3494 Automated Tape Library IBM 3584 Automated Tape Library IBM TS7700 Virtual Tape Server EMC DMX-1000 Storage Subsystem EMC DMX-800 Storage Subsystem IBM DS8100 Storage Subsystem IBM DS8800 Storage Subsystem

SOLICITATION: OPM32-11-R-0018 QUESTIONS AND ANSWERS (PART 2 OF 2) AMENDMENT #000004 Dated: 10/19/2011

Brocade CNT USD-X Channel Extension IBM SAN80B FICON Switch IBM 3590 IBM Magnetic Cartridge Unit IBM TS1130 IBM Magnetic Cartridge Unit IBM 3490-A02 IBM Magnetic Cartridge Unit IBM 3490E Cartridge Unit Xerox Docuprint 135 Printer Xerox 4635 Printer

Wide-Area Network

Ethernet Open Systems Adapter Gigabit Ethernet Open Systems Adapter Data Mirroring links network connections Cisco 7200/2600 Brocade 3200 Switch Cisco 2950 Switch 2074 Establishment Controller

81Q Ref.: Amendment 2, Attachment 1, D.3.2.6 Environment (pages 58-63). Please clarify if OPM does or does not desire ongoing staff training to keep up with changes in technology and new innovations.

81A The Contractor is the sole maintainer of the technology located within the Data Center and is required to keep abreast of the changes in technology affecting the operations of all equipment under Data Center control.

82Q Ref.: Amendment 2, Attachment 1, D.3.2.6.n Qualification Standards for Required Skill Categories (page 63). Similar to Section D.3.1.1.b (Duties and

Responsibilities) under STA 1, please provide the skill sets required of the various labor categories proposed in D.3.2.6.n (e.g., minimum years of experience, skills sets required, specific technology competencies). Does the staff need to be cross-trained in multiple areas or is one resource sufficient?

82A The roles and responsibilities covered by STA 2.1 encompasses the overall duties outlined from D.3.2.1 through D.3.2.6. The skills sets required and specific technologies competencies required are those which would enable the offeror to maintain and ensure proper operation of all the software in the inventory of the Data Center. Cross training staff in multiple areas would lead to smaller staffs. Each software area within IBM z/OS needs more than one person trained for continuity. An overall familiarity of all products is required for personnel manning (see D.3.2.6.m Personnel Coverage) during

SOLICITATION: OPM32-11-R-0018 QUESTIONS AND ANSWERS (PART 2 OF 2) AMENDMENT #000004 Dated: 10/19/2011

Principal Period of Service and have personnel providing continuous, unbroken coverage during PPS and for the two-tiered on call support. Skill sets are ones which involve what is needed to perform the work supporting each individual software product along with the correct operation of the IBM Enterprise Servers and its follow-on technology.

83Q Ref.: Amendment 2, Attachment 1, D.3.2.6.n Qualification Standards for Required Skill Categories (page 63). Please clarify that offeror may propose multiple staff members per labor category (e.g., two z/OS Sysplex Systems Programmers) as part of its staffing plan.

83A Yes, this is correct.

84Q Ref.: Amendment 2 Attachment 3. Past Performance Instructions (page 99). If an offeror intends to bid multiple STAs, may the offeror use a past performance questionnaire for more than one STA? Or, is the offeror limited to use the past performance questionnaire only once for only one STA?

84A If the information in the past performance questionnaire is applicable to the Special Technical Area that the offeror is proposing on, yes it may be used more than once.

85Q Ref.: Amendment 2 Attachment 3, Past Performance Instructions (page 99). Please clarify if the offeror is supposed to initiate the process of completing the Past Performance Questionnaire for the offeror's references or will OPM initiate the Past Performance Questionnaire process.

85A The offeror shall include in the Past Performance Questionnaire (PPQ) those past/current projects that they want to be considered as part of their past performance evaluation. As a result, the offeror shall list projects and then forward to their references. The offeror’s references shall rate the offeror’s performance on the project, then submit to OPM at email: ITBPA@OPM.GOV prior to the closing date of the RFP. The questionnaire should NOT be submitted by the offeror. The offeror is responsible for ensuring that the questionnaire is submitted by the deadline.

86Q Please clarify if the format for the Price Proposal is supposed to be in MS Excel format. Given the requirements in E.3.3, these required sections do not lend themselves easily to MS Excel format. Also, if you want labor rate pricing in MS Excel format, can you please provide a template that you prefer offerors to use.

86A Yes. Section B of the RFP provides the template/format for Base and Option Year pricing.

87Q Ref.: Amendment 2 Section E, E.3.1, Volume I: Technical Proposal (page 109). The answer to Question 16 from Questions and Answers - Part 1 of 2 indicates that the Subcontracting should be part of the Technical Proposal. However, the Amendment 2 indicates including it in the Technical Proposal.

Please clarify if the Subcontracting Plan belongs in Technical or Price Proposal.

87A Amendment #2, page 109, E.3.1 provides instructions on where the subcontracting plan should be. Please re-read the amendments.

mailto:ITBPA@OPM.GOV�

SOLICITATION: OPM32-11-R-0018 QUESTIONS AND ANSWERS (PART 2 OF 2) AMENDMENT #000004 Dated: 10/19/2011

88Q Factor 2: IT Resources/Personnel Qualifications/Staffing on Page 112 states, “The contractor shall provide a letter of intent for all proposed key personnel.” Historically this has been a requirement of the subsequent BPA Calls rather than the BPA itself. Can you confirm that letters of intent are required for the BPA proposal?

88A Correct at BPA Call level, but I assume that part of your proposal will include key staff.

89Q The volume requirements table presented on page 106 states a 60 page limitation for the Technical Volume (not including resumes). Can you please clarify if the following items will be included in the page count?

• Cover Page

• Executive Summary

• Table of Contents

89A Yes

90Q Do small businesses have to submit the Small Business Subcontracting Plan? Are small business required to have small business subcontractors or can we fulfill the small business requirements as prime?

90A No. No.

91Q For Subcontracting goals should actual dollars or percentages be used?

91A RFP Clause 52.219-9 requires goals be expressed in percentage as well as dollars. The Subcontracting Plan outline was provided as a guide to assist offerors in complying with this clause. The form also provides what information offerors are to complete for Base and Option Years in Dollars and Percent. Please review the clause and the form.

92Q Ref.: Amendment 2, pg 46 of 115. OPM Clause 1752.239-70 indicates the level is Moderate. Another reference stated Low. What is the Level?

92A The OPM clause will be corrected. As per Technical the Level is High due to Personnel Identity data that OPM manages.

93Q The formatting instructions currently state that “all materials shall be in typeface Times New Roman 11 point (or Arial 11 point), double spaced on 8-1/2 x11’ white paper” and that “all material submitted may be single-spaced.” We assume that the government’s intention was to say that “all materials shall be in typeface Times New Roman 11 point (or Arial 11 point), double sided on 8-1/2x11” white paper.” Please confirm.

93A Double-sided paper is acceptable, with no change to page limit.

SOLICITATION: OPM32-11-R-0018 QUESTIONS AND ANSWERS (PART 2 OF 2) AMENDMENT #000004 Dated: 10/19/2011

94Q Ref.: D.3.2.1 (STA 2.1). Will the Government provide the enterprise server millions of instructions per second (MIPS) and the current running average CPU daily utilization (monthly basis if available)?

94A The systems are two (2) IBM Enterprise Servers; IBM 2096-X02 and IBM 2096-X03. The systems are rated at 741 and 1086 MIPS respectively with IBM zAAP processors along with an IFL. The utilization of these systems ranges from low to high depending on time of day. The systems are processing 24/7 and must be available.

95Q Does OPM expect each of your BPA contractors to have experience in 100% of OPM’s requirements (technical competencies, tools, and environments) for STA 1 and STA 5?

95A No. OPM does not expect all BPA contractors to cover all competencies within STA1.

96Q Will OPM furnish licensed copies of all software relevant required for use in a BPA Call once awarded?

96A The availability of OPM furnished licenses depends on the development of task (BPA Call) and the solution proposed.

97Q How will contractors be reimbursed for facilities cost when an individual BPA Call indicates Contractor Site as the place of performance?

97A Your question is hypothetical because currently we do not know what a BPA Call will entail. Any travel will be reimbursed in accordance with Federal

Travel Regulations.

98Q Will contractors be allowed to add facilities costs to the contract-defined rates when pricing BPA Calls indicating Contractor Site performance?

98Q See question #98 answer.

99Q Will the Government modify the pricing instructions to require Contractor site rates in addition to Government site rates?

99A Work will be mainly performed at Government site. No plan to modify for Contractor site.

100Q Are we correct in assuming that Volume I: Technical Proposal, Section 3: Subcontracting Plan (RFP Attachment II) is excluded from the 60 page limit?

100A Yes. In addition, we will not exclude any proposal where page limit is exceeded due to RFP Attachments.

101Q The pricing instructions only call for labor category names. Does the government require labor category descriptions, required education levels, etc.?

101A Yes. See Amendment #2, page 5. Description of Labor Categories proposed are required.

SOLICITATION: OPM32-11-R-0018 QUESTIONS AND ANSWERS (PART 2 OF 2) AMENDMENT #000004 Dated: 10/19/2011

102Q Amendment 002 states that we must provide a separate proposal for each subsection (i.e. 3.3.1, 3.3.2, etc) that is an entirely separate proposal. Will the government clarify the subsection level for this requirement?

For example, does the government wish to receive 1 proposal response for section “3.3 IT Security Management” which would include all subsections (3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, and 3.3.7) or 7 proposal responses (one 50 page proposal for each subsection) for section “3.3 IT Security Management”?

102A Amendment #2, page 4 provides offerors a list of all Special Technical Areas (STAs) that require a proposal. The same page, paragraph “c” also states:

Contractors may propose on one or more technical areas listed… However, each technical area identified ..requires a separate proposal. Re-read the Amendments please

103Q Question: Based on the RFP, will the government please verify that a QASP may be required by the Offeror at the Call level and is not required to be submitted with the proposal response to the BPA? BPA Call Level in the format provided.

103A BPA Call Level in the format provided.

104Q FACTOR 2: IT Resources/Personnel Qualifications/Staffing. In this section, the offeror shall provide the resumes of the proposed principal/point of contact, other key personnel, and supporting personnel, as well as a staffing plan. Resumes should present sufficient information to determine the proposed individual’s qualifications to successfully perform the required services. The contractor shall provide a letter of intent for all proposed key personnel. Question: Are Letters of Intent required for proposed personnel if they are current employees of the Offeror?

104A They are not employees under this RFP. This is a new requirement. Information will be required at the BPA Call Level.

105Q No contractor shall sub-contract to a firm that serves as a subcontractor to another contractor under this BPA.” Could the government please provide additional explanation of this restriction? Answer: 58A A subcontractor cannot be a sub for more than one prime contractor for services required in this RFP. Question: Can you please clarify if this is inclusive per STA or BPA wide?

105A A subcontractor can not be a sub under multiple Primes under this RFP. For example , if Prime A and Prime B are BPA Holders as a result of this RFP, you can not be a sub under both Prime A and Prime B. You can only be a sub under one Prime as a result of this RFP.

106Q Question: What level(s) of security clearances are required from proposed project personnel specific to service task areas 3.3.4 and 3.3.6?

106A A High Risk BI is required for service task areas 3.3.4 and 3.3.6

SOLICITATION: OPM32-11-R-0018 QUESTIONS AND ANSWERS (PART 2 OF 2) AMENDMENT #000004 Dated: 10/19/2011

107Q D.3.2.9.b STA 3.1.1 CIO Strategic Oversight of Information Technology“ It includes the drafting of content for the IT Systems Manager tool.”

What is the OPM specified or preferred IT Systems Manager tool?

107A The IT Systems Manager tool is available for review on CD. At this time, it is OPM’s preferred tool. Please contact the OPM contracting officer to request a copy.

108Q D.3.2.9.b STA 3.1.1 CIO Strategic Oversight of Information Technology “It also includes advisory support in the implementation of in-depth assessments called TechStat reviews.” Please define “TechStat” review.

108A A “TechStat” review is “a face-to-face, evidence-based review of an IT investment.” For more information, see the CIO Council website at http://www.cio.gov/pages.cfm/page/What-is-TechStat.

109Q How many systems are in scope for STA 3.3 (IT Security Management)?

109A Approximately 50.

110Q What are the security categorizations of the systems in scope for STA 3.3 (IT Security Management)?

110A Most systems are categorized as medium. There are some high and low systems categorizations.

111Q In what phase of the Certification & Accreditation (C&A) process are the systems within scope for STA 3.3 (IT Security Management)?

111A Systems are in various stages across the three year recertification cycle and there are several that require recertification in the next six months.

112Q Page 79, Section D.3.3.4, STA 3.3.1: To assist level of effort and pricing determination, please provide an estimate of the number of systems that will need to go through the C&A process. Also, please estimate the number of these systems that have gone through a C&A in previous years.

112A Please see RFP amendments.

113Q Will STA 3.3.2 (Independent Risk Assessments – Infrastructure and Systems) include penetration testing? Or, will the contractor be able to rely on the results of Security Test and Evaluation (ST&E) activities?

113A A full organizational risk assessment is required including vulnerability assessments.

114Q Will STA 3.3.3 (Independent Verification and Validation) include functional IV&V?

114A The vendor will be responsible for functional security testing of the system in the CA& process.

http://www.cio.gov/pages.cfm/page/What-is-TechStat�

SOLICITATION: OPM32-11-R-0018 QUESTIONS AND ANSWERS (PART 2 OF 2) AMENDMENT #000004 Dated: 10/19/2011

115Q For STA 3.3.4 (Security Policies and Procedure Development), do these policies exist and require revision, or do they need to be created from scratch?

115A The policies and procedures exist but updates will be needed per NIST, OMB, DHS and Audit directives, policies and recommendations.

116Q For STA 3.3.6 (Security Audits & POA&M Management), how many poams currently exist? Are there any known vulnerabilities for which poams have not been created?

116A There are more than 300 POA&Ms but less than 500. POA&M are generally created for identified vulnerabilities.

117Q Page 53, Section D.3.1 says that contractor support for STA 1 will involve “one or more” of areas “a” through “j”. As noted on P30, Section C.5 (52.216-

1), this is a fixed-price contract. Therefore, for pricing STA1, should the contractor provide a separate fixed price for each area, or provide an overall aggregate price with the assumption that it will perform all STA 1 areas (i.e. “a” through “j”)?

117A Section C.5-52.216-1 states that the “BPA Calls….shall use the fixed price labor categories/rates…” and that “…calls may be Fixed-Price (FP) or Labor Hour (LH)…” If the contractor wishes to use different fixed price labor categories/rates and/or discounts for STA 1 items a through j, then that should be stated and detailed in their cost and pricing proposal.

118Q Page 53, Section D.3.1, bullet “a” refers to the OPM IT Systems Manager (ITSM) document. Please provide a copy of the current version of this document or provide a publicly accessible source from which contractors may obtain it.

118A A CD is available

119Q Page 53, Section D.3.1, bullet “a” states that the contractor shall provide “Full applications development support and maintenance… for OPM lines of business including retirement, insurance, financial management, investigation services and all other program offices.” Please provide the names of the other program offices that must be supported. Also, please provide an estimate of the overall number applications to be supported during this contract, including anticipated new systems.

119A www.opm.gov provides an organization chart that covers all OPM program offices. Applications support evey aspect of OPM’s mission. A complete inventory of applications will not be provided.

120Q Page 53, Section D.3.1, bullet “a”: please specify the current contractor(s) who are providing these services.

120A Please see addendum responses.

121Q Page 89, Section D.3.5.4.b says “Other locations of work will include Boyers, PA, Macon, GA, Fort Meade, MD, Charlottesville, VA, Denver, CO and other OPM field sites.” To assist the contractor’s travel pricing efforts, please provide, for each STA, the estimated number of trips to each location and estimated duration for each trip.

121A That information is provided as BPA Calls are made.

http://www.opm.gov/�

SOLICITATION: OPM32-11-R-0018 QUESTIONS AND ANSWERS (PART 2 OF 2) AMENDMENT #000004 Dated: 10/19/2011

122Q D.3.2.9.c/D.3.3.2 Please clarify the distinction between the “Program Management” requirements in these two sections. For instance, do the requirements expressed in D.3.3.2 only apply to OPM’s Records Management and Data Quality activities?

122A Yes, the requirements expressed in D.3.3.2 only apply to OPM’s Records Management and Data Quality activities (STA 3.2). Subsection D.3.2.9.c is part of STA 3.1, which begins with D.3.2.9.a.

123Q D3.3.0 (to include subsections D.3.3.1 & D.3.3.2) Please clarify the relationship of subsections D.3.3.1 and D.3.3.2 which provide the detailed requirements to the general requirements description in D.3.3.0. There does not appear to be a clear relationship.

123A As noted in the solicitation, D.3.3.0 is “not used.” Neither D.3.3.1 nor D.3.3.2 detail any requirements for it. Instead, subsection D.3.3.1 applies to STA 3.1 which begins with D.3.2.9.a. Subsection D.3.3.2 applies to STA 3.2.

124Q: D.3.2.9d Is the plan for OPM to continue using eCPIC in FY 2012?

124A Yes, the plan is for OPM to continue using eCPIC in FY2012.

125Q Question: D.3.2.9d Please provide the software COTS name and version numbers for all the software tools that are being used to support IT program management.

125A : OPM is using the following software tools to support IT program management:

- Primavera Project Management P4.1 SP4 (See Note 1)

- Primavera Cost Manager 5.0 SP4 (See Note 1)

- eCPIC version 5.6 (See Note 2)

- Microsoft Project versions 2003, 2007, and 2010

- Microsoft Excel versions 2003, 2007, and 2010

Note 1: OPM is currently upgrading to Primavera Project Management P6 v7 and Primavera Cost Manager 6.2.

SOLICITATION: OPM32-11-R-0018 QUESTIONS AND ANSWERS (PART 2 OF 2) AMENDMENT #000004 Dated: 10/19/2011

126Q Question: D.3.4.1 In the EA requirement there is no mention of cloud, data center consolidation, performance metrics, or investment portfolio data.

Does this mean that the CPIC data, cloud considerations, data center consolidations, etc. are not kept in the EA repositories? If so, is it OPM’s intent to maintain different repositories?

126A EA Document has not been updated yet with Cloud information; however, the updated EA document scheduled for December will include Cloud information and the OPM approach for uses of the cloud.

127Q D.3.4.1 Is there any link between the OPM EA and OPM Government–wide HR Programs and Systems FEA. If so are the models and information maintained in a common repository using the Metis tool?

127A OPM has METIS but maintenance has been unfunded or 4 years and cannot be used.

128Q D.3.3.1 Is the CPIC and Performance data from the OPM Government-wide considered part of the OPM portfolio?

128A Yes. The agency’s IT portfolio is identified in its budget Exhibit 53. CPIC and Performance data from OPM Governmentwide initiatives are part of the OPM portfolio.

129Q STA 3 includes Capital Planning and Portfolio Management, and Government-wide HR Management. But there are no sub-STA’s assigned to those areas. Will they be included in STA 3 at the highest level – no sub-STA? Or are they included in some of the other sub-STA’s?

129A Each STA is clearly marked at even the sub-STA level. Please see revision for details.

130Q If we do not already have any security clearances in place that would be required, would the US Office of Personnel and Management provide us the means (sponsorship) to obtain this and how long would the clearance process take?

130A Yes, OPM would sponsor US citizens for a Public Trust Clearance. Timeframes could range depending on the subject’s background from weeks to months.

131Q C.6, page 49. In reference to clause 1752.239-71 Information Technology Systems Security, please clarify the proposal requirements for (b)(1) on page 47 of Amendment 0002. Is a statement acknowledging our understanding and compliance with the security requirements of the SOW sufficient, or is a detailed outline required? If an outline is required, please confirm that it is excluded from the Technical Proposal page limit.

131A As stated in the RFP, a detailed outline is required and is subject to the proposal page limitation.

SOLICITATION: OPM32-11-R-0018 QUESTIONS AND ANSWERS (PART 2 OF 2) AMENDMENT #000004 Dated: 10/19/2011

132Q STA 3.2 Does OPM expect the contractor to provide the full range of support to OPM in “implementing” policies and procedures? If so, can you elaborate on those expected activities?

132A Yes. Implementation of policies and procedures are within the scope of services but the BPA calls will have specific requirements for these services.

133Q STA 3.2. Is the contractor expected to provide support to OPM in developing and implementing policies and procedures for its forms management program?

133A Please see amendment #000003 to RFP paragraph 2 page 65. Implementation of OPM Policies. The contractor will ensure that all work performed complies with OPM policies and procedures in place at the time the work is performed.

134Q Pg 70 , D.3.3.4 STA 3.3.1 Security Certification & Accreditation “The contractor shall conduct assessments in all areas of Security Certification &

Accreditation using NIST standards as documented the 800 series Special Publications and FIPS standards. This includes developing Security Plans, risk assessments and related documents as required by OPM policies, FISMA and NIST guidance.”

Will OPM provide bidders with access to current OPM CIO policies and standard operating procedures which support Information Security and the C&A process within OPM? If copies are not provided, will OPM provide a reading room to allow bidders to review these materials prior to the proposal submission date?

134A No, copies will not be made available prior to proposal submission date. OPM’s information (IT) security and privacy program are compliant with OPM's strategic goals (located on the OPM.gov website), the Federal Information Security Management Act (FISMA), the Privacy Act of 1974, the Clinger- Cohen Act of 1996 and other applicable federal IT security and privacy laws and directives. Pg 70 D.3.3.4 STA 3.3.1 Security Certification & Accreditation “The contractor shall conduct assessments in all areas of Security Certification & Accreditation using NIST standards as documented the 800 series Special Publications and FIPS standards. This includes developing Security Plans, risk assessments and related documents as required by OPM policies, FISMA and NIST guidance.”

135Q Question: What automated C&A tool does OPM utilize?

135A Response: OPM utilizes MS- Word and MS-Excel but expects to adopt Trusted Agent FISMA in the near future.

136Q Pg 70 D.3.3.4 STA 3.3.1 Security Certification & Accreditation “The contractor shall conduct assessments in all areas of Security Certification & Accreditation using NIST standards as documented the 800 series Special Publications and FIPS standards. This includes developing Security Plans, risk assessments and related documents as required by OPM policies, FISMA and NIST guidance.” Does OPM have a standard set of C&A templates that the contractor is required to complete or is the contractor responsible for developing C&A documents by following NIST standards?

136A OPM has a standard set of C&A templates.

SOLICITATION: OPM32-11-R-0018 QUESTIONS AND ANSWERS (PART 2 OF 2) AMENDMENT #000004 Dated: 10/19/2011

137Q Section D.3.1.a. of the Scope of Work asks for “Full applications development support and maintenance using the development life cycle methodology defined in the OPM IT Systems Manager (ITSM)” Could OPM provide offerors with the referenced OPM IT Systems Manager (ITSM) documentation?

137A CD is available

138Q Section D.3.1.1.b (page 59) asks offerors to comply with OPM’s Information Technology Enterprise Architecture, Version 6 and OPM’s Information Technology Security Policy. Could OPM provide offerors with a copy of these documents?

138A Due to schematics of system vulnerabilities, only specific policy questions will be entertained and the document will not be made available. It is best to describe our environment in terms of our mainstream deployed suites of software so that vendors can provide best fit talent and propose additional options that align with or interface to our existing infrastructure:

• OPM has a structured environment of D-T-P (Development Test Production) of HP Blade Servers ( 24 processors) that host Oracle 10g with RAC( Remote Application Cluster) and disaster recovery, CITRIX supported access for remote desktop.

• OPM has an Oracle ELA annual true-up for the Database, tuning, diagnostic, change and configuration management packs, partitioning, Internet application server (IAS). IBM mainframe runs ZOS, Linux (Susie) ZOS COBOL VSAM, CICS, ADABAS with ELA (to be discontinued in fy16)

• Microsoft ELA for Desktop Suite, Systems Center, Exchange Server, limited number of VISIO, MS Project, Visual Studio, Visual Basic with annual true-up for full range of MS products including BING Microsoft Windows 7 with planned migration to Windows 10, •Stand alone products include Serena Business Manager suite, Oracle BI Tool, Cognos 10(in Dec 2011), JAVA

139Q Section D.3.2.9.a states that STA 3.1 will provide support for OPM’s IT Capital Planning and Investment Control (CPIC) program. However, STA

3.2.,section D.3.3.2 (on page 78) includes “execute the CPIC process and develop required capital asset plans, funding strategies, budgets and business cases” as a program/project related task. Please clarify if this requirement would fall under STA 3.1. or 3.2.

139A Please see the RFP revision of October 5, 2011.

140Q Question: Please identify the specifics that should be included in the outline (i.e. Do you want to see our internal security policies with regard to handing

OPM data?)

140A Response: Provide information on how your internal security program has complied with the Federal Information Security Management Act of 2002

(FISMA, Public Law 107-347, 44 U.S.C. 3531-3536 ) and Office of Management and Budget (OMB) Circular A-130, Appendix III, "Security of Federal Automated Information Systems” to verify that OPM data, when residing within your network, can be considered to be safe and secure.

Reference: Statement of Work, page 65-71.

SOLICITATION: OPM32-11-R-0018 QUESTIONS AND ANSWERS (PART 2 OF 2) AMENDMENT #000004 Dated: 10/19/2011

141Q Question: Beyond the key personnel requirement listed in Section D.6 on page 81, do we need to submit key personnel for STA 3.3?

141A Yes

142Q Question: Per section D.3.4.3, D.3.4.4, D.3.4.5, and D.3.4.8, Should the network engineering to be considered as a part of network operations?

D.3.4.3 did not point on the network design and the network engineering.

142A The Network Engineering team is not part of the Network Operations team. The Network Operations team is responsible for the engineering of the LAN and WAN network infrastructure.

143Q Beginning on Page 72 for sections D.3.4.6.a, D.3.4.7.a, D.3.4.8.a and D.3.5.2.a, Desired Skill Sets require Disaster Recovery Planning and Implementation. Question: Who declares the disaster and what is the notification mechanism for the disaster declaration? Is there any emergency response center to declare the disaster? What is the time frame to satisfy the disaster recovery requirements?

143A The Office of the Director is responsible for declaring a disaster. There is currently no emergency response center although there is a Situation Room at the DC location and IT staff are also stationed at Boyers, Ft Meade and Macon sites. Time frame for disaster recovery requirements has not been clearly defined.

144Q Beginning on Page 72 for sections D.3.4.6.a, D.3.4.7.a, D.3.4.8.a and D.3.5.2.a, Desired Skill Sets do not required high availability skill sets to support 99.999% target availability of OPM networks, systems and applications. Question: Should high availability skill sets to added to disaster recovery skill sets?

144A High availability skill sets are not specifically required for this response.

145Q Page 72 for section D.3.4.4 Project Purpose: “The contractor will provide coordinated support across multi-contractor platforms, technologies, and geographical boundaries.” Question: Will the geographical boundaries match the provided operational support Monday through Friday, 6:00am to 6:00pm Eastern Standard Time, excluding government holidays?

145A Response: Yes

146Q The Answer to Question number 15, in Amendment 3 states that “The 50 page limit does not include resumes.” Within Amendment 2 on page 106, the page limitation for the Technical Volume is stated as 60 pages. Will OPM please confirm whether the page limitation of the Technical Volume is 50 or 60 pages.?

146A See Amendment #000002 for number of pages.

SOLICITATION: OPM32-11-R-0018 QUESTIONS AND ANSWERS (PART 2 OF 2) AMENDMENT #000004 Dated: 10/19/2011

147Q Section C.3 (e)(1) states "Notwithstanding the requirements of the clauses in paragraphs (a), (b),(c), and (d) of this clause, the Contractor is not required to flow down any FAR clause, other thanthose in this paragraph (e)(1) in a subcontract for commercial items." As an example, FAR 52.222-35 is not "X" (or selected) in section C.3 (b) but is included within section (e)(1). Are potential Prime Contractors accurate to read this as a FAR clause which is not "X" (or selected) in C.3 52.212-5 (b) is not applicable to Prime Contractors but, if included in C.3 (e)(1) it is applicable to subcontractors? This is to help clarify the Prime Contractor's responsibility in relation to OPM Specific Clause 1752.222

147A Flowdown required for commercial services/items.

148Q Will the government identify the Trouble Ticket system in use and the version?

148A Yes. Currently Remedy ARS 7.0 is in use but an upgrade is in planning.

149Q Will the government indicate which of the following components of your ITSM are implemented:

- Incident Management?

- Change Management?

- CMDB?"

149A Yes, OPM implements the components you have listed:

• Incident Management

• Change Management

• Configuration Management Data Base (CMD

150Q What monitoring tools are you using for networks, servers, desktops, etc?

150A Response: OPM uses a variety of tools including Nagios, Cacti, and is implementing additional tools including Solarwinds.

The IBM Enterprise Servers uses the following software COTS packages for its internal “10” network

a. z/OS - Allen Systems Group TMON for z/OS

b. CICS – Allen Systems Group TMON for CICS

c. IBM Enterprise Server Network – Software Diversified Services VIP & VSV

151Q What patch management tools are you using for servers?

151A OPM is using multiple tools for server patching including LanDesk, Microsoft SUS / System Center and Red Hat Kickstart. The IBM Enterprise Servers are using IBM’s SMP/E.

SOLICITATION: OPM32-11-R-0018 QUESTIONS AND ANSWERS (PART 2 OF 2) AMENDMENT #000004 Dated: 10/19/2011

152Q What SIEM (Security Information and Event Mgmt) are you using today?

152A No SIEM is currently in place but ArcSight has been purchased

153Q Do you have management dashboard access into the operation? If so, what product?

153A Management dashboards are not in place but Solarwinds and ArcSight are planned.

154Q Question: What version of Microsoft Exchange are you using today?

154A Response: 2007

155Q What solution is your VoIP based on (e.g., CISCO)?

155A Cisco

156Q Have you implemented Unified Communications? If not, do you plan to?

156A In progress

157Q Do you permit "ActiveSynch" devices on your network (e.g. iPhone, Tablets, etc)?

157A Yes

158Q Do you have a common tool for managing all of your storage assets or is it by vendor?

159A OPM uses Navisphere to manage EMC storage and Inform to manage 3Par storage; IBM Enterprise Servers are using IBM System Managed Storage

(SMS).

160Q What are the common tools used for server mgmt (Windows, Linux, Unix)?

160A Multiple tools in place.

161Q What patch management tools do you use for desktop? For servers?

161A LanDesk for Wintel machines and Casper for Apple Mac’s.

SOLICITATION: OPM32-11-R-0018 QUESTIONS AND ANSWERS (PART 2 OF 2) AMENDMENT #000004 Dated: 10/19/2011

162Q Do you have IFL Linux implementations? If so, do Linux Admins have responsibility for management or mainframe staff?

162A The LINUX systems running on the IBM Enterprise Servers (mainframe) lie and are managed by Data Center staff who are trained as Linux Systems

Administrators.

163Q Question: Evaluation Factor 4 states specifically HR Systems experience? Could Government clarify whether the scope of RFP services is limited to HR Systems or covers all other systems at OPM?

163A Response: Please see Amendment to RFP dated October 5, 2011. BPA Calls are not limited to HR systems.

164Q Please clarify if (a) through (f) on pages 51-52 are considered subtasks of "f. Implementation planning, customization, integration and support for

Commercial-Off-the-Shelf (COTS) products, in-house developed systems, and enhancements to existing systems." or are they separate task areas?

164A Response: These are separate tasks but may be combined in any call that OPM could issue.