RFP-33-11-325 Responses to Vendor Questions 2.pdf

U.S. Nuclear Regulatory Commission Responses to Questions Information Technology Infrastructure and Support Services (RFP-33-11-325)

Response Package 2 4/23/2002 Page 1 of 27

ID RFP Reference Question Response 318 SOW Section C.4.2

NRC Locations “The NRC ITI is extended to an application support facility”

Please provide the location of this facility and any security requirements in entering the facility or working on its network

With an NRC badge, ITISS contractors will be granted admission to the application support facility. If the Contractor requires access to more secure spaces in that facility (such as the server room) they will be assisted by a facility representative that supports local IT infrastructure at the facility (this individual works for the application support contractor)

150 1Reference: SOW Section C.4.4.1.1, Hardware, page 11;

SOW Section C.7.1, Initial Transition, page 129.

This section describes the hardware environment as consisting of approximately 6,860 personal computers (i.e., 5,450 desktops, 310 laptops, approximately 1,000 GFE laptops, and 100 high performance computing workstations). SOW Section C.7.1 provides Table 4, which lists leases for 5,350 personal computers (i.e., 4,500 desktops and 850 laptops). There is a delta of 1,510 personal computers. Please clarify if the 1,510 personal computers that are not accounted for in Table 4 are the equipment owned by the incumbent ISSC contractor.

Please also provide information required for offerors to be able to estimate the timing of the refresh costs for the equipment not accounted for in Table 4 (e.g., quantity, manufacturer, item description/model, and age).

The 6,860 is a reasonable estimate of the number of personal computers provided by the incumbent ISSC contractor. Table 4 in section C.7.1 provides information about leases that the incumbent ISSC contractor has entered into that will extend beyond the end of the ISSC contract. As explained in section C.7, there is an expectation that the ITISS awardee will either need to assume these leases or absorb the cost of cancelling the leases. There are other leases for the remainder of PCs in the environment (approximately 1,510) which will complete their 36-month lease obligations either during the transition period or earlier. An ITISS Offeror is not obligated to maintain these leases, and will need to acquire replacement PCs in order to address the NRC's requirements and transition out the existing equipment.

Response Package 2 4/23/2002 Page 2 of 27

261 SOW-C.6.2.2 The offeror shall perform day to day operations and maintenance and on-site technical support of OCIMS as well as provide preventive maintenance on various OCIMS equipment and keep the equipment in operating condition consistent with best practices. Currently, most of this hardware is owned by the NRC. The offeror shall recommend a strategy for the replacement of OCIMS hardware with offeror-supplied hardware over a period of time as the current hardware comes to the end of its refresh cycle. The offeror shall also be required to update the OCIMS asset inventory list when additions and/or deletions are made in the OCIMS environment. Provide age and inventory of assets.

The majority of the requested information about assets in the OCIMS environment has been provided with the RFP as Attachment F (Inventory List). Please refer to the tab titled "NSIR Ops Center (Additional)".

Although specific age of equipment is not provided, much of the information can be discerned from the models of the equipment.

301 RFP Attachment F NRC ITISS Inventory List Personal Computing Tab Multiple items listing portable and desktop computers

To allow offerors to accurately price the support of GFE computing devices please provide specific information on the locations, models with configurations and software, system ages and warranty status of each seat to be covered under this contract. If the government cannot supply detailed information regarding the seats to be supported, please confirm that offerors will be able to adjust prices for seats following contract award after performing inventories.

Section C.7 of the SOW "Transition Considerations" goes into detail about transfer of leases and other equipment owned by the incumbent ISSC contractor.

Table 4 provides data for approximately 5,350 personal computers including the make, model, and when they will reach the end of their three-year life-cycle. The remaining balance of personal computers (approximately 1500) will have already reached the end of their three-year life cycle by the point of transition. Offerors will NOT be able to adjust prices for seats following contract award. However, the number of units may vary depending on the Offeror's Transition Plan as negotiated with the NRC.

Response Package 2 4/23/2002 Page 3 of 27

320 SOW Section C.4.4.1.1

Hardware “Approximately 1000 Government-furnished laptop computers that are not managed by the current incumbent ISSC contractor. These Government Furnished Equipment (GFE) laptop computers are in the process of moving from non-managed to managed under the current ITI contract

1) Is it the Governments intention that the offeror should include the costs of supporting these 1,000 laptop computers into its proposal, for a total evaluated base of 5,450 desktops, 1,310 laptops and 100 high performance computing workstations?

2) Is it correct to assume these laptops will be under contract for the entire first year?

3) Where are these laptop users located?

See Q ID # 150

The NRC is in the process of attempting to centralize laptop purchase and management in order to provide better security an management of agency laptops. In the interim, the incumbent ISSC contractor is providing a service where they are patching and updating GFE laptops that exist throughout the agency. However, only a small number of GFE laptop users (150 all at headquarters) are taking advantage of this service. These laptops are not permitted to connect to the NRC ITI. The agency is looking to phase these standalone GFE laptops out. Offeors should price a mobile computing solution that would allow the NRC to address the mobile computer user class as described in section C.5.1.4.1 of the ITISS

SOW.

325 SOW Section C.5.1.4.1 Personal Computing Provide a pool of encrypted, loaner laptops configured for NRC mobile use per NRC security policies.

When the ITISS contract is awarded, it is expected that there will be 100 loaner laptops at headquarters and 80 in the Regions (mostly Region 1), with rebalancing in the Regions over time from current GFE equipment.

Please confirm that the offeror will provide the 180 initial loaner laptops and that any future additions to this base will be provided using GFE.

The Offeror is correct that they should anticipate supporting an initial loner laptop pool of 180 mobile computers. However, If the agency elects to modify the quantiy of laptops in the loner pool, the NRC intends to adjust the units that are being provided by the vendor, not as GFE equipment to the laptop loner pool.

Response Package 2 4/23/2002 Page 4 of 27

40 Service Continuity and Backup-C.5.2.2.5 IT Service Continuity (and Backup and Recovery) items No.:

7. “Perform daily backups of all file servers and application servers (for all systems)”

Are “all systems” only the 175 that are referenced in C.4.4.2.1 Hardware?

It is the expectation of the NRC that all of the "Core Tasks" will be awarded soon after contract award.

The 175 servers that are referenced in C.4.4.2.1 is a close approximation for the number of servers that support the "Core Tasks." However, the requirements that are articulated in Section C.5.2 of the ITISS SOW can also apply to other tasks in the SOW once they are awarded. So for this specific example, Offerors should be aware that this requirement also applies to C.6.1, C.6.2, C.63... and all other tasks that require backup and recovery of servers. Most of these remaining servers are likely covered in the count included in section C.4.4.3.1 of the SOW.

41 Service Continuity and Backup-C.5.2.2.5 IT Service Continuity (and Backup and Recovery) items No.:

7. “Perform daily backups of all file servers and application servers (for all systems)”

Are the servers located at the regional offices included in this, or are they backed up independently at each office?

Each Regional office performs, administers and maintains their own backups and performs their own restores. The ITISS Contractor will be responsible for this function as the incumbent ISSC Contractor is now.

The offsite storage is performed locally and managed through an independent vendor under local contract, which is outside of the scope of the ITISS contract.

42 Service Continuity and Backup-C.5.2.2.5 IT Service Continuity (and Backup and Recovery) items No.:

7. “Perform daily backups of all file servers and application servers (for all systems)”

Are any of these servers at a higher-level security classification? If so, please identify.

All of the servers managed under the "Core Tasks" and most of the servers under the remaining tasks are all handled at the same level of security, namely sensitive - which is not considered a classification.

The SLES tasks involve a specialized type of information (Safeguards) which need to be segregated from the general sensitive data that is processed on all of the other agency servers that will be managed under the ITISS contract.

Response Package 2 4/23/2002 Page 5 of 27

43 Service Continuity and Backup-C.5.2.2.5 “Provide routine removal and retention of backup media to off-site storage at a remote location other than NRC headquarters or the Regional Office”

Does this include the backup media located at the Regional Offices, or is each regional office responsible for performing this function?

Please see Q ID # 41

176 SOW Section C.5.2.2.5.2, Offeror Responsibilities, page 44.

The following statement indicates the scope for data backup encryption support: “Design and implement system backup, restore and recovery plans and procedures that include encryption of backup data.” It is unclear if the offeror will be responsible for implementing a data backup encryption solution and the implementation schedule, should it be required. Please provide clarification of the current state of data backup encryption, the financial responsibility for encryption assets, should the offeror be required to implement a data backup encryption solution, and the timeframe for implementation.

Currently, only hardware-specific backup encryption is available (via the SpectraLogic equipment) – tapes can only be read on the device that creates them.

The ITISS contractor is responsible for maintaing backup encryption.

229 SOW-C.5.2.2.5.2 Provide routine removal and retention of backup media to off-site storage at a remote location other than NRC headquarters or the Regional Office; How frequently should data be moved to an off site facility? Is the cost to be included in the fixed price or additional services from the offeror? How many containers are currently being taken off site each period. What types of tapes and how many? Which cities are these services to be provided at? Are there any locations that require this service that the offeror is not expected to staff with full time personnel?

All backup tapes are physically removed from the NRC on a weekly basis. They are stored offsite. The full backups are completed on Saturday and the tapes are pulled and sent offsite on Thursday – this gives us some time just in case we get a restore request – then we have the most current full set available. The NRC maintains 3 sets of tapes: a set getting ready to go offsite, a set in the drives ready to be created, and a set offsite. The ITISS Contractor is only responsible for offsite storage at headquarters in Rockville, MD (see Q ID # 41 for information about Regional backups). There are no locations that require this service where Offeror is not expected to staff with full time personnel.

Response Package 2 4/23/2002 Page 6 of 27

231 SOW-C.5.2.2.5.2 Provide restoration services with no significant impact to NRC

ITI or end-user performance from backup copies; Does the NRC have a separate network for backup/restore?

No, all backup are done over the main data network.

26 Capacity Management-Section C.5.2.2.3

“Quarterly, the offeror will update a capacity plan and capacity models to forecast current and future (to one year out) technical capacity needs (space, computing power, bandwidth, etc) [to include human resource capacity on the service desk and Tier 1 support]. The offeror will ensure that performance and availability targets are met, and lead the diagnosis and resolution of incidents and problems related to capacity. The offeror will recommend the most cost-effective capacity plan for the NRC. As such, the offeror shall be cautious about not providing more capacity than is appropriate for underlying NRC business requirements.” Will the government provide current Baseline Capacity Management Statistics a/o Performance Information in order to comply with this requirement?

The NRC is not seeking Offeror's to meet this requirement upon award. The intention of this requirement is that the ITISS Awardee will produce this report starting in the first quarter after they have completed transition of NRC operations. The NRC wants the ITISS Contractor to be fully immersed in and aware of the NRC environment in order to adequately develop a Capacity Management Plan.

166 Reference: SOW Section C.5.2.2.3, Capacity Management, page 42.

This section requires the offeror to forecast current and future technical capacity needs. Future capacity forecasting is usually done at the overall application environment level. Please detail the number of applications that require capacity forecasting and how many servers comprise each application.

Please see response to Q ID # 26. The NRC envisions this Capacity Management Plan as being associated with many aspects of capacity management, not limited to server capacity. The ITISS Contractor will also be responsible for assessing and forecasting network capacity, device (PC, BlackBerry, etc.)

capacity, help desk capacity, and other areas to provide input to the NRC about changes in resources that are required in order to address the demands that the ITISS Contractor perceives.

215 SOW-C.5.1.5.1 Conduct regular performance capacity testing using industry-standard automated tools; Are there GFE Tools or tools that will transfer?

No there are no capacity tools that will transfer to the ITISS Contractor. Please feel free to propose “best practice” processes with “best of breed” products and tools. The NRC seeks analysis that will allow the agency to adjust capacity to appropriately meet business requirements over time by ordering additional units of service.

Response Package 2 4/23/2002 Page 7 of 27

219 SOW-C.5.1.7.2 Conduct performance capacity testing using industry-standard automated tools. Activities shall include, but not be limited to, performing impact assessments on all new technologies introduced in the NRC IT infrastructure. The offeror shall also serve as technical experts in the area of measurement and analysis of LAN, Metropolitan Area Network (MAN), WAN, and Office Automation systems, hardware and software; Is NRC providing tools or the offerer?

Please see Q # 215

115 SOW, C.3.4 - 4 In Table 1- Current Contracts Providing ITISS Services at the NRC, it lists the contract for Data Center Systems Operation with a Start Date of FY 2010 Q2, and End Date of FY 2011 Q2.

This referenced contract has not yet been awarded as proposals were due to the GSA on 4/13/2010 to replace the existing contract that expires on June 30, 2010. Does the NRC intend to amend the effective dates in this table?

Your observation is correct but there is insufficient information to amend the table at this time.

225 SOW-C.5.2.2.5.2 IT Service Continuity Operational Management – The offeror shall execute operational activities for ITSCM including user and technician training and education, preparation of plans, periodic testing of the ITSCM recovery plans, and periodic audit and review of the plan, testing, and documented results. What is the frequency of testing? Is this a table top exercise or a physical test. What is the frequency of testing for table top exercises? What is the frequency of physcial tests? How long do the tests occur? How many servers and clients are involved in the test?

COOP tests are conducted semi-annually. All systems and components are activated, tested and verified.

Particular focus is put on issues discovered during the previous test(s) (to ensure that we have resolved the issue) and to exercise equipment, process changes or additional features added. Tabletop exercises are rare (but, sometimes required) – most COOP events exercise a “real time” COOP scenario and a full cutover and verification of services. Tests typically run 8-9 hours on a chosen “maintenance weekend” day. The following equipment is housed at our COOP site for COOP events – some of this equipment has a dual POE/COOP role:

Server – 9 Router – 2 PIX device – 1 Switch – 1 Workstation - 6

Response Package 2 4/23/2002 Page 8 of 27

226 SOW-C.5.2.2.5.2 Provide metrics on the status of testing of each service continuity plan to ensure the viability of the plans; How many plans are there? How many services are there?

The is one agency COOP plan and it provides for the following systems at a designated COOP location:

- Active Directory services

- File and Print

- Messaging (primarily email/includes Standby Continuous Replication – Blackberry services are being evaluated/considered)

- Internet Access/Security

227 SOW-C.5.2.2.5.2 Provide a testing and auditing schedule for all Services indentified in the ITSCM plan; What is the frequency for testing and auditing NRC desires?

Please see Q ID # 225

230 SOW-C.5.2.2.5.2 Prevent loss of information during all operations and maintenance activities by taking steps to protect and, at the NRC's direction, restore, as necessary, any information residing in the equipment being maintained; Historically, how many restores does the NRC conduct annually?

Over the last year, there were 620 requests for disk space restores and 8 requests for email restores.

Given that disk space is capped at 200MB (with some exceptions) and email is capped at 1GB (with some exceptions), based on these numbers the total restore requests for last year resulted in less than 10GB of actual space restored.

92 Attachment A – SOW

- C.5.1.7.5 - Test Facility

Where is the provisioning of the “best value” test facility to be priced? There is no line item for it in the Integration Pricing Template. Also, will the NRC provide space for this equipment in the Data Center or other facility?

The NRC will provide a physical location (which currently exists) for the Consolidated Test Facility (CTF). It is currently co-located with (yet physically separated from) the primary NRC Data Center. Where the pricing for the CTF is proposed will depend a little on the Offeror's solution. However, it may appear in several locations on the Pricing Schedule. There are several CLINs which should address the requirements of the CTF as it is a replicated environment of the Production ITI. The CTF consists of Network Components, Personal Computers, and Servers.

Specific aspects of the Production ITI must be replicated to provide an adequate testing environment and should be incorporated into the cost for those items (e-mail, BlackBerry).

Response Package 2 4/23/2002 Page 9 of 27

156 Reference: SOW

Section C.5.1.7.5, Test, page 37.

Offerors are required to provide a “best value” test environment that replicates the production environment so that tests can be as accurate as possible and real problems can be identified and corrected. Additional information is required for offerors to quantify the scope of this requirement in terms of the number of servers, amount and type of storage, amount of network infrastructure, etc. that make up the test environment. Are the hardware and software that comprise the test environment included in the inventory list that was provided in the RFP? Please clarify if the test environment hardware and software are included in the Inventory List and, if not included, provide detailed information about the test environment to enable offerors to identify the inventory of hardware and software required to fulfill this requirement.

The hardware and software that comprise the test environment are included in the inventory list that was provided in the RFP.

216 SOW-C.5.1.5.1 Perform impact assessments on all new network technologies introduced in the NRC ITI; Will the government continue to own the CTF hardware/software or will the offeror be responsible for the ownership, replacement and maintenance?

The NRC Consolidated Test Facility (CTF) as it exists today has a few major groupings of hardware/software.

The first grouping is the network infrastructure (firewall, switches, etc.). There are also servers that contain services which replicate the production environment (Exchange, BlackBerry Servers, etc.) The majority of this equipment is owned by the incumbent ISSC contractor. The NRC has purchased a few switches that will be made available to the ITISS Contractor.

The next grouping is the personal computers (desktops/monitors) that are used to perform testing (approximately 25). These PCs are also provided by the incumbent ISSC contractor and are on the same leases and refresh cycle as the PCs provided to general NRC users.

The final grouping of hardware/software is

Response Package 2 4/23/2002 Page 10 of 27 associated with the services being tested with the intention of putting them in production. This could be services that are provided by the incumbent ISSC contractor, other Office of Information Services contractors, or staff and contractors from other NRC offices. In the current environment, these "service providers" might bring hardware with them to the CTF to test their solution, with the intent that the same hardware would move into the production environment once they have been properly security hardened and tested.

It is the NRC's ultimate goal that the ITISS contractor will acquire, provision, and maintain all of the hardware in the CTF. In addition, the NRC would like any new or changed services that are being introduced, to be supported by standard hardware solutions that exist in the NRC data center. A "service provider" would bring their software to the CTF and would be provisioned a requested amount of hardware resources to test and harden their solution.

Once the testing phase has been passed, they will then be provisioned an appropriate amount of computing power in the production data center to achieve the service levels that they have defined for their solution.

189 RFP SOW, Appendix A (QASP), Paragraph A.3 Unacceptable Performance, page 137.

This paragraph, in part, states that “At the end of every contract quarter, the NRC Contract Officer (CO) and NRC Project Officer (PO) will meet to evaluate the documented SLR deficiencies for that quarter and assess appropriate damages for each deficiency.” However, there is no guidance as to what defines “appropriate damages.” Please clarify how the Government will determine “appropriate damages” and provide an example of such damages. Also, will the Government allow offerors to propose process for managing the disincentives, such as defined disincentive fees for each

Please see Q ID 194 that was released on 4/20/2010 along with a Disincentive Model to be considered as an entry point for negations with the ITISS Awardee.

Response Package 2 4/23/2002 Page 11 of 27

SLR?

55 SOW What is the average growth of email over the last few years? As stated earlier, our users are capped at 200MB for file space (with some exceptions) and 1GB for email (with some exceptions). The only growth was an increase in the email cap from 500MB to 1GB after the implementation of the SANs.

212 SOW-C.5.1.2 Perform nightly E-mail back-ups and maintain them in accordance with NRC retention requirements; What are the retention requirements?

Email and file retention is 2 weeks. Files dated beyond that are “best effort”.

213 SOW-C.5.1.2 Restore email from back-up as requested; How long must the email be accessible? How long must backups be kept and available to the user?

Please see Q ID # 212

Response Package 2 4/23/2002 Page 12 of 27

282 SOW-C.5.1.2 Other Questions not specifically in the requirements: Is

Exchange using a "resource" forest? Is there any migration required? What is the administrative model in place? Is Journaling required? Is there an archiving solution in place?

EMC?

NRC's Exchange 2007 environment does not use a Resource Forest. The NRC Active Directory environment is set up as a single Domain, single Forest architecture which spans our Headquarters location as well as our 5 Regional/Satellite Offices.

Each Regional/Satellite Office is configured as an individual Active Directory site with its own domain controller and each site has Exchange servers on site as well.

Administration and support of the Exchange 2007 environment is done centrally by our Network Operations Center (NOC). Regional LAN Administrators have rights to administer Exchange users in their respective regional offices, but the bulk of the Exchange administration is done in our headquarters location by the NOC.

Currently Journaling is not performed at NRC and is not required in our current configuration.

There is currently no centralized archiving solution in place. Individual users are creating local outlook archives on their workstations.

323 SOW Section C.5.1.2 Electronic Mail (Email) and Messaging Item # 11.

Perform nightly E-mail back-ups and maintain them in accordance with NRC retention requirements;

What are the NRC’s E-mail retention requirements? Please see Q ID # 212

Response Package 2 4/23/2002 Page 13 of 27

279 SOW-C.6.8.3 The offeror shall maintain and update the ERDS user interface software including the operability of the software which provides the capability to display ERDS data in the NRC Operations Center, located in Rockville MD., as well as at the Regional Emergency Response Centers, at site team locations (nuclear power plant sites), and other locations (State Government emergency response facilities, Regional Offices located in King of Prussia, PA, Atlanta, GA, Lisle, IL, Arlington, TX, and the Technical Training Center in Chattanooga, TN) in accordance with the design specifications contained in the references listed in the Reference Materials section of this statement. How many FTEs support this function today? Is on site support required? Full time? How many hours Remote VS

HQ?

The word "update" is used here to describe the action of patching and updating computers with new releases of software that are provided by a vendor outside of the scope of ITISS. The NRC is not requesting that the ITISS contractor perform development work of this software. However, this activity involves active participation of contractor staff to evaluate and test software updates to ensure that they do not disrupt the production environment.

This activity will be performed under the advisement of NRC staff. This role is not a full-time responsibility but part of the system administration responsibilities of maintaining the ERDS servers. This will require on-site support, primarily at NRC headquarters in Rockville, MD.

224 SOW-C.5.1.8 Provide end user support by responding to requests concerning the system software, hardware, network, and information security of the high performance computing zones and data center; What is the current number of tickets generated for this environment? What is the average length of a call?

Requests for these services generally do not appear as help desk tickets. For the existing ISSC contract and as proposed for the ITISS Contract, this service is provided as a labor hour effort. Dedicated Contractor staff should be made available to agency high performance computer users to respond to their support requests, separate from the general personal computing user community. The Price Schedule contains an estimated number of hours under High Performance Computing that the NRC believes will adequately address the requests that are generated for this requirement.

Response Package 2 4/23/2002 Page 14 of 27

56 SOW Is there currently a specific standard for IM? We currently have no production implementation of

IM in-place. The NRC is currently piloting Microsoft Office Communications Server 2007 R2 (OCS) in our production environment to provide Instant Messaging (IM), Virtual Meeting (VM), and Presence management (PM) functionality for our users. The current pilot of OCS is limited to a small group of people within the agency, but there is a lot of interest in other areas of the agency to take advantage of the technology as well. The Agency is also evaluating hosted OCS services with Microsoft in the cloud as a possible alternative to hosting the system on-premise.

294 RFP Section C.1.b.4 SOW Section C.4.4.1.1 Hardware SOW Section C.4.4.3.1 Hardware RFP requires “A technical description of the items being offered in sufficient detail to evaluate compliance with the requirements in the solicitation”.

Offeror is unable to locate any specific hardware requirements for the Personal computing or Server hardware. To allow for a fair comparison of solutions, please provide the minimum technical requirements offerors computing hardware solutions must provide and how exceeding those requirements will be evaluated and scored.

Offerors are encouraged to propose solutions that combine ease of management with flexibility to support different NRC user classes and application classes over time. The NRC is seeking a "Personal Computing Service" and a "Hosting Service" approach, not simply a technical solution based on the current inventory. The NRC would encourage offerors to propose solution to providing Personal Computing Services and Hosting Services based on their experience and the environmental data provided.

28 Network Management- C.5.1.5.1 Network Management and C.6.6.1 and Attachment A – 2009 NRC IT Roadmap “Provide protocol management, proxy service, and Public

When support of PKI is referred to in the SOW, does it refer to an NRC managed PKI or is this managed by an outside organization such as VeriSign? What is the scope of support referred to in SOW for PKI and does NRC manage or plan on managing its own Certificate Authority (CA)?

The Certificate Authority (CA) at the NRC is managed/operated by VeriSign located in Mountain View, California. The NRC has certificate management authority for the provisioning and revocation of client/server certificates. The NRC makes use of VeriSign client and server digital certificates for a majority of our certificate requirements.

The Safeguards LAN and Electronic Safe solution

Response Package 2 4/23/2002 Page 15 of 27

Key Infrastructure (PKI) management;”

(Additional Task) is currently using an on-site Microsoft CA to issue approximately 200 client certificates.

183 SOW Section C.5.2.2.6.2, Offeror Responsibilities, page 53.

The SOW states: “The offeror shall adhere to the guidance outlined in NIST SP 800-53, FIPS 200 and NRC guidance for the identification and documentation of minimum security controls.” Is the offeror to implement a security training and awareness program just for its staff or is NRC requiring that the offeror implement a security training program for all NRC employees and contractors?

The offeror must provide security training for their staff, not all NRC employees and contractors.

Basic security training and awareness training will be provided by the NRC to all contractor staff who are badged at IT Level I and IT Level II (most of awardee's staff). This training is mandatory. This is the training referred to in the SOW, Section C.5.2.2.6.2, Item 10 (Page 47). Item 11, on the same page requires that the Offeror provide additional training for specific security responsibilities for their system administrators.

There is general language on page 56 of the SOW that requires all NRC contractors to provide training to thier staff in the area of IT security, with specialized training provided to anyone who has specialized data which increases vulnerability to the

NRC.

186 SOW Section C.5.2.2.6.2, Offeror Responsibilities, page 49.

The SOW states: “Develop and maintain strong two-factor authentication….” What two-factor systems are currently in place and what systems do they provide service to?

Please see Q ID # 248

Response Package 2 4/23/2002 Page 16 of 27

248 SOW-C.5.2.2.6.2 Develop and maintain strong two-factor authentication for management and administrator access of NRC systems. Least privilege for these accounts are to be provided such that these individuals have a user and a management / administrative account with the higher privileged account used only for management and or administrative functions with all privileged access logged and reviewed by the NRC security officials and make these reports available when requested by the NRC; What does NRC/Incumbant have that offerer can/will inherit to fulfill this requirement? Will the tools be government furnished or provided by the offeror?

The NRC is currently developing a Personal Identity Verification (PIV) workstation authentication solution for network login to support Homeland Security Presidential Directive (HSPD-12). Currently the NRC expects to have logical access through this solution in production around the same time as ITISS contract award. NRC is supplying the PIV cards and the certificates. We would expect the contractor to continue supporting this PIV solution. The NRC is also investigating various Identity & Access Management solutions to further enhance security and various other business requirements using the PIV card.

249 SOW-C.5.2.2.6.2 Identify and prevent any non-ITI devices (including computers, USB drive, peripherals, etc.) attempting to attach to the ITI;

What does NRC/Incumbant have that offerer can/will inherit to fulfill this requirement? Will the tools be government furnished or provided by the offeror?

Please see Q ID # 248

250 SOW-C.5.2.2.6.6 The offeror shall ensure that its employees, in performance of the contract, receive Information Technology (IT) security training in their role at the offeror’s expense. Please provide examples of the information security training that you are making reference to here. For example, security plus+.

See Q ID # 183

251 SOW-C.5.2.2.6.7 The system shall be able to create, maintain and protect from modification or unauthorized access or destruction an audit trail of accesses to the objects it protects. The audit data shall be protected so that read access to it is limited to those who are authorized. What system is this requirement referring to?

The requirement that is quoted here is from a general requirement that is standard in all information technology acquisitions. In the case of the ITISS contract, this requirement would apply to all systems and tools that are provided by the Offeror to address ITISS requirements. The intent of this requirement is to allow appropriate IT security oversight by the NRC's Computer Security Office as well as the Inspector General or other Federal authorities.

Response Package 2 4/23/2002 Page 17 of 27

258 SOW-C.6.2.1 Make routine and ad hoc preventive and correct changes to the

OCIMS databases as requested or approved by the NRC Project Officer; Technical or data changes? What is the anticipated frequency of change?

The changes that are required to OCIMS databases (Microsoft SQL Server with a Microsoft Access interface) are infrequent (a few times per year). The requirement is for modification of the database structure as needed to accommodate changes in the information that is being collected and stored.

45 IT Security Monitoring-5b) Section “IT Security Monitoring” item No.

10. “Develop and maintain strong two-factor authentication for management and administrator access of NRC systems.”

Does NRC have an existing strong two-factor authentication that the government will provide?

The NRC is currently developing a Personal Identity Verification (PIV) workstation authentication solution for network login to support Homeland Security Presidential Directive (HSPD-12). Currently the NRC expects to have logical access through this solution in production around the same time as ITISS contract award. We would expect the contractor to continue supporting this PIV solution. The NRC is also investigating various Identity & Access Management solutions to further enhance security and various other business requirements using the PIV card.

46 Attaching to the ITI-

11. “Identify and prevent any non-ITI devices (including computers, USB drive, peripherals, etc.)

attempting to attach to the ITI.”

Comment – As worded, this is an all inclusive requirement that will have a significant impact across all of NRC for several reasons such as:

• Not all ITI devices will fall under the control of this contract so including them in a list of “approved” devices is not assured and maintaining an accurate, authoritative listing will be problematic

• It will significantly impact NRC’s “Work Anywhere” objective in that it will severely curtail the use of “home-office” resources (e.g. printers, networks).

Question – Will the NRC further detail the requirement or consider constraining the requirement such as making it a desirable, best effort undertaking or a future goal?

The current NRC NAC solution is provided by the incumbent ISSC Contractor. The NRC NAC interrogates every network-attached device and associated peripheral prior to being permitting to access to the production network. The network-attached device must comply with a minimum set of standards, including anti-virus protection, operating system/application security patches and a pre-determined configuration prior to access. If the computer does not comply with the minimum set of standards, the NAC will perform an automatic remediation to update/patch the computer or isolate the computer from the production network depending on the severity of the non-compliance.

The proposed brand/model must meet the defined NAC business requirements and meet the defined contract SLA’s. The ITISS Contractor will be able to transfer the existing solution from the incumbent ISSC contractor. However, whether the Offeror

Response Package 2 4/23/2002 Page 18 of 27 transitions the existings solution or proposes a different solution, the Offeror must furnish the solution.

31 Cost Proposal -E.14 & Pricing Template

For T&M CLINS, can bidders propose less or more hours than those given in the pricing template?

Yes.

32 Cost Proposal-Pricing Template

In order to allow for an equitable evaluation of costs, will the Government specify where the Offeror should reflect non-labor (e.g. tools software) costs in the pricing template?

Tool costs should be included in the unit price that the tool is supporting.

34 Cost Proposal-Pricing Template

Where does the Government want the Offeror to price the effort for SOW C.5.2 Service Delivery and Management?

These costs should be spread over the other cost line items. The NRC is anticipating high quality Service Management in all efforts performed by the offeror;

Section C.5.2 is meant to describe such high quality Service Management and to delineate roles and responsibilities of the NRC and of the ITISS vendor.

77 Price Schedule Template - C.7.1 - Pricing

For Initial Transition pricing, the template specifies a per-unit price per year, and lists the unit of measure as hours. Please confirm that the price to be entered by offerors is the hourly labor rate, not a labor rate for a year. This applies to all items in the templates for which the unit of measure is hours.

Offerors are requested to enter an hourly labor rate in the column labeled per-unit price per year for all labor hour CLINs. The estimated number of hours provided is the estimate for a year-period. In the case of Transition, it is expected that the actual period of performance will be significantly less than a full year.

Response Package 2 4/23/2002 Page 19 of 27

89 Attachment A – SOW

- C.5.2 Service Delivery & Management - BOE

Will a new pricing template line item be added to Attachment E for SOW C.5.2 or should these costs be spread over other cost line items?

Please see Q ID # 34

121 Price Schedule Templates - A-4

If the government expects Contractor to staff for example, the Development Facilities Center full time, the 1000 productive hours allocated for the Test Engineer & Security Analyst out of approximately 1920 hours available per year may not be sufficient, unless the government prefers part-time consultants to be available on an as-needed basis. In general, is there flexibility for the contractor to bid sufficient hours within the POP needed to cover each task?

Yes.

122 Attachment D - All The pricing of FFP tasks is to be based on the stated number of units of measure. Given that these are estimates and the actual numbers may vary over the life of the contract, what window of variance, i.e. + or - 5%, will the Government provide, such that if the actual units of measure varies significantly from the basis of estimate, the Contractor is permitted to adjust its price accordingly?

It is expected that the Offeror's price per unit will be constant for each year of the contract. However, the units that are provided in the Price Schedule are reasonable estimates for the number of units. The actual number of units will vary periodically as negotiated with billing.

283 SOW-5.1.4.1 In addition, The incumbent ISSC contractor currently provisions and maintains an inventory of encrypted MXI Stealth MXP Universal Serial Bus (USB) drives to users to transfer files from one personal computing device to another, including foreign devices. These drives are currently being procured by the NRC through a separate contract. The offeror shall include a proposal to acquire and provide these drives or ones with similar specifications. Is the offeror to include the cost of these drives in the personal computer price? If so, how many should be provided. If not, where should the costs be provided?

A new CLIN has been provided in the Pricing Schedule in the Personal Computing tab.

327 SOW C.5.1.5.1

Network Management “Provide and maintain external access to NRC resources and

What is meant by public access to NRC resources, does this consist of access to NRC web pages, 800 access to NRC information etc.?

The referenced statement is referring to the agency's public Web presence. Although the actual Web service is managed by a different business unit, the ITISS Contractor is responsible for the network connectivity to ensure that those Web servers can be visible through the Internet to the outside world.

Response Package 2 4/23/2002 Page 20 of 27 information for the public and other interested parties

220 SOW-C.5.1.7.3 Develop Network Operating System (NOS), applications, and utilities as required; Please provide examples of what is being requested. Is the intended scope to create scripts to automate monitoring and deployment of applications or is it broader. If broader, please define.

This statement should not be misunderstood that application development is a requirement of this task

– it is not. However, some scripting and development skills are required to maintain alert, monitoring and deployment systems. And, login scripts are in heavy use and demand throughout the agency – the contractor must be able to support systems, components and current capabilities within our production, test and development environments.

29 Hardware Specifications- C.4.4.2.1

Are there any Sensitive Data Requirements within the scope of this contract?

A large amount of data that is stored on NRC servers, transverses the NRC network, and is manipulated on personal and mobile computing devices is considered sensitive. Agency financial, acquisition, security, pre-decisional, and other data must be protected kept confidential and unalterable from anyone who is not authorized access to it. In addition, for the two SLES tasks, segregated handling is required for Safeguards information which is a special type of sensitive data.

30 Hardware Specifications- C.4.4.2.1

Are there any print servers that will print sensitive documents?

Is so, please delineate between core and optional as well as how many servers function in this role?

In our Production Operations Environment (POE), we do not have any print servers that print information that is of different sensitivity than the standard sensitivity of all data on the network. In other words there is no delineation based on sensitivity of documents. There is absolutely no classified information on the NRC ITI.

Response Package 2 4/23/2002 Page 21 of 27

157 Reference: SOW

Section C.5.2.4.1, The Service Desk Function, pages 63- 65.

In order to appropriately staff the service desk, statistical information is required regarding the current service desk operations at the various locations/facilities where services are considered in scope. Please provide average call volumes, average talk time, and a breakout of phone versus email contacts per location where service desk services are provided and are in scope for the offeror. Ideally, a call distribution report for the previous 6 to 12 months would also be provided.

Please See Q ID # 23

23 SLA’s, SLR’s-Section C Attachment A

Will the government release relevant statistics such as ACD Data, call volume, monthly ticket count, service requests, etc., by grouping/team/function in order to adequately size the Service Desk?

Call Volume Average = 4600 per month.

Average length (Agent time on phone) = 5min 30 sec E-mail Request Average = 550 per month Ticket Count Average = 6000 per month

Please also see the newly released document "RFP- 33-11-325 - NRC ISSC Current Service Desk Statistics.pdf". The statistics in that document are all for the period of March 1 to March 31, 2010.

53 Attachment A, SOW C.5.2.4.1, Service Desk Function:

Attachment A Statement of Work states the current service desk operation includes multiple service desks at headquarters, as well as local help desks within the regions. To plan and size for a consolidated service desk can you provide the following:

1. average number of help desk tickets per month over all service desk operations

2. average handle time of calls into the help desk

3. call patterns by time of day and day of week of calls into the help desk

4. the top 10 categories of ticket types for the help desk

Please See Q ID # 23

272 SOW-C.6.6.4 The offeror is required to upgrade/refresh system hardware and software to ensure appropriate maintainability and IT security controls. Hardware and software should not be allowed to become unsupported or insecure. What is the refresh cycle required?

Hardware for the SLES task should be priced on a three-year refresh cycle. Most of the equipment under this task is currently GFE and was purchased in the last half of calendar year 2009.

Response Package 2 4/23/2002 Page 22 of 27

339 SOW Appendix A.4 -

Service Level Requirements Performance Target for Standard, VIP 1, VIP 2.

The performance target is listed as “Business Days” and “Business Hours”. The SOW section C.4.3 NRC Business Hours identifies the normal working hours are from 6am – 9pm Eastern Standard Time/Eastern Daylight Time (EST) Monday thru Friday excluding Federal Holidays. Does the government agree that a business day is 15 hours and the service measurement starts during the business day and stops at the end of the business day and if necessary re-starts when the next business day begins?

Tthe SLRs that refer to business hours apply to all incidents that are discovered and reported during business hours. The assumption proposed by the Offeror's question is correct: If an incident or request is reported towards the end of business hours, the SLR measure allows for the response to be carried into the next business day.

267 SOW-C.6.5.6 Usage Reporting and Auditing How is this different from C.5.1.4.3? Is the government IV & V with a separate auditor or is the offeror responsible for hiring the IV & V contractor?

The difference between C.5.1.4.3 and C.6.5.6 is that the former applies only to management of Offeror-supplied software and the latter applies to all software installed at the NRC. The NRC is responsible for contracting with an IV&V contractor, not the ITISS Contractor.

335 SOW Section C.6.5.5 Software Catalog “The offeror will provide, as a part of the Software Catalog, an automated mechanism for users to order software for their use.”

Please confirm the following assumptions

1) That software is strictly for NRC official use

2) Software purchases will be done using Government standard Purchase Orders

That software is strictly for NRC official use, and software purchases will be done by the government for that software not provided by the offeror as part of this contract.

336 SOW Section C.6.5.5 Software Catalog “The offeror will work with Agency program and support offices and will integrate their approval workflows into the software ordering process.”

Please confirm that the requirements analysis, systems design and application customization and implementation services and other costs required to perform this workflow integration is to be priced under a separate T&M task order to be issued post award, and should not be included in the original bid.

That is not correct. Those efforts should be included in the original bid.

Response Package 2 4/23/2002 Page 23 of 27

337 SOW Section C.6.5.5

Software Catalog “The offeror will interface with Agency financial management tools to track the funding available for software purchases and the purchase of software licenses.”

Please confirm that the requirements analysis, systems design and application customization and implementation services and other costs required to perform this Financial management and funding approval integration is to be priced…