Q and A - Cybersecurity Support Services 05 15 2023 - v2 (Cyber Review).pdf

Questions and Answers – Cybersecurity Support Services BPA – RFP20343023R00002

1. How many endpoints? If so, will you provide list of devices?

The CFPB enterprise consists of approximately 5000 endpoints including workstations, servers, mobile devices, and other networked devices.

2. Do you require remote management support?

We do not require remote management support of endpoints.

3. Do you require 24/7 (tier 1-3) phone support?

Section 3.5.3.1 of the solicitation describes requirements for after-hours support.

4. Will you at any point require onsite assistance?

Thought the majority of the CFPB workforce is currently teleworking, the location requirements are described in the “Place of Performance” clause. Due to the nature of some subtasks some on-site support may be required.

5. Will you require onsite/remote cyber security training?

For the most part, training is remote. There may be occasions when cybersecurity events are conducted onsite. Annual cybersecurity awareness training is launched via an automated training platform. The contractor staffed with this work, may be remote or local to the Washington DC area. The cybersecurity role-based training is partial automated and partial live instructor led. The live instructor lead training is conducted via MS Teams.

6. Is the Government at liberty to provide the current incumbent names and associated task orders to this work?

TFSACFPBPA16006 (20343018A00006) – Booz Allen Hamilton Inc (BAH), TFSACFPBPA16007 – Knowledge Consulting Group Inc (KCG), TFSACFPBPA16008 – Deloitte Consulting Group LLP (Deloitte). For additional information please conduct research via the Federal Procurement Data System (FPDS).

7. Request for a one-week extension due to the high volume of required key personnel, in addition to the standard proposal response process.

An extension to 05/22/2023 at 10:00am EST has been issued through Amendment 1.

8. If a response was not previously submitted to (RFI) - Cybersecurity Support Services BPA RFI-CFPB- 23-037, can vendors still submit bid for solicitation # RFP20343023R00002?

Yes.

9. If a vendor has never provided services to the federal government before but they have the skills and personnel to do this job, can they still submit bid for this RFP?

Yes, but they are not likely to get past the Go/No-Go criteria evaluating if they do not have experience supporting a Federal Agency. Experience supporting a Federal Agency is highly relevant due to the myriad cybersecurity requirements from NIST, CISA, and OMB to which the CFPB adhere.

10. Does the Government intend to provide a pricing worksheet for the solicitation?

No pricing sheet will be provided by the Government.

11. Will the Government consider a two-week extension?

An extension to 05/22/2023 at 10:00am EST has been issued through Amendment 1.

12. As a norm the Government provides its own PIV reader. Will this department purchase a PIV reader from our company?

Personnel directly supporting a Task Order under this BPA will be provided a government-issued laptop that includes a built-in PIV reader.

13. What are the Cybersecurity requirements and do they adhere to NIST 800-53 REV 4/5 controls and NIST SP 800-171 and 800-35-37.

All cybersecurity clauses are consistent with NIST-800-53r5 controls, and they are also specified in the solicitation package.

14. Are you requiring the contractor to have their own office? Please elaborate on what makes up a facility to be searched?

Contractors are not required to have an office and generally telework under current CFPB contractor policy. They may be required to come onsite for cybersecurity events. In the case of coming onsite, they can request a “hoteling” cubical in advance.

15. What type of Certification is required to show that the system has been sanitized? (The systems are traverse the network are backed up even before the contract begins. Explain, how will this be possible?

NIST SP 800-88 Rev. 1 is the standard for sanitization.

16. What type of computing environment are your referring to the Company's office?

This question is unclear without knowing which section of the solicitation is being referred to, and therefore an answer cannot be provided.

17. Does this contract have a previous incumbent?

TFSACFPBPA16006 (20343018A00006) – Booz Allen Hamilton Inc (BAH), TFSACFPBPA16007 – Knowledge Consulting Group Inc (KCG), TFSACFPBPA16008 – Deloitte Consulting Group LLP (Deloitte). For additional information please conduct research via the Federal Procurement Data System (FPDS).

18. Which reports do you require for Cybersecurity Status Reports and Cybersecurity Metric Reports?

See the schedule of deliverables in Section 5.1.

19. The contract is written as if they do not want new incumbents because FedRamp packages are with incumbents who already have worked previously for the government? So, this is not for new incumbents, correct?

The offeror should propose a well-developed technical proposal and qualified personnel to support the respective PWS sections regardless of incumbency. Experience supporting a Federal Agency is highly relevant due to the myriad cybersecurity requirements from NIST, CISA, and OMB to which the CFPB adhere.

20. RFP Page 171 - Key Personnel. Please confirm the contract period of performance is Base plus four one-years options. The RFP letter states the anticipated period of performance will include

(1) 12-month base year and four (4) 12-month option years. However, the Key personnel table shows base plus two-option periods.

The BPA itself has a five-year maximum duration. Each Task Order under the BPA has a three-year duration from which the Key Personnel Level of Effort is derived.

21. "RFP Page 117 Required Proposal Documents lists the following as Key Personnel:

"Tasks 3.2.3 and 3.2.4 Senior IT Audit & Compliance Specialist"" - Please confirm that based on RFP page 91 there are two (2) FTE key personnel intended for PWS Section 3.2.3, and one (1) FTE key personnel for PWS Section 3.2.4. "

That is correct.

22. RFP Cover Letter, RFP Pages 23, 24. Please clarify what part/volume of the Offeror's proposal is to include the "Phase-In and Phase-Out Plans" referenced on RFP pages 23 and 24? Please advise if the offeror is to submit a separate proposal volume (Volume IV) for this requirement.

The CFPB will lift the requirement to provide a phase-in/phase-out plan as part of offeror proposals. However, for new task order awardees selected to support the BPA, the phase-in plan will be a mandatory deliverable within 5 business days of award to facilitate transition and program continuity.

23. RFP Cover Letter, RFP Pages 23, 24. Please clarify what part/volume of the Offeror's proposal is to include the "Phase-In and Phase-Out Plans" referenced on RFP pages 23 and 24? Please advise if the Government requires the Offeror to include this in one of the existing proposal volumes?

The CFPB will lift the requirement to provide a phase-in/phase-out plan as part of offeror proposals. However, for new task order awardees selected to support the BPA, the phase-in plan will be a mandatory deliverable within 5 business days of award to facilitate transition and program continuity.

24. "RFP Page 117 Required Proposal Documents states: ""The Offeror shall submit a complete proposal package in the following Volumes (I, II, III) as separate attachments"" and then the Government lists: ""VOLUME I: Contractual Documents, VOLUME IIA: Factor 1: Go/No-Go Criteria, VOLUME IIB: Factor 2: Technical Approach, VOLUME IIC: Factor 3: Key Personnel, VOLUME IID:

Factor 4: Past Performance, VOLUME IIE: Factor 5: Small Business Participation, VOLUME III:

Factor 6: Price Proposal. Please clarify if offeror is to submit three volumes: (Volume I, Volume II with separate sections for IIA, IIB, IIC, IID & IIE and Volume III; OR offeror is to submit 8 separate attachments, i.e. Volumes I, II, IIA, IIB, IIC, IID, IIE and III."

Offerors are to submit three volumes: (Volume I, Volume II with separate sections for IIB, IIC, IID & IIE and Volume III).

25. RFP Page 115 and 116 Required Proposal Documents. Please clarify what is required to be submitted as part of Volume IIA: Factor 1: Go/No-Go Criteria as it is, reads to be evaluation criteria without response instructions.

The Technical Evaluation Panel uses the Go/No-Go criteria as an initial scrub of proposal packages. Offerors are not required to provide a direct response to Volume IIA. The separate volumes described in the RFP are the only artifacts to be included in the packages.

26. Attachment C, Non-Disclosure Agreement. Please clarify if any specific safeguarding for information and materials outside of the E.O. 13556 is required.

All relevant criteria are described in the non-disclosure clauses.

27. PWS RFP Page 62. On RFP page 62, the Offeror notes that there are two (2) PWS Section 3.4.2:

3.4.2 Security Engineering Resource and 3.4.2 Security Engineering Resource Surge Support.

Please advise if this is a numbering error and the second PWS Section 3.4.2 should be numbered 3.4.2.1.

This is a numbering error, and CFPB will provide an updated PWS to clarify.

28. RFP pages 108 through 112. Volume I - Contractual Documents. Solicitation Pages 108 through 112 - Is Offeror required to submit responses to 52.219-1 if it is NOT a Small Business?

Yes, complete (c)(1).

29. RFP pages 121 through 135. Volume I - Contractual Documents. Solicitation Pages 121 through 135, Representations and Certifications - Please clarify if this requirement is to be submitted under Volume I.

Offerors shall adhere to the Proposal Instructions included within this solicitation on pages 112 through 120.

30. RFP Pages 112 and 113. On RFP pages 112 and 113, the Government defines aspects Personally Identifiable Information (PII) which are prohibited for the proposal. In RFP page Section (b), "individual's name" can be included and in Section (c) the RFP suggests that it should not be included. Please confirm that the names of candidate key personnel can be included.

Names of proposed candidates for Key LCATs should be included in the resume.

31. RFP Page 116 Required Proposal Documents. Please clarify that a cover/title page can be included in the Offeror's proposal for each volume, and is excluded from the page count.

The cover page is not included in the page count.

32. RFP Page 116 Required Proposal Documents. Please clarify that a Table of Contents and a List of Exhibits can be included in the Offeror's proposal for each volume, and both are excluded from the page count.

Offerors are allowed a single page for a coversheet, a single page for a table of contents, and a single page for acronym definitions what will not count against the 20-page limit.

33. RFP Page 116 Required Proposal Documents. Does the requirement for Arial 10 point font in the Volume IIB Technical Approach apply to all proposal volumes?

Arial Narrow 8-point font is acceptable for graphics, but tables must still adhere to the 10-point Arial (not Arial Narrow) font guidance in the solicitation. This applies to all volumes.

34. RFP Page 116 Required Proposal Documents. Please clarify the allowable font size for tables and graphics.

Arial Narrow 8-point font is acceptable for graphics, but tables must still adhere to the 10-point Arial (not Arial Narrow) font guidance in the solicitation. This applies to all volumes.

35. RFP Page 116 Required Proposal Documents. On RFP page 117, please confirm that instructions in the Offeror's response for Volume IIC Factor 3: Key Personnel have no page limitations, other than the 2-page limit for each resume.

The Technical evaluation panel will only assess resumes for key LCATs. Other content such as a coversheet, organization charts, or descriptive narratives will not be evaluated.

36. RFP Page 116 Required Proposal Documents, Attachment D. In Volume IIE - Factor 5: Small Business Participation, please confirm Attachment D is excluded from the Volume IIE - Factor 5: SB Participation 5-page Response.

Yes.

37. RFP Page 116 Required Proposal Documents, Attachment E. In Volume IIE - Factor 5: Small Business Participation, please confirm Attachment E is excluded from the Volume IIE - Factor 5: SB Participation 5-page Response.

Yes.

38. RFP Pages 120 and 3. There are references to discounts ( e.g. "price proposal shall include…discounted rates..."and "most favored customers" in the RFP, however there is no overarching federal supply schedule (e.g. GSA) upon which the BPA rates are to based on. Please revise language relative to discounts and most favored customers, or identify if pricing is to be based on an existing supply schedule.

Interested offerors are encouraged to provide their best price for the associated level of effort.

39. BPA Dollar Value and SB Participation Goals. Please provide an estimated BPA dollar value so US Treasury FY 2023 Small Business Participation goals can be provided for this proposal?

The BPA award Dollar Value is not available at this time.

40. BPA Rate Card - Volume III Price Proposal. Please confirm the template/format for receipt of the BPA rate card (pdf or excel), and confirm rates should be provided for each contract period (5 years total).

Offerors shall adhere to the Proposal Instructions included within this solicitation on pages 112 through 120. Pricing shall be submitted for each contract period.

41. Volume III Price Proposal. Please confirm the period of performance start date that the offeror should be using.

The anticipated award date of the BPA(s) will be June 28, 2023. This date is subject to change.

42. RFP Page 34 Organizational Conflict of Interest Attestation. Please confirm that such attestation is to be included as part of proposals in Volume I.

Yes

43. RFP Page 5 Order of precedence. Please specify which schedule of supplies/services is referenced under (1)

This will be defined in each Task Order and is expected to closely align with various subtasks under section 3.0 (Performance Work Statement).

44. RFP Page 6 Order of precedence. Please identify and provide order of precedence of the paragraphs referred to as "other paragraphs" and specify which clause is "of this clause" under (6); OR delete in its entirety.

This is standard commercial item terms, conditions and clauses. The order of precedence should be followed as shown.

45. RFP Page 6 Order of precedence. Please specify each document, exhibit and attachment with order of precedence, referred to as "Other documents, exhibits and attachments" under (8); OR delete in its entirety.

This is standard commercial item terms, conditions and clauses. The order of precedence should be followed as shown.

46. RFP Page 8, 52.212-4 CONTRACT TERMS AND CONDITIONS -- COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES. The requirements under this clause do not appear pertinent. Please clarify purpose of this information and when/if it is required.

This is standard commercial item terms, conditions and clauses. The order of precedence should be followed as shown.

47. RFP Page 34 Organizational Conflict of Interest Attestation. Please confirm that such attestation is to be included as part of proposals in Volume I.

Yes.

48. RFP Page 5 Order of precedence. Please specify which schedule of supplies/services is referenced under (1)

This will be defined in each Task Order and is expected to closely align with various subtasks under section 3.0 (Performance Work Statement).

49. RFP Page 6 Order of precedence. Please identify and provide order of precedence of the paragraphs referred to as "other paragraphs" and specify which clause is "of this clause" under (6); OR delete in its entirety.

This is standard commercial item terms, conditions and clauses. The order of precedence should be followed as shown.

50. RFP Page 6 Order of precedence. Please specify each document, exhibit and attachment with order of precedence, referred to as "Other documents, exhibits and attachments" under (8); OR delete in its entirety.

This is standard commercial item terms, conditions and clauses. The order of precedence should be followed as shown.

51. RFP Page 8, 52.212-4 CONTRACT TERMS AND CONDITIONS -- COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES. The requirements under this clause do not appear pertinent. Please clarify purpose of this information and when/if it is required.

This is standard commercial item terms, conditions and clauses. The order of precedence should be followed as shown.

52. How can we participate in the bidding process and submit the tender? Is there any procurement portal?

Vendors shall follow the instructions within solicitation # RFP20343023R00002 posted to SAM.gov.

53. How do we access and download the documents related to scope of work and other bid documents? Request for a copy of tender: Tender No. RFP20343023R00002.

All applicable documents are available for download within the solicitation #

RFP20343023R00002.

54. Is there any registration fee or other fees and how do we have to pay?

There are no registration fees or other fees to submit a proposal. Please refer to the solicitation for instructions on submitting a proposal.

55. Can we file the tender in the global language English? Will the tender documents be available in English language?

English should be used for all documents posted or accepted.

56. Can you please confirm the due date for the subject solicitation was extended to May 22, 2023 at 10:00 am? There doesn’t appear to be an associated amendment document uploaded to SAM.gov.

The extension was processed through Amendment 1.

57. Is this a new requirement or an existing requirement?

This is an existing requirement.

58. How many incumbents are there performing this work?

There are three (3) incumbents.

59. What are the incumbent names, contract #s, and revenues received under the incumbent contract?

TFSACFPBPA16006 (20343018A00006) – Booz Allen Hamilton Inc (BAH), TFSACFPBPA16007 – Knowledge Consulting Group Inc (KCG), TFSACFPBPA16008 – Deloitte Consulting Group LLP (Deloitte). For additional information please conduct research via the Federal Procurement Data System (FPDS).

60. How many FTEs were on the previous contract? Has the PWS Changed?

There are approximately 45 full-time equivalent (FTE) and 7 part-time contractor positions across all currently active task orders. The PWS contents have changed in many areas since the previous BPA was awarded.

61. What did you like about the previous contract? Dislikes?

CFPB is looking for offeror to support a cohesive and collaborative environment, while continually to identify efficiency and effectiveness in performing the PWS.

62. What is the estimated budget for this opportunity?

The offeror should propose costs that provide the best value for the requirements.

63. What are your Key Performance Indicators?

Organizational Key Performance Indicators for Cybersecurity are reviewed quarterly and generally center around core tasks that align with the subtasks. Currently, there are numerous metrics used in different task areas, and part of the subtask for CISO-COR support is the development of future iterations of these performance indicators.

64. If we have a teaming agreement with a subcontractor, does the subcontractor's experience count as experience for the prime?

Yes, but only if the work proposed for a given subtask will be performed by the subcontractor with the relevant experience.

65. Page: N/A. RFP Section: N/A. Will the Government please confirm that this contract will be issued under the Multiple Award Schedule (MAS) Information Technology Special Item Number (SIN) 54151HACS, Highly Adaptive Cybersecurity Services (HACS)?

As stated in the solicitation, this acquisition is an unrestricted open market acquisition.

66. Page: 5-3. RFP Section: Pricing. Will the government please remove the most favored customer language in this section as this appears to conflict with clause 552.238-81 (formerly 552.238-75) Price Reductions included in all Schedule contracts?

The language has been removed.

67. Page: 52. RFP Section: 3.3, Cybersecurity Safeguards and Risk Management Support. Will the Government please provide the metrics as to: How many FISMA reportable IT Systems are in the enterprise? How many are High, Medium, Low or General Support Systems?

There are currently 111 FISMA reportable systems (90 Moderate/21 Low)

68. Page 52 . RFP Section: 3.3, Cybersecurity Safeguards and Risk Management Support. Will the Government please provide the metrics as to how many new systems, on average, are developed and deployed into the CFPB enterprise annually that will require assessment and authorization?

Average – new systems requiring full ATOs = 10 to 12 Average – updates to existing ATOs = 8 to 15

69. Page: 52. RFP Section: 3.3, Cybersecurity Safeguards and Risk Management Support. What tools/solutions are currently used by CFPB to support Configuration Management, Continuous Monitoring, and Asset Management capabilities?

DOJ Cyber Security Assessment and Management (CSAM), ServiceNow, Qmulos Q-Compliance, and Bitsight

70. Page: 61. RFP Section: 3.4.1 Security Architecture Support. What offerings, if any, are currently being utilized from DOJ's IT Services: SOCaaS (what products/tools), CSAM (which components), Cloud-Optimized TIC (TIC 3)?

We are currently using CSAM, and we are undergoing final preparations to use DOJ SOCaaS and DOJ Justice Edge Trusted Services (JETS)

71. Page: 116. RFP Section: Volume IIB, Factor 2: Technical Approach. Can the offeror include a Table of Contents that will not count towards the page count?

Yes, but the Table of Contents may not exceed a single page.

72. Page: 116. RFP Section: Volume IIB, Factor 2: Technical Approach. Will the government allow 8-pt font size graphics and tables?

Arial Narrow 8-point font is acceptable for graphics, but tables must still adhere to the 10-point Arial (not Arial Narrow) font guidance in the solicitation.

73. Page: 119/120. RFP Section: Attachments D (Small Business Participation Plan) and E (Subcontracting Plan Outline). Please confirm that Large Businesses must complete both Attachment D and Attachment E, as they appear to require similar Information.

Yes. Attachment D will be evaluated as described in the solicitation. Attachment E is required by FAR 19.7 for only the apparent awardee.

74. Page: 119/120. RFP Section: Attachments D (Small Business Participation Plan) and E (Subcontracting Plan Outline). Is it the Government's expectation that each Vendor will meet the business percentage targets for each socioeconomic sub-category (as listed on p.119 of the RFP) in order to meet the subcontracting criteria or meeting/exceeding some of the categories would suffice?

To be clear, the SDB goal is 5%. Offers shall propose to meet all of the socioeconomic goals listed on P. 119, including the correct SDB goal of 5%.

75. RFP pages 23 and 107. RFP page 23 "Contractor Transition Planning/Implementation" states "the award resulting from this solicitation is anticipated to occur in time to permit at a maximum a 60-day transition period." RFP page 107, Section 12.0 Phase In/Phase Out Period states: "To minimize any decreases in productivity and to prevent possible negative impacts on additional services, the Contractor shall have personnel on board, during the ninety (90) day phase in/ phase out periods." Please specify the number of days for each of the Transition-In and Transition-Out phases.

Correction to page 107 of the RFP: “To minimize any decreases in productivity and to prevent possible negative impacts on additional services, the Contractor shall have personnel on board, during the sixty (60) day phase in/ phase out periods.”

76. RFP Page 113 Basis for Award. This section states that the Government will not make an award at a significantly higher overall price...to achieve slightly superior technical skills. Given that the BPA requires submittals of labor hour rates, and that Offeror may propose additional (or fewer) LCATs than those identified in the RFP, please advise how the Government will evaluate such additional/fewer LCATs/rates to determine best value to the Government?

As described in Volume IIIc (Key Personnel), the Offeror must articulate in their Technical Approach how they will leverage the number of reduced or added LCATS to accomplish work specified in the PWS criteria. The Technical Evaluation Panel will assess the technical approach to determine if it is sufficient to account for the proposed reductions of each LCAT, or substantive additional value in the case of additional LCATs. In either case, the change must be determined by the Technical Evaluation Panel to likely result in successful task order execution.

77. RFP Page 113 Basis for Award. For best evaluation purposes, please confirm that the specific Level of Effort identified for the individual PWS task areas is to be priced by Offerors, in addition to the required BPA Rate Card pricing.

Yes, the specific level of effort for both Key and non-key positions must be included in the pricing proposal.

78. Volume IIE Factor 5. To enable Offerors to develop the Small Business Participation Plan (Volume IIE Factor 5 Section A) and Small Business Subcontracting Plan (Volume IIE Factor 5 Section B), please confirm that Offerors may utilize the Level of Effort identified in the PWS multiplied by the hourly rates in the BPA Rate Card.

The PWS Projected LOE (hours) multiplied by the contractors proposed GSA rate-inclusive of all discounts, and Labor Category should be submitted for price evaluation.

79. RFP Page 117 Volume IIC, Factor 3. Key Personnel Instructions. On page 117 of the RFP, the Government has identified a list of 19 key personnel labor categories for this BPA. The Offeror understands that the total number of actual key personnel resumes are based on the Key Personnel FTEs in RFP PWS on pages 89 through 105, which we calculate as 23.5 FTEs. Please confirm.

The anticipated number of personnel described under section 6.0 includes both key personnel and non-key personnel. However, the table on page 117 only includes the key personnel, hence the difference. Resumes are required for each candidate for a key position, but resumes are not required for non-key positions (Note that while resumes for non-key positions are not required in the proposal, the personnel filling those non-key positions must still meet minimum qualification requirements). The calculation of 23.5 FTEs does not seem to consider the total number of hours projected for each LCAT. In CFPB’s projections, one Full Time Equivalent (FTE) Level of Effort is calculated at 1920 hours per year as noted at the top of page 89 of the solicitation. For example, the Senior Vulnerability Analyst LCAT is estimated at 3840 hours and therefore CFPB anticipates two proposed resumes unless the offeror proposes a reduction or increase to the number of personnel under that LCAT.

80. RFP PWS Sections 3.3.1-3.3.1.3 (page 92). In the Key Personnel Senior Information System Security Officer (ISSO) position, due to the nature of work and complexity, we respectfully request that the Government modifies the position to require experience for Subject Matter Expert (SME) capabilities specifically with NIST SP 800-37 Risk Management Framework, 800- 60, 800-53, 800-53A, FIPS199 (and related OMB and NIST guidance), and we urge the number of years of such SME experience increase from 3 to 7+ years.

CFPB concurs and we have updated the PWS accordingly.

81. RFP PWS Sections 3.3.1-3.3.1.3 (page 92). In the Key Personnel Senior Information System Security Officer (ISSO) position, due to the nature of work and complexity, will the government consider that the number of hours for this key personnel position be increased from 1920 to 3,840?

82. RFP PWS Sections 3.3.1-3.3.1.3 (page 93). In the Non-Key Personnel Senior Information System Security Officer (ISSO) position, due to the suggested increase in the Key Personnel ISSO, we recommend that that Government reduce the number of Non-Key Personnel ISSO from 7680 to 5760 hours.

83. RFP PWS Sections 3.3.1-3.3.1.3 (page 93). In the Non-Key Personnel Senior Information System Security Officer (ISSO) position, due to the nature of work and complexity, we respectfully request that the Government modifies the position to require experience for Subject Matter Expert (SME), specifically with NIST SP 800-37 Risk Management Framework, 800-60, 800-53, 800-53A, FIPS199 (and related OMB and NIST guidance), and we urge the number of years of such SME experience to be 1 to 3+ years.

84. RFP PWS Personnel Table (page 91; categories described as 3.2.3 and 3.2.4) For the Senior IT Audit & Compliance Specialist, the Offeror requests the Government to allow a substitution of "Bachelor's degree with a concentration in Cybersecurity" with IAT or IAM III certifications.

The lack of a bachelor’s degree would not disqualify the candidate as this is a desired but not a minimum qualification.

85. RFP PWS Personnel Table (page 91; categories described as 3.2.3 and 3.2.4). For the Senior IT Audit & Compliance Specialist, the Offeror requests the Government to allow additional experience in cybersecurity in lieu of a "Bachelor's degree with a concentration in Cybersecurity."

The lack of a bachelor’s degree would not disqualify the candidate as this is a desired but not a minimum requirement.

86. RFP PWS Sections for Section 3.2. In RFP PWS Section 3.2, paragraph numbers in the PWS document do not appear to align to paragraph numbers in the PWS personnel table. On PWS page 49, Cybersecurity Policy, Directive, Process, Procedure and Communication Development Support is listed as 3.2.3; in the PWS personnel table (page 90), this is listed as 3.2.2. Please clarify.

The PWS has been updated accordingly.

87. RFP PWS Sections for Section 3.2. In RFP PWS Section 3.2, paragraph numbers in the PWS page 50, Cybersecurity Audit and Compliance Support is listed as 3.2.5; in the PWS personnel table (page 91), this is listed as 3.2.3. Please clarify.

88. RFP PWS Sections for Section 3.2. In RFP PWS Section 3.2, paragraph numbers in the PWS page 51, Technology & Innovation Audit and Compliance Support is listed as 3.2.7; in the PWS personnel table (page 91), this is listed as 3.2.4. Please clarify.

89. RFP PWS Sections for Section 3.2. In RFP PWS Section 3.2, paragraph numbers in the PWS page 52, Cybersecurity Workforce Development is listed as 3.2.9; in the PWS personnel table (page 91), this is listed as 3.2.5. Please clarify.

90. RFP PWS Sections for Section 3.2. In PWS Personnel Table (page 90), is Cybersecurity Program Coordinator part of the Cybersecurity Project Management Support PWS 3.2.1? Please clarify.

The Cybersecurity Program Coordinator is under PWS 3.1.3. The PWS has been updated accordingly.

91. (RFP) 20343023R00002 RFP Section: Due Date/Time. Page: 2. Due to the size and scope of this response, the time to receive answers to questions, and to ensure a fair pool of bidders, we kindly request the Government provide at least a one-week additional extension.

An extension to 05/22/2023 at 10:00am EST has been issued through Amendment 1.

92. Instructions to Offerors. RFP Section: Attachment F Volume IIA. Page: 115-116. The Go/No-Go criteria, exceptions, and notes listed in the RFP do not align with the Go/No-Go Criteria listed in Attachment F. Would the Government please confirm that the Go/No-Go criteria in the

Volume IIA instructions are the complete and accurate version? And if so, please provide an updated Attachment F.

An updated Attachment F will be provided. The Go/No-Go Factors as listed on pages 115-116 of the RFP are accurate.

93. PWS RFP Section: 3.4.2. Page: 62. Section 3.4.2 appears to be duplicated. Would the Government confirm whether Security Engineering Resource Surge Support is combined with

3.4.2 Security Engineering Support, and therefore evaluated as one subtask?

The PWS has been updated.

94. PWS. RFP Section: 12.0 Phase-in Phase-Out. Page 23, 107. 12.0 lists the Phase-In/Phase-Out period to be 90 days. Contractor Transition Planning/ Implementation (March 2019) lists a maximum of a 60-day transition period. Would the Government please confirm the correct time period for the Phase-In/ Phase-Out period?

Correction to page 107 of the RFP: “To minimize any decreases in productivity and to prevent

95. (RFP) 20343023R00002. RFP Section: 12.0 Phase-in Phase-Out. Page: 23, 107. Since it is not evaluated and not part of a Go/No-Go decision, would the Government please consider removing the requirement to submit phase-in/ phase-out plans for this BPA and make it a requirement for ~30-60 days after contract kickoff, post-award?

The CFPB will lift the requirement to provide a phase-in/phase-out plan as part of offeror proposals. However, for new task order awardees selected to support the BPA, the phase-in plan will be a mandatory deliverable within 5 business days of award to facilitate transition and program continuity.

96. (RFP) 20343023R00002. RFP Section: 12.0 Phase-in Phase-Out. Page: 23, 107. If the Government requires Phase-In/Phase-Out plans with this submission, would the Government consider include the Phase-In and Phase-Out plans within Volume IIB, Technical Approach and not count it against page limit?

The CFPB will lift the requirement to provide a phase-in/phase-out plan as part of offeror proposals. However, for new task order awardees selected to support the BPA, the phase-in

97. (RFP) 20343023R00002. RFP Section: Volume IIA. Page: 115. Would the Government please confirm that there is nothing for offerors to submit for Vol IIA, Factor 1, Go/No-Go Criteria?

The Technical Evaluation Panel uses the Go/No-Go criteria as an initial scrub of proposal packages. The separate volumes described in the RFP are the only artifacts to be included in the packages.

98. (RFP) 20343023R00002. RFP Section: Type of Contract. Page: 121. Would the Government please elaborate on how individual task orders will be competed and issued following one or more BPA awards?

Task Orders will be competed following the award of the BPAs once awardees of the BPAs have been selected.

99. (RFP) 20343023R00002. RFP Section: Attachment E. Page: 2. In Attachment E, should the total subcontracted dollars be based on our priced proposal?

Yes.

100. (RFP) 20343023R00002. RFP Section: RFP. 116. Would the Government please allow for Arial Narrow 10pt font for tables and graphics?

101. (RFP) 20343023R00002. RFP Section: Required Proposal Documents. Page: 114. Would the Government confirm that offerors should submit one combined file for Volumes IIA-IIE?

Offerors should provide each volume as a separate file. Note that Volume IIA (Go/No-Go Criteria) does not require a submission. This is shared with the offerors to be made aware of the high-level criteria the Technical Evaluation Panel will use to initially screen proposals.

102. PWS. RFP Section: 3.2.6. Page 50. Would the Government please confirm whether 3.2.6 should be titled “Cybersecurity Audit and Compliance Surge Support”?

Section 3.2.6 should be titled “Cybersecurity Audit and Compliance Support Surge Support”.

103. PWS. RFP Section: 6.0 Key and Non-Key Personnel. Page: 92. Would the Government accept alternate certifications to the CISSP, such as CISM, CCISO, or GSLC?

Yes. CFPB has updated the minimum requirements to require the CISSP or CISM certification.

104. PWS. RFP Section: 6.0 Key and Non-Key Personnel. Page: 92. Would the Government consider amending the requirement “Demonstrated experience leading cybersecurity risk management programs of 5 or more IT professionals” to “demonstrated years of experience in cyber risk management”? Experience leading cyber programs is unlikely to be found in personnel who are still Senior ISSOs and have not moved on to Program Manager roles.

No. For the key personnel position, the Senior ISSO is not only experienced in leading a team, but also a hands-on risk management practitioner.

105. PWS (RFP) 20343023R00002. RFP Section: PWS 3.0-5.0 Instructions IIB. Given that CFPB does not anticipate replacing any of its current cybersecurity toolsets based on offeror proposals and offerors are required to define all tools used to execute the contract, will the Government provide a comprehensive list of tools used to support deliverables within the task and subtask areas?

While CFPB doesn’t plan on replacing any existing tools based on proposals, offerors may propose additional technologies to compliment capability if that is an integral component of their technical approach. Below is a general list of technologies the CFPB currently uses to maintain the Cybersecurity program:

• Subtask 3.2 (Cyber Program Management) o KnowBe4 o ServiceNow

• Subtask 3.3 (Safeguards and Risk Management) o Bitsight o CSAM o HackerOne o Jira o Qmulos Q-Compliance and Q-audit o ServiceNow

• Subtask 3.4 (Security Architecture and Engineering) o AWS Config o Jira o ServiceNow

• Subtask 3.5 (Cyber Operations) o Anomali ThreatStream (with VMray) o AWS CloudTrail, GuardDuty, Macie o Axonius o BurpSuite Enterprise and Professional o Core Impact o Cribl o CrowdStrike Falcon o IntelJ IDEA o Jira (for project management only, not incident response ticketing) o Microsoft Purview (for Data Loss Prevention) o Qualys o ServiceNow SecOps (for Cyber Incident Response Ticketing) o Splunk to include Enterprise Security (ES), Security Orchestration & Automated

Response (SOAR), and User Behavior Analytics (UBA) o Tenable o VirusTotal

106. PWS. RFP Section: 3.3.4. Page: 60. “The Contractor shall provide specialized contractor support for executing strategy for dealing with increasing number of audits, compliance checks and external assessment processes for internal/external auditors, NIST 800-171 and FISMA.” – Does the Government intend to cite NIST SP 800-53 instead of NIST SP 800-171?

No, we need support for both NIST 800-53r5 and NIST SP 800-171 as well

107. PWS. (RFP) 20343023R00002. RFP Section: Technical – General, PWS 3.0-5.0. Surge support tasks are inconsistently listed across tasks and subtasks. Would the Government consider consolidating the surge support response into a single response section to be applied across all subtasks?

The offeror is welcome to structure its proposal in a manner that best articulates its technical approach within the page limit. We have updated the PWS to clarify sections related to surge support.

108. (RFP) 20343023R00002. RFP Section: Technical – General. Would the Government allow submission of security packages for surge staff personnel prior to a need arising?

Yes, this would be acceptable.

109. RFP. Section: Volume IIA, Factor 1: Past Performance and volume IID, Factor 4. Pgs. 116 and

118. With respect to the language, "Note: Contract periods of performance whose duration have not completed will only count up to the time at which the proposal is evaluated (i.e. a contract POP of 03/15/2021 to 03/14/2026 will only count as approximately two years of experience, not five)." and "The Offeror will be evaluated on performance under existing and prior contracts with similar Product Service and NAICS Codes. The Government will focus on information that demonstrates quality of performance, customer service, cost control, problem resolution, and the submission of timely reports relative to the size and complexity of the procurement under consideration as well as the relevance of the project." - it is currently unclear how/whether the government will weight a past performance reference with a POP of 2 delivered years of an ongoing contract versus that of a completed 5 year contract that ended 2 years ago. Will the government please clarify whether an ongoing contract that has less than 3 completed years would be evaluated less favorably than a contract which has 5 full years of performance that ended within the last 3 years?

Offerors should provide the most relevant and most recent past performance that demonstrates their experience would indicate a high probability of program success.

110. RFP. Section: Volume IIA, Factor 1: Technical Proposal. Pg. 115. Whereas the government states, "NO-GO - Multiple significant weaknesses without Significant Strengths to counterbalance risk (like a compensating control) in the subtask is unacceptable" and "NO-GO

- Three or more significant weaknesses in a subtask are unacceptable. (Exception, an offeror may still earn a “GO” rating for the parent Task Area if ALL the other related subtasks are strong enough to compensate for the single weak subtask.)," will the government please clarify the intent of these statements? Does this mean that an offeror may have 2 significant weaknesses and can mitigate these with compensating strengths, but once they have 3 significant weaknesses, no such mitigation will be considered within the subtask area?

Yes. A high volume of significant weaknesses, even with compensating strengths, still introduces substantial risk to the successful execution of the program.

111. RFP. Section: Volume IIA, Factor 1. Pg. 115. Will the government please provide definitions of evaluation finding terms of strength, significant strength, weakness, significant weakness, and deficiency?

No.

112. RFP. Section: Volume IIC, Factor 3. Pg. 118. Whereas the government states, "Offerors should highlight content within the candidates’ work history that is directly applicable to requirements of the PWS," for the avoidance of doubt, does the government wish that resume/work history content relevant to the PWS is actually "highlighted" through shading/bolding or is this statement meant to suggest that the wording should explicitly demonstrate the relevant work history, but that highlighted shading of relevant elements is not necessary?

This statement is intended for the relevant content of the resume to stand out during the reviews, so a highlight (as in a yellow background behind black text) is not required nor is it discouraged. Bold text is sufficient to call out a specific experiential qualification.

113. RFP. Section: Volume IIE: Factor 5 A. 4. Pg. 119. How will the government evaluate prior performance information relative to Small Business prime offerors in this sub-factor given that it is not common practice, nor a requirement on other programs for small businesses to complete or manage small business participation/commitment or subcontracting plans?

Small business prime offerors participation as a prime counts towards the percentages set in this evaluation factor and small businesses shall not be required to subcontract to other small businesses in order to achieve the small business participation goals.

114. RFP. Section: Basis for Award. Pg. 114. Will the government please clarify what, if any, adjectival ratings will be used to assign rating scores to Factors 2 through 4?

115. RFP. Section: General. Pg. General. Will the government award task orders as a direct result of these proposals or will task orders be competed separately after the BPA award pool has been established?

Task Orders will be competed following the award of the BPAs once awardees of the BPAs have been selected.

116. RFP. Section: Attachment F. The Go/No-Go criteria in the attachment vary from those outlined in Volume IIA, Factor 1 in the RFP. Will the government please modify the respective sections to make them consistent?

the RFQ are accurate. Please see pages 115 and 116 for details.

117. RFP. Section: Volume IIB, Factor 2. Pg. 116. Will the government allow 8-pt font for graphics and tables?

118. RFP. Section: Volume IIB, Factor 2. Pg. 116. Where the government requires "Arial" font - can the offeror use any font in the "Arial" family?

119. RFP. Section: Volume IIB, Factor 2. Pg. 116. Will the government please confirm that a table of contents and an acronym list may be included and not considered as part of the 20 page limitation for this section?

Yes, but the Table of Contents and acronym list may not exceed a single page each.

120. RFP. Section: General. Does the government have an anticipated timeline for task orders after the BPA is awarded?

It is anticipated that Task Orders will be awarded on or before 08/28/2023.

121. RFP. Section: General. How many task orders are anticipated under the resultant BPA?

CFPB anticipates awarding as many as five task orders under the first period of performance.

122. RFP. Section: RFP Factor 5 Section A #5, Attachment E page 1. RFP Page 119; Attach E page 1.

The RFP states that the target for SDB is 12% while the attachment states 5%. Can the government confirm which is the correct target?

5% is the correct SDB subcontracting goal.

123. RFP. Section: RFP Factor 5 Section A #5, Attachment D page 1. RFP Page 119; Attach D page 1.

The RFP states that the subcontracting goals are percentages of total planned subcontracting dollars while the attachment states that it is of total contract value. Can the government confirm which the Offeror should use?

Offers shall report percentages of total contract value.

124. RFP. Section: 3.4.2 Security Engineering Resource Surge Support. Page 64. The surge task listed under 3.4.2 currently references Security Baseline Development Resource Surge Support, but seems intended to reference surge support for security engineering resource surge support. It also references deliverables consistent with those from 3.4.1 which is Security Architecture Support. Will the government please update this paragraph to consistently reference Security Engineering Surge support and the associated deliverables of 3.4.2?

125. RFP. Section: Terms and Conditions, Section 3. Pg 3. The Pricing Section requires Contractors to warrant that prices offered are not in excess of most favored customers. This is a clause generally reserved for GSA Schedule-based solicitations. As this is not a GSA procurement, will CFPB please remove this clause?

The language within the section has been removed.

126. RFP. Section: General. Does CFPB have size limitations on receiving attachments?

CFPB can accept files via email that are no larger than 10MB each. Total message size restrictions are 36MB.

127. RFP. Section: Volume III Price Proposal. Pg 121. The government requests labor categories and discounted rates as part of the proposal. Will the government please clarify the basis from which discounts should be applied? This is not a GSA procurement, so discounts from GSA would not be applicable. Will the government modify this language to request BPA rates and allow discounts from those rates to be applied during competition at the BPA Order/ BPA Call/ Task Order level?

Contractors are to provide their proposed level of effort at the contractor’s labor category hourly rate.

128. RFP. Section: Basis for Award and Price Proposal. Pages 113-114; and 121-122. The government requests labor categories and discounted rates as part of the proposal. The government also stipulates that it will "not make an award at a significantly higher overall price to the Government to achieve slightly superior technical skills." Given that there is no templatized pricing volume, how will the government evaluate "overall price"?

Proposed Level of effort(hours)shown in the PWS and proposed labor categories will be evaluated.

129. RFP. Section: Basis for Award and Price Proposal. Pages 113-114; and 121-122. The government also stipulates that it will "not make an award at a significantly higher overall price to the Government to achieve slightly superior technical skills." Will the government remove reference to price as a component of Best value at the BPA given that discounts from BPA prices should be proposed in response to the defined scope of a subsequent BPA Call/ BPA Order/ Task Order?

No. Pricing will remain as it is part of a best value determination.

130. RFP. Section: Basis for Award and Price Proposal. Pages 113-114; and 121-122. The government also stipulates that it will "not make an award at a significantly higher overall price to the Government to achieve slightly superior technical skills." Discounts should be offered at the BPA Call/ BPA Order/ Task Order Level. Offerors cannot assume that they will be awarded the full scope of work under the associated BPA and thus cannot offer discounts associated with the full work scope. Will the government revise the requirements to evaluate BPA rates for reasonableness and allow the BPA Calls/BPA Orders/ Task Orders to function as the mechanisms from which Best Value determinations that contemplate price can be evaluated?

No. Best value determination will apply at the BPA Base level as well as at the BPA order level, inclusive of technical criteria shown and price.

131. RFP. Section: Basis for Award, Technical Approach, Key Personnel and Price Proposal. Pages 113-116; and 121-122. The government "HIGHLY ENCOURAGED" proposal of cost-saving efficiencies. While strategies to drive cost savings can be proposed, there is no mechanism to reflect such efficiencies in the Price Proposal. As stated, the Price Proposal will evaluate labor categories and discounted rates. Assessing rates tied to Labor categories without attributing a level of effort tied to a scope and technical approach renders quantifiable cost efficiencies impossible to evaluate. Cost efficiencies and resultant "overall costs" are only relevant to BPA Calls/BPA Orders/Task Orders under the BPA. As the BPA solicitation does not have any BPA Calls/BPA Orders/ Task Orders outlined in the solicitation, will the government please modify all price proposal language to stipulate that BPA rates will be evaluated for reasonableness only, and will not be considered as part of an overall Best Value determination (since overall cost tied to a specific scope of work cannot be evaluated)?

Proposed Level of effort(hours)shown in the PWS(starting on page 89) and proposed labor categories will be evaluated.

132. RFP. Section: Basis for Award and Price Proposal. Pages 113-114; and 121-122. The government also stipulates that it will "not make an award at a significantly higher overall price to the Government to achieve slightly superior technical skills." Under the Price Proposal, only rates and discounts are requested which will not allow for an evaluation of overall cost.