Questions_and_Answers.pdf

Questions and Answers R16PS01467 ICS Support

1. Is this a new requirement, or an existing requirement that is being performed by an incumbent?

This is a new Requirement.

2. If there is an incumbent, Please see question #1.

a. Is the incumbent eligible to bid on this work?

b. What is the name of the incumbent?

c. What is the contract number for the existing work?

3. What is the current or historical Level of Effort? Please see questions #1.

4. What is the estimated level of effort for the PWS? If unavailable and given this is an FFP bid, would the Government consider providing the number/quantity of desired Full Time Equivalent (FTE) staff for this effort? Vendors must determine and submit this information in their technical approach.

5. Will the contractor staff have access to space and GFE at government facilities in Denver CO?

Yes

a. Can some of the work be performed at contractor site? Please see PWS Section 4. Work to be performed at the Denver Federal Center.

b. Does the contractor site need to be in Denver, or within a certain mile radius of Denver?

Please see PWS Section 4. Work to be performed at the Denver Federal Center.

6. What are the anticipated travel locations related to the PWS? Exact locations are to be determined, but they will all be located within the 17 western states.

7. With a travel estimate NTE $26,000, how many trips, duration of trip, location, and number of staff were used to derive this estimate? Estimate was based on an average estimated cost of $2000 per trip.

8. PWS: 4.1-4.3 : Can the Government provide the number of ICS assessments, technical evaluations, and threat assessments required by the contractor during the base period and option periods. Also please confirm if the assessments are completed remotely since travel budgeted in the RFP is 26,000 and the number of Dams/ICS facilities is in the range of 500.

Exact number to be determined on a priority basis; current estimate is between 6-12 per year, the number will vary based on size and complexity of assessments conducted. Some may be conducted remotely; others will be conducted onsite using the estimated travel that has been identified.

9. With the entire contract amount on the SF-18 which includes travel, will the Government consider travel as a cost reimbursable item versus FFP? Please see SF1449 Travel CLIN states NTE only actual expenses will be reimbursed.

10. Are there any other labor categories required other than the ICS Expert? Section L 3b.1 suggests a technical supervisor. Is this also a labor category? Contractor will determine this in their quote and technical approach.

11. Does the Project Manager for this work require the same experience, certs, education and specific ICS experience as the Expert labor category? Yes.

12. How many systems are projected to be evaluated by the Experts on an annual basis? See #8.

13. Are all of the ICS systems to be evaluated located in hydroelectric producing dams, or are there other dams or sites to be evaluated as well? No, not all evaluated ICS will be located in hydroelectric dams, nor will all ICS be in dams.

14. If a teaming solution is proposed to provide the Government with Best Value, is past performance from a team member acceptable in addition to the Prime contractors? YES

15. Section L 2.D: Is the contractor required to submit 2 full copies of the proposal volumes(technical, key personnel, past performance, price) both redacted and un-redacted? In addition, “Price” is omitted from the redacted version as re. Please clarify if Price is required in redacted version. Please provide the purpose of the “redacted version” of the proposal. Will the Government be evaluating the entire or redacted version? Price is not required in redacted version. One copy of each redacted and non-redacted documents is required. The government’s technical team will be reviewing the redacted version.

16. Section 5 performance requirements summary, states Performance standard is “compliant with agreed upon delivery schedules and product requirements”.

a. Can the Government please define “product”? Product will vary based on task assigned. Products could include security assessment plans, security assessment reports, training materials etc.

b. The quantity of and delivery schedule for Task deliverables will determine staff required.

Will the government provide a matrix of the quantities required for each task as applicable? Unknown quantity please see question #27.

17. 7.4 staff replacement plan. Please confirm a staff replacement plan, although a contractual deliverable is not required in the response not to be confused with the knowledge transfer plan under section L 3.ii which is required under solicitation. Correct.

18. PWS Section 5 Performance Requirements Summary

a. Tasks 4.1 through 4.18 each call out a potential penalty to the contractor in the form of a “price reduction or other action” for any instance of not delivering at least 90% of the required products on time. Would the government elaborate on the timeframe for each of the products and the quantity required so that vendors know exactly what is expected? Timeframes will be negotiated at the time of task assignment.

b. Use of the word “support” in tasks 4.10 to 4.18 implies the vendor does not deliver final product, yet the expectation is the same as other tasks that do not use the word “support”. Would the government consider removing the potential penalties associated with tasks that the contractor “supports”? No, as deliverable of the final product may depend upon contractor support.

19. Solicitation Page 29, Past Performance – the requirement states “The Past Performance shall include a list of three (3) references of projects similar to this requirement under this solicitation which the offeror has completed during the last (3) years.” Can the offeror provide references that are currently being worked, and not completed as well? All past performance must be completed, evaluated and a reference provided.

20. Solicitation Page 28, Key Personnel Experience – “Include the following information:

“A list of alternate personnel sources to be utilized in the event proposed personnel are not available as planned (Include full resume by name of all additional personnel listed.)” Are Alternate personnel considered KEY personnel for purposes of this solicitation? Yes

21. What is the Level Of Effort (LOE) for this solicitation? In other words, what is the expected number of personnel required to accomplish this need? Please see Questions #4.

22. Is there an incumbent for this contract? If so, can the Government please provide the contract number? Please see Question #1.

23. The Government states that authorized travel expenses will not exceed $26,000 per contract year. Can some of the work on this contract be done remotely, or would the Government prefer that the vendor’s resources work on site full-time? Please see Questions #5.

24. Will personnel security clearances be required to perform any of the work on this contract? If so, what level of clearance (Confidential/Secret/Top Secret) will be required? Secret.

25. Is a facility security clearance required for this contract? If so, what level of clearance? See Question #24. There is not a separate facility clearance required.

26. Will the Government consider granting vendors a two-week extension? Given the Labor Day holiday, questions are due just four business days before the proposal due date. This gives vendors very little time to incorporate information from the Q-and-A into their proposals. This solicitation will be extended with quotes due on 9/16/2016 at 11:00 AM MT.

27. With only limited information about the Industrial Control Systems (ICS) in scope, it is very difficult for vendors to estimate level of effort and develop a firm, fixed price for each contract year. Can the Government provide concrete details about the infrastructure and ICS in scope?

This would include:

• Types of systems in scope (e.g., SCADA systems, Distributed Control Systems, Programmable Logic Controllers, etc.) Any ICS that Reclamation operates could be in scope, varying in size, function and form. Sizes range from extra-small to large. Not all systems will be assessed however. See Question #8.

• Number of systems currently in operation that will be in scope for this effort. See above.

• Number of systems in development that will be in scope for this effort. See above.

• Estimated number of future systems that are in the planning stage and might be considered in scope for this effort. See above.

• Size of system/number of components. Varies by ICS.

• Number of system users. Varies by ICS.

• FIPS categorization. Varies by ICS. Low – Moderate.

• Description of technologies included in each system. Varies by ICS.

• If the system has been granted ATO before. Varies by ICS; in most cases yes.

28. Will the vendor be required to create all security documentation from scratch, or does the Government have templates for artifacts, such as: Templates exist.

• System Security Plan

• Contingency Plan

• Disaster Recovery Plan

• Incident Response Plan

• System Architecture Document

• Security Assessment Report

• Plan of Action and Milestones

29. The Government uses the word “support” to refer to vendor involvement in sub-tasks 4.10 through 4.15. It is unclear what degree of support the vendor is expected to provide in these task areas. Is the Government looking for recommendations and process documentation, or is the vendor expected to execute these subtasks? Support the government leads in development.

• 4.10, Process Improvement/Task Automation

• 4.11, Development of ICS Cybersecurity Dashboards

• 4.12, ICS Asset Inventory and Classification

• 4.13, Development and Implementation of an ICS Cybersecurity and Execution Plan

• 4.14, Development of a Cybersecurity Framework

• 4.15, ICS Training Initiatives

30. Ref. Sub-Sections 4.13 and 4.14, ICS Cybersecurity Strategy and Cybersecurity Framework: Can the Government please clarify the distinction between the cybersecurity strategy and the cybersecurity framework? Also, is the Government looking for the vendor to develop and deliver these artifacts? The phrase “support the development of…” is unclear. Please research business strategies and frameworks. For a framework reference, refer to NIST SP 800-37. The contractor will support the government lead in completing these tasks.

31. Ref. Sub-Section 4.15, ICS Training Initiatives: What are the deliverables for this sub-task? Is the Government looking for a review and assessment of its current training program, or is the vendor expected to develop and deliver ICS training courses? If the vendor is expected to deliver training, please clarify: Not an assessment of the current training program. Offer recommendations for training, provide subject matter expertise to system operators during security assessments, and support government lead in creating training documentation.

• Desired format (classroom training, computer-based training, web-based training)

• Desired topics

• Desired frequency and length of courses

• High-level training objectives

• Target audience (IT staff, security staff, management personnel, etc.)

• If the training will be role-based

32. How many resources (key personnel) should the vendor provide? Is the Government looking for full-time resources? Please see Questions #4.

33. Do the qualifications listed – for example, CISSP or equivalent certification, 10 years’ experience in IT security, 2 years’ specialized experience with ICS security – apply to technical leads only, or to all personnel who will work on this contract? All Key Personnel.