RFP-33-11-325 USNRC ITISS Responses Package 3 to Vendor Questions.pdf

U.S. Nuclear Regulatory Commission Responses to Questions Information Technology Infrastructure and Support Services (RFP-33-11-325)

Response Package 3 4/27/2010 Page 1 of 21

ID RFP Reference Question Response 270 SOW-C.6.6.2 Monitoring the performance of all SLES back-end servers and other equipment, systems programming and configuration management, database administration, security hardening, building of new servers, hardware/software configuration, system backup and restore, system review and making recommendations for performance enhancement are included under this task. Provide hardware inventory by location.

All of the server hardware that is contained in the inventory provided with the ITISS RFP is located at NRC headquarters.

Approximately 12 additional servers similar in model will be purchased in the near future (before transition to the ITISS contract) to support continuity of operations (COOP). These servers will be located at the agency's COOP site which is co-located with one of the agency's Regional Offices.

314 RFP Attachment F NRC ITISS Inventory List File and Print Tab Multiple “Printer” related items with descriptions such as “Network Printers GFE” and “Network Printers – Color”

To allow offerors to accurately price the support and consumable costs of NRC printers, please provide the specific models, ages, locations and location quantity of each printer Offeror is expected to support. Also please provide any information on existing maintenance contracts.

The NRC is not asking vendors to provide consumables for any existing NRC printers only new models for a period of time until these consumables can be provided through a separate contract vehicle. This requirement is explained in SOW section C.5.1.3.2 "Print Management", Page 23, in the last paragraph of that section.

317 RFP Attachment F NRC ITISS Inventory List File and Print Tab Multiple “Server” related items with descriptions such as “General Purpose Enterprise Servers (File and Application Servers)” and

Please confirm these servers are GFE and offeror is expected to support them. Please provide details on the location of each server, its operating system and all licenses and maintenance contracts associated with each.

The servers referenced by the Offeror are provided by the ISSC incumbent Contractor and are not GFE. All GFE items in the inventory are labeled as such.

218 SOW-C.5.1.5.4 Synchronize client files on remote servers and the failover system; Please provide the source and destination location for the client files and the failover system. Is it all client files or a select set? If a select set, what is the approximate size of the select set?

The total volume of files replicated between NRC headquarters in Rockville, MD and our COOP site (co-located with one of the NRC Regional offices) is 530GB. This represents 22% of the total available space at the COOP site for replicated data – total storage available is 2.5 TB. Our replicated data is transferred at a low rate of .8 MB p/second to a high rate of 3 MB p/second – the average rate is 1.66 MB p/second.

Response Package 3 4/27/2010 Page 2 of 21

158 Reference: SOW Section C.6.1, Computer Facilities Management, page 75. It is unclear who is responsible for buying data center consumables such as data backup tapes, printer ribbons and stock, etc. Please clarify whether the NRC or the offeror is financially responsible for replacing data center consumables. If it is the offeror’s responsibility, please provide usage details so offerors can price these consumables.

Consumables are monitored by the contractor, and when supplies are projected to dip below critical threshold, notification is made to the appropriate NRC staff. The NRC is financially responsible for replacing these consumables, not the Offeror.

164 Reference: SOW Section C.6.3.2.2, Database Support, pages 82 - 83.

A) What are the total number and types of databases that will be supported under the ITISS contract? Please provide a list of the type and number of databases currently supported in NRC’s environment. B) Please clarify whether NRC expects different levels of DBA support (e.g., SLAs, backup requirements, etc.) for production versus development, versus test, versus QA environments. If different levels of support are required for the different environments, then offerors would need to understand the number of production, development, test, and QA environments.

Please identify the number of databases in each environment and the level of support expected for each environment.

There are currently two database management systems in use.

The two database management systems in use today are Microsoft SQL Server and Sybase. There are 35 MS SQL instances with 311 databases that range in size from 2MB to 93GB. In addition, there are 2 Sybase databases.

Although databases maintained in the test environment should be maintained at a reduced service level, customer pressures often require management and reporting that is equivalent to production. Database management and other items such as load balancer configuration and setup have become hot issues, essentially demanding production level support and response for a system still in development and testing.

Response Package 3 4/27/2010 Page 3 of 21

168 Reference: SOW Section C.6.3.3.1, Application Support, page 85.

It is not clear as to the scope of support sought under this heading and by this statement: “The offeror shall respond to user inquiries on technical matters such as: resolving programming anomalies, access to and use of equipment, systems software, and support for vendor or third-party proprietary software.”

Please clarify whether support is being sought for the NRC applications and their code structures themselves, or only for the mainframe equipment, operating systems, and 3rd party installed software as they exist to support NRC applications.

The intended requirement is that the ITISS Contractor shall provide limited support to COTS products that run on the NIH mainframe. The following is a more list of expectations in this area that are more detailed than in the RFP:

The contractor shall respond to user inquiries on technical matters and resolve issues with any scripting or programming anomalies, problems accessing systems on the NIH campus, and problems with the use of equipment. The contractor shall work with the telecommunications staff to facilitate communication setup, identify the appropriate problem resolution, and rectify problems with communication setup.

The contractor shall assist the NIH account sponsor with the following duties:

• run the monthly timesharing cost and cost allocation reports.

• monitor user and application resource usage.

• update the NRC’s internal Web site for its NIH users.

• maintain the NRC’s NIH access database application for downloading and distributing NIH mainframe cost reports to its users.

The contractor shall support agency IP print services using AnyQueue print management software and shall write and maintain scripts to assist with print distribution and redirection.

The contractor shall support file transfers to other agencies using various file transfer protocols (FTP and secure FTP).

Response Package 3 4/27/2010 Page 4 of 21

173 Reference: SOW Section C.6.1.4, Backup and Recovery, page 76.

The RFP states the provider shall “Replace backup information for HRMS as needed and notify HRMS systems staff regarding problems.” It is unclear what specific actions, processes, or infrastructure might be required to satisfy this requirement. Please clarify the statement “Replace backup information.”

First, the wording in the SOW was in error and the word "Restore" should be used in place of "Replace" in this requirement.

This is an infrequent requirement. The NRC estimates no more often than once annually (providing a restore due to a failure is a different issue). One example for this requirement might be as a result of an audit of time cards. This would require restoring a database to a test server, perhaps from a year prior for an auditor to review perhaps a dozen or two employees time records.

175 Reference: SOW Section C.6.3, Data Center System Administration; C.6.3.3, Mainframe Administration;

C.6.3.3.3, Backup and Recovery, pages 85 – 87.

The following statements indicate the scope for mainframe support: “Allocate disk space for system file, users, and databases and their associated tables.” “The offeror shall design and implement system backup and restore procedures to ensure that the NRC systems are maintained with complete backup and have the ability to be restored.” The SOW does not provide the size, scope, or location of the involved systems. Please provide a configuration outline that clarifies the operating status of the NRC components, indicating the locations, the make, model(s), and quantity of the involved mainframe hardware and also indicating whether the NRC workload exists in separate LPAR(s), machines, or is somehow intermingled with these other agencies’ workloads.

Please refer to Q ID # 168

255 SOW-C.6.1.4 Replace backup information for HRMS as needed and notify HRMS systems staff regarding problems; What is the frequency of this process? How often is there a failure?

Please refer to Q ID # 173

Response Package 3 4/27/2010 Page 5 of 21

153 Reference: SOW Section C.5.1.2, Electronic Mail (Email) and Messaging, page 20.

SOW Section C.5.1.2 states: “The offeror shall provide upgrades to Outlook and Exchange (e.g. Exchange 2010) as these products become available and when they are approved by the NRC. The offeror shall ensure that no additional cost is incurred by the NRC for upgrades providing comparable services.

When NRC determines that it is appropriate to upgrade to a newer version of the software, the offeror will manage a complete upgrade of not only the software, but migration of individual user data.” Services required to plan and execute upgrades to the messaging infrastructure and the level of effort to perform user data migrations represents a vast range of complexities and resource requirements. Please provide a more defined scope for this requirement in order to ensure the costs provided by all offerors to perform these tasks are fairly assessed.

The focus of this requirement is on the software licensing. It is expected that all upgrades to new versions of existing software provided by the Offeror will be provided in the established pricing. For example, the NRC expects the fixed unit for personal computing to stay the same when the MS Outlook or MS Office software is upgraded to a newer version.

It is also expected that data migration (if appropriate) will also be included in the fixed cost. The agency wants to be clear that the ITISS Contractor will migrate data when it is appropriate, not just upgrade the software with no data.

The NRC is not requesting as a part of this requirement to change software platforms and migrate data.

4 As Is Environment - Section C.3.4 Section C.3.4 indicates that the NRC is open to new solutions that would provide greater efficiencies and service. Without additional configuration detail, existing contractors will have an substantial advantage in regard to creating an accurate “as is” description of the NRC as well as a feasible "to be" environment.

Can the NRC provide detailed information regarding the server, network and storage platforms only described at a high level in the inventory list?

The Offeror is misinterpreting what the NRC intends by this openness to new solutions. The statement means to convey that Offerors should not feel limited by the "as is" environment as they are constructing their proposals. The information provided about what is currently in place is intended only to direct the Offerors in planning a potential migration plan. An Offeror should focus on how they can address the requirements of the SOW, not how they can address it the same way it is being addressed currently.

Response Package 3 4/27/2010 Page 6 of 21

199 RFP Reference: SOW

C.5.2.4.1 The Service Desk Function

“The offeror shall report all verified or suspected computer security and/or unauthorized PII release incidents immediately to the NRC CSIRT.” Are suspected security and PII incidents be reported to the NRC CSIRT through automatic escalation of the Service Desk incident ticket? If not, what tool is used to escalate/report security and PII incidents to the CSIRT?

All incidents (security or non-security) are logged in the help desk ticketing system. Security related incidents are moved into a Security queue within the ticketing system. This security incident response process in not fully automated at present.

211 SOW-C.5.1.2 4. Monitor mail statistics such as inbound and outbound mail flow; Are the reports currently available from IronPort sufficient? Do they provide the level of increment detail needed?

The reports currently available from IronPort address the NRC's requirements.

179 SOW Section C.5.2.2.6.2, Offeror Responsibilities, page 58.

The SOW states that the offeror shall prepare the POA&M based on STE results. Is there an existing POA&M tracking solution? If so, will that solution transfer as a result of this award?

The NRC is in the process of configuring and installing a POA&M tracking solution for the enterprise. Currently, POA&Ms associated with the systems that will be maintained by the ITISS awardee are manually tracked with a local database. In either case, these tools are NRC tools and will be available to the ITISS Contractor.

182 General If the latest FISMA and OMB A-123 audits are available, please provide a copy, if possible.

These audit reports are not available for distribution in the ITISS acquisition forum.

185 SOW Section C.5.2.2.6.2, Offeror Responsibilities, page 47.

The SOW states: “Perform account management functions for all infrastructure systems that require user accounts….” How many and what types of centralized authentication systems are in place (i.e., AD, LDAP, TACAS) and how many systems operate without centralized authentication?

All systems that are being referred to in this section operate with centralized authentication through Microsoft Active Directory (AD). There are other applications that run on these systems that do not currently use AD for authentication, but their account management function is not in the scope of ITISS.

260 SOW-C.6.2.1 The offeror shall implement system backup and restore procedures to ensure that OCIMS is maintained with complete backup and have the ability to be restored. How much data?

The current total of data that is currently being backed up in support of OCIMS if approximately 500 MB.

Response Package 3 4/27/2010 Page 7 of 21

44 Information Security

Management-C.5.2.2.6 Information Security Management 5.a.) Section “Network Security Center Management”

This implies the creation of a security operations capability (SOC) that will serve as the Tier 1 (i.e. detect, correlate, interpret, and report) of a CIRC (computer incident response capability).

Question – Is this a correct interpretation of the government’s intent? If so, then what will be its hours of operation – will it need 24x7x365 staffing?

The NRC believes that this is an accurate interpretation of the government's intent. Currently, the on-site operations is from 7:00 AM - 7:00 PM EST Monday through Friday. During the time outside of the operating hours listed above, automated alerts are used to notify on-call SOC staff of security events that require further investigation.

169 Reference: SOW Section C.5.1.4.1, Personal Computing, pages 24- 26.

This section states: “The offeror shall provide separate headquarters and regional pricing for each of the recommended personal computing solutions for each year of the contract.” Please provide a breakout of the number of work tickets on a monthly basis for each NRC location.

The reason for this pricing breakout is to discriminate between help desk that is provided at NRC headquarters exclusively to headquarters users vs. the Regions where no help desk support is provided by the ITISS Contractor for personal computing.

Information about support tickets was provided in the response to Q ID # 23 in responses provided on 4/23/2010.

201 C.5.2.4.4.2 Offeror Responsibilities and C.5.2.3.5.1 NRC Responsibilities

“The offeror shall establish a Known Error Database (KEDB)…” “The NRC is responsible for furnishing existing knowledge to the offeror in bulk at the beginning of the contract and as requested thereafter.” Does the incumbent ISSC contractor have a Service Desk / Problem Management KEDB? If yes, is the transfer of the contents of that KEDB covered by the statement in C.5.2.3.5.1 that NRC will furnish existing knowledge to the offeror”? Is there a cost associated with obtaining the current KEDB that vendors need to reflect in their ITISS Price Schedule?

There is some basic information related to a known error database that is available to the NRC and can be provided to the successful ITISS awardee. There will be no cost to the ITISS awardee. However, the NRC does not see this data as a true Known Error Database and seeks ITISS Offerors to propose "establish"-ing this tool, because it is not at the maturity level that the NRC would like to have.

269 SOW-C.6.6.1 Attachment A: Statement of Work - General What is the anticipated call volume? Average length of call? Estimated level of effort?

Number and location of servers?

In support of the Safeguards LAN, for the last several months, this help desk has been receiving 40-50 calls per month. The average call length is approximately 30 minutes. For the location of servers, please see Q ID # 270.

Response Package 3 4/27/2010 Page 8 of 21

271 SOW-C.6.6.3.2 Helpdesk Support Can this be the same help desk for section 5? Where are they? Who owns the hardware, government or the offeror? How many of them are there? What is the historical call volume? Average length of call? OS for workstation?

Currently, this help desk is being managed under a separate contract from ISSC. It is desirable for the NRC to have users have a common Service Desk for these services. However, the Offeror should keep in mind that the Safeguards LAN does require special data handling which must remain separate from the main NRC network.

Currently, both the main help desk, and the Safeguards LAN helpdesk are maintained at NRC headquarters in Rockville, MD.

The NRC currently owns all of the Safeguards LAN hardware. For additional information about the Safeguards LAN hardware and helpdesk, please see Q ID # 269 and Q ID # 270.

276 SOW-C.6.6.4.2 The offeror assures that system backup tapes and other media not being used are stored outside of the server room and rotated on a regular basis. Specific procedures to be followed by the offeror for the handling, storage and the rotation of the backup tapes and media are outlined in the Operation Manual. How much data? How many tapes?

Can we use the same service provider and rotation cycle used for all of the other systems?

The Safeguards LAN data is currently being backed up to disk, the Electronic Safe data is being backed up to tape. The total volume of data being backed-up (primarily Electronic Safe) is approximately 500 GB.

The NRC has no objection to an Offeror using the same service provider or rotation cycle as for other backups. However, the data must be segregated from the other data given its Safeguards classification.

141 SOW Appendix A.4 Service Level Requirements

There are Service Level Requirements associated with the Labor Hour contract components. This is inconsistent with a Labor Hour contract type where the only true deliverables are the hours. Offeror recommends removing the SLRs for the following Labor Hour components of the SOW:

1. C.5.1.7 Integration

2. C.5.1.8 High Performance Computing

3. C.6.5 Software Licence Management

4. C.6.8 ERDS Operations and Maintenance

The NRC believes that compensation for a time and materials task should in part be associated with the completion of the task as it was estimated and agreed to by the offeror. This includes deviations from the agreed upon schedule, quality of the deliverables, and measures that are specific to the task. The ITISS contractor's inability to meet these SLRs would be reflected in the disincentive as proposed in the ITISS SOW.

The NRC will not remove the SLRs for the suggested components of the SOW at this time.

Response Package 3 4/27/2010 Page 9 of 21

321 SOW Section C.4.4.1.2 Software

“The current operating system (OS) is Windows XP. The NRC has currently elected not to upgrade to Windows Vista, but will upgrade to Windows 7.”

Please confirm that offerors are expected to propose systems which include Microsoft Windows 7, as Windows XP will no longer be available from Major OEMs with new systems at expected time of first delivery.

The NRC currently maintains a standard desktop image (see SOW section C.5.1.7.3 "Development", Page 36, Item # 24 for more details). The basis for this image is the Microsoft Windows XP OS. It is not expected that this image will change before ITISS contract award, although the agency is investigating and testing in preparation for a Windows 7 migration.

Keeping the above in mind, the NRC would like offerors to propose the most appropriate solution to address the agency's requirements while causing the least disruption to agency users.

The proposed solution should also be one that the Offeror can maintain at a reasonable price to the NRC.

25 Electronic Mail (Email) and Messaging -Section C.5.1.2

Electronic Mail (Email) and Messaging item No. 14. “Provide, manage, operate, maintain, administer and support a unified messaging service that will provide NRC users with a computer-based interface for email, voice mail, PBX, and messaging (the NRC does not currently use unified messaging);” The government seems to be asking for the offeror to provide a unified messaging solution that will interface with NRC’s legacy voice systems (voice mail, PBX, and messaging). Is this a correct interpretation? If so, will the government provide more specifics on the legacy systems that will need to be interfaced with and indicate that the necessary access points will be ready and able to support the interfaces?

This is not a correct interpretation of the NRC's requirement.

First, the NRC does not expect that the Offeror will address this requirement at the beginning of the ITISS period of performance. This requirement would only realistically be addressed at a future point in time when the NRC has purchased a PBX for headquarters telecommunications use (outside of the scope for the ITISS Contract). The NRC wants the ITISS contractor to be in a position to support the unification of these systems, not to actually provide the solution, as the components are not currently in place.

257 SOW-C.6.2.1 Perform WebEOC event archives and event clean up after each use; How often are these events scheduled? Please describe the activities related to this requirement

There are 4 major exercises a year; the number of events is unpredictable. Essentially this effort requires archiving the event (with WebEOC this is very simple) once the PO gives them the OK, bringing the OPs Center back to normal mode (resetting the displays, cleanup).

Response Package 3 4/27/2010 Page 10 of 21

345 C.6.10 Is the NRC's expectation that the development environment must replicate the entire actual production environment or is the expectation that the development environment be a smaller but identical in network including infrastructure, servers and applications, environment?

The NRC recognizes that to replicate the entire production environment would be cost prohibitive. The intent of this requirement is that key elements of the production ITI would be reproduced (i.e. firewall settings) so that a developer could increase the chances that their application would run in the NRC environment. It is not even expected that all applications would be available in the development environment, but rather key applications such as e-mail. The NRC is looking for Offeror's expertise in helping the agency identify a solution that will reduce the effort of application developers and ITISS support staff when a solution is ready for transition into the production environment.

346 C.6.10 Will the NRC provide guidance or procedures for the creation of non-production data?

Typically, it is the developer's responsibility (whatever the system) to provide "dummy" to test their application with. The Offeror will need to provide "dummy" data for the systems that it manages which are replicated in the development environment (such as e-mail). The only guideline that the NRC will provide is that it must not be actual production data, since the development environment is not supported at the same security level as the production environment, and the agency does not want any actual data to be susceptible to IT security threats.

351 Attachment A - SOW -C.5.1.5.1 - Page 29 - Network Management

Should we assume that the conversion from IPv4 to IPv6 is a special project rather than a part of the fixed price for Core services?

This requirement is driven towards the Offeror's capability to provide IPv6 as a function of the equipment that they propose.

As stated in the SOW, NRC is currently primarily and IPv4 environment, with IPv6 capable hardware. This requirement only speaks to the ITISS contractor being able to support IPv6, not convert applications. The NRC expects that the Offeror will provide network components that are IPv6 capable and that the agency will not have to pay additional amounts for IPv6 transmission when the time to migrate comes. It is likely that an integration task will be awarded to manage the actual migration when the time comes.

Response Package 3 4/27/2010 Page 11 of 21

355 Q&A ID #188, Response Package 1 dated April 20; SOW C.7, Transition Considerations

Answer to question 188 indicates that as the ITISS awardee takes over operational activity, they will be responsible for the SLRs that are associated with the tasks that they have transitioned. Are we to understand that during the second 90 days of the transition period, the ITISS awardee has ownership of the equipment and software, but the incumbent ISSC contractor will continue to operate the equipment until each of the various tasks is serially transitioned to the new contactor?

Also, during this time, is it correct that the ITISS awardee is not responsible for SLRs for a particular service category (e.g., Blackberry) until each service is fully transitioned to the awardee? Is it the government’s desire to have all services fully transitioned at once on Day 180 or gradually transitioned, service by service, during the second 90-day period of transition?

The NRC's only interest is in causing no disruption to agency users. The NRC has thoughts about the best way to achieve this.

However, we are interested in seeing what Offeror's have to propose based on their experience in relation to transition. The agency would like to understand what has worked for Offerors when they have transitioned similar contracts in the past. At the time of initial award, a reconciliation will take place between the incumbent ISSC contractor's transition plan, the NRC's plan, and the Offeror's plan to provide a smooth transition of all services.

Please provide a recommendation for transition that will cause no disruption to NRC users.

366 Q&A ID #310, Response Package 1 dated April 20; RFP Attach F NRC ITISS Inventory List Personal Computing Tab Enterprise Software – MS Office

Please confirm if the new ITISS contractor will need to provide licenses for MS Office Professional 2007 (Word, Excel, PowerPoint, Access, Outlook, InforPath, & Publisher) as well as licenses for Microsoft SharePoint or if the Government has an Enterprise License Agreement in place with MicroSoft.

The new ITISS contractor will need to provide the licenses described.

367 Q&A ID #324, Response Package 1 dated April 20; SOW Section C.5.1.4.1

Please confirm that additional personal computing devices proposed, as suggested in the answer to question 324, will not be included in the evaluation of Total Overall Price.

The assumption made by the Offeror is incorrect. The NRC does not intend to "propose" any devices here, rather to invite proposals from the Offerors. The NRC is requesting that Offeror's propose the technical solution that will address the NRC's current needs and any future needs that are predicted from the experience of the Offeror and submit a complementary price proposal.

Response Package 3 4/27/2010 Page 12 of 21

369 C.5.1.7, C.5.1.8 In the government’s response to Q80 it is stated that the Core Services are to be priced as Firm Fixed Price. However, in response to Q 101 it is stated that Development, Integration and Transition are to be priced as Time and Materials. The transition section (C.5.1.7), which encompasses Development, Integration and Transition, is included as part of Core services. Will the Government please clarify?

This would also appear to be the case with C.5.1.8 “High Performance Computing”

The Offeror is correct. RFP Section B-1 "Price/Cost Schedule" contains the correct contract types for each task listed in the SOW. A portion of the "Core Tasks" are in fact labor hour tasks as indicated in the Price/Cost Schedule.

Q 101 was trying to clarify that many items for which specific labor categories were not provided should be factored into the firm fixed units.

167 Reference: SOW Section C.5.2.2.5.1, NRC Responsibilities, page 44.

We would like to know if NRC currently has any third party contracts for recovery services for which the new contractor would be required to assume financial responsibility. If there are third party disaster recovery vendor contracts required for the new ITISS contractor to assume or take over ownership, please provide the cost of the current contract.

There are no third party contracts for recovery services for which the ITISS awardee will be required to assume financial responsibility for.

234 SOW-C.5.2.2.5.2 Perform daily replication to the warm standby environment, and ensures data synchronization to backup site was successful;

What volume of data is being replicated? How much of the environment is replicated to the warm stand by environment? How many change occurs daily? What is the data throughput on the link for the replication?

Q ID # 218 and # 226 speaks specifically to data replication in the agency's current Continuity of Operations (COOP) Plan. This COOP replication represents a limited number of systems to maintain basic operations for short periods of time.

The NRC's plans for Disaster Recovery are still developing, and involve an ability to restore the agency's operations in the aftermath of a more significant disruptive event. Currently there is no replication of data for this DR solution. The current expectation is that replication of systems will begin in fiscal year 2011 and continue through fiscal year 2013. Specifics about data throughput are unknown at this time.

Response Package 3 4/27/2010 Page 13 of 21

235 SOW-C.5.2.2.5.2 Assisting with detailed preparation, configuration, testing, and deployment of systems/applications identified in the NRC DR Plan not “DR-enabled” prior to contract award;

How many systems are not DR enabled? What is the estimated level of effort required to DR enable them? Over what period of time?

Currently, it would be appropriate to say that no NRC systems are DR-enabled. The ITISS Contractor's involvement with each system that is enabled for DR will be related to the level of ownership of that system. For example, for a system that is provided by the Offeror (i.e. e-mail), they will be heavily involved in the activities around developing the DR solution for that system. However, for a system that is hosted in the data center and managed by a separate program, the ITISS Contractor's activities will be limited to a support role.

The estimated time-frame is described in the response to Q ID # 234.

236 SOW-C.5.2.2.5.2 Ongoing operation and support of systems/applications that have been DR-enabled prior to contract award; How many?

What is the estimated level of effort in labor hours? Over what time period is the activity to take place?

Please see Q ID # 235.

237 SOW-C.5.2.2.5.2 Participating in scheduled disaster recovery testing to ensure proper failover and recovery of systems/applications; What frequency?

What support is needed? What is done during tests? Provide a copy of the plan now

It is anticipated that Disaster Recovery testing will take place annually. The plan is still under development by NRC staff.

Q ID # 225 provides some insight for how COOP testing is currently conducted, to provide some insight as to the starting point for how tests will likely be conducted.

Response Package 3 4/27/2010 Page 14 of 21

223 SOW-C.5.1.8 Provide assistance in the planning, development, design, and implementation of the effort to consolidate high performance computing at the agency; Consolidate it from where to where? How many servers and how much data? Will the consolidation occur over a WAN link? If so, what is the estimated data throughput?

There are two flavors of high performance computing at the NRC: server-based and desk-top based. Two major program offices use desk-top based solutions. The desk-top solution is largely standardized across the agency. These systems are all located at NRC headquarters in Rockville, MD. Although the incumbent ISSC contractor provides support for these systems, the hardware is primarily GFE.

Currently, two major program offices use independent server-based solutions. Both offices are located in Rockville, MD, but they are currently in temporary space, not co-located with the main NRC campus at White Flint. Each office has a small server room within their temporary office space to support these GFE server-based HPC assets. When the new NRC headquarters is completed, both of these offices will be moving into the new building. A new server room will be built in the new building to house these computing assets.

It is not anticipated that any of these assets will be utilized over a WAN link.

184 SOW Section C.5.2.2.6.2, Offeror Responsibilities, page 53.

The SOW states: “The offeror shall adhere to the guidance outlined in NIST SP 800-53, FIPS 200 and NRC guidance for the identification and documentation of minimum security controls.” The NIST standards require automated tools be deployed for functions such as patch management, mal-ware scanning, etc. What tools are currently installed at NRC to automate the security controls specified in NIST SP 800-53?

In response to this question, the agency is providing some clarification as to the expectations for IT operational security at the agency as the document "RFP-33-11-325 USNRC ITISS Security Tools". This document contains a list of functions related to this activity and an associated description of the tools currently being used. This list also indicates whether this tool is owned by the NRC or the incumbent ISSC contractor. In cases where the tool is currently owned by the ISSC contractor, the Offeror will need to provide tools to address the described function.

Response Package 3 4/27/2010 Page 15 of 21

240 SOW-C.2.2.6.3 Manage, maintain and administer other security systems, including log management, proxy, vulnerability scanning, traffic analysis devices to provide reporting, analysis and alerting of emerging security issues, as well as the ability to implement mitigating controls;

What does NRC/Incumbant have that offerer can/will inherit to fulfill this requirement? Will the tools be government furnished or provided by the offeror?

See Q ID # 184

241 SOW-C.2.2.6.4 Provide, manage, maintain, and operate an automated tool to audit NRC ITI system logs;

evaluate and report on security events monitored in those logs as determined by NRC policy and IT security oversight bodies; What does NRC/Incumbant have that offerer can/will inherit to fulfill this requirement? Will the tools be government furnished or provided by the offeror?

See Q ID # 184

242 SOW-C.2.2.6.5 Manage, maintain, and operate an automated tool to monitor changes to system baseline configuration settings and report on events as determined by NRC policy and IT security oversight bodies; What does NRC/Incumbant have that offerer can/will inherit to fulfill this requirement? Will the tools be government furnished or provided by the offeror?

See Q ID # 184

243 SOW-C.2.2.6.7 Develop and maintain auditing systems and take the necessary actions to prevent and stop unauthorized access and/or suspicious activity;

What does NRC/Incumbant have that offerer can/will inherit to fulfill this requirement? Will the tools be government furnished or provided by the offeror?

See Q ID # 184

Response Package 3 4/27/2010 Page 16 of 21

244 SOW-C.2.2.6.8 Perform verification of perimeter router policies; configure firewall or network sensor to alert for unauthorized access attempts and privilege escalation; and perform routine review of Host Intrusion Detection system (HIDs), Network Intrusion Detection systems (NIDs), and firewall rules for accuracy, efficiency and their ability to withstand new attacks; What does NRC/Incumbant have that offerer can/will inherit to fulfill this requirement? Will the tools be government furnished or provided by the offeror?

See Q ID # 184

245 SOW-C.2.2.6.9 Maintain systems that automatically examine network access logs for signs of unauthorized access, intrusion or suspicious activities; What does NRC/Incumbant have that offerer can/will inherit to fulfill this requirement? Will the tools be government furnished or provided by the offeror?

See Q ID # 184

246 SOW-C.2.2.6.10 Log all access attempts by NRC users, offeror users, and administrators; What does NRC/Incumbant have that offerer can/will inherit to fulfill this requirement? Will the tools be government furnished or provided by the offeror?

See Q ID # 184

247 SOW-C.5.2.2.6.2 Provide reports such as system audit logs, password control lists, user access logs and reports, reports on periodic security audits, and reports on unauthorized access attempts;

What does NRC/Incumbant have that offerer can/will inherit to fulfill this requirement? Will the tools be government furnished or provided by the offeror?

See Q ID # 184

Response Package 3 4/27/2010 Page 17 of 21

88 Appendix A - A.4.1 - A.4.1 Table 1

- BOE

Please provide the number of VIP 1 and VIP 2 users and their geographic locations

There are approximately 50 VIP 1 users and approximately 200 VIP 2 users. Virtually all of these users are based at NRC headquarters. Additional VIP 2 users will likely exist in the Regional Offices if/when consolidation of Service Desk function takes place.

106 Attachment A – SOW - Appendix A

Some SLAs in Appendix A have been structured based on VIP 1, and VIP 2 and Standard support. However, the Pricing tables make no such distinction (i.e., personal computing and blackberrys). Is the intent to have VIP users pay the same price for service as a Standard user? If yes, please provide the maximum percent total of VIPs in the user population for each applicable service.

Please see Q ID # 78 for the VIP user numbers. If the Offeror believes that a multi-tiered pricing structure for such services as BlackBerry or Personal Computing would provide the greatest value to the NRC, the government suggests that the Offeror propose additional CLINs in these areas to segregate costs for these users.

162 Reference: SOW Appendix A, Quality Assurance Surveillance Plan (QASP), Section A.4.1, Blackberry, page 138 and other sections throughout Appendix A.

SLR “Time to provision a new Blackberry device” refers to VIP 1 and VIP 2 in the Performance Target column. There is no reference to, nor a definition or clarification statement, for a VIP 1 or VIP 2 user or user type within Attachment A. Please provide a clarifying statement as to the classification of a VIP 1 or VIP 2 user in the NRC environment, the approximate number of users, and the expected support hours for those users.

VIP 1 is equivalent to NRC Commissioners and their staffs. It is estimated that there are approximately 50 VIP 1 users at any time. VIP 2 users encompass the Executive Director for Operations and his Deputies, Office Directors, and individuals who have been identified in the agency that should be given additional support based on the mission criticality of their position. There are approximately 200 VIP 2 users at this time.

Response Package 3 4/27/2010 Page 18 of 21

356 Q&A ID #188, Response Package 1 dated April 20; SOW C.7.1, Initial Transition

Answer to question 188 indicates that as the ITISS awardee takes over operational activity, they will be responsible for the SLRs that are associated with the tasks that they have transitioned. SOW C.7.1 indicates that “The offeror shall use the first 90 days of this period to prepare for transition (inventory, hiring, security clearances, etc.) and the remaining 90 days will be to transition infrastructure services from the incumbent ISSC contractor.”

Later in C.7.1, the RFP states ”Upon legal transfer of assets from the incumbent ISSC Contractor to the offeror (no more than 90 days after notice to proceed with the new ITISS contract), the incumbent ISSC Contractor’s responsibility for ITISS services shall terminate.” This language appears to be contradictory, because if the ISSC contractor’s responsibility for services terminates at the end of the first 90 days, there is no opportunity for the ITISS awardee to use the remaining 90 days to transition services from the ISSC contractor. Please clarify that the ISSC contractor will continue to have responsibility for ISSC services after the first 90 days until the services are transitioned to the awardee.

As discussed in C.7.1, there are two phases involved with transition. The first phase is about ensuring that the ITISS awardee is in a position to succeed when transition begins. The NRC anticipates that the first phase will not exceed 90 days;

however the exact timing is dependent on several factors. Listed here are a few:

1. How long it takes to badge a sufficient number of ITISS contractor staff.

2. The award date of ITISS.

3. The end date of the ISSC contract.

Once the ITISS awardee is in a position to perform the work, the second phase will begin. The NRC also anticipates that the second phase will not exceed 90 days. The exact period of this second phase is also dependent on several factors. Listed here are a few:

1. Incumbent ISSC contractor transition proposal.

2. ITISS Contractor transition proposal.

3. How rapidly the ITISS Contractor is able to take on new services successfully.

Response Package 3 4/27/2010 Page 19 of 21

152 Reference: SOW Section C.4.4.2.1, Hardware, page 13; SOW Section C.4.4.3.1, Hardware, page 14; and other sections of the SOW.

If the current ITI assets are available for transfer from the incumbent or if NRC expects the offerors to include refresh costs for the various hardware in the ITI (e.g., General Server Environment, Application Hosting Server Environment, Network Components, etc.), then offerors would need asset financial information for these servers so that they can determine the age of assets, transfer cost, and the timing of the refreshes. Please provide asset financial data for the ITI hardware that the offerors will have the option to transfer from the incumbent ISSC contractor and for assets that NRC requires the offeror to refresh. Please provide the purchase or lease date, lease duration, monthly lease cost or original purchase cost, lease termination cost, and remaining un-depreciated asset value for each item of server, storage, and network hardware in the ITI.

There were many questions regarding the transfer of the existing leases. This answer should be regarded as the answer to all of those questions, which will not be separately answered.

Regarding equipment that is leased under the current contract, we are specifically targeting desktop and laptop computers. For uniformity across proposals and ease of evaluation we suggest the government estimated cost of $33 per desktop lease per month and $48 per laptop lease per month.

If vendors wish, they may contact the lessors of this equipment to negotiate their own per month lease costs. Current lessors are CSI Leasing, US Bank Corp., Global Capital, and Tip Capital.

In any case, final disposition of these leases will occur subsequent to the actual award. At that time, the awardee will formalize plans with the lessors to terminate or assume leases in accordance with terms of the master leases.

202 RFP Reference: C.3.4 Core Services and Additional Services, Table 1

Vendor Question: Can the government provide the name of the prime contractor, particularly those who are small businesses, for each of the 6 current contracts providing ITISS Services at the NRC? This will assist ITISS offerors in evaluating incumbent NRC contractors as possible subcontractors.

No, but we believe this is public information

287 SOW Section C.3.4, Table 1 (page 4/217):

Will the Government identify the contractors presently supporting the six listed current contracts? Are those contractors eligible to bid on the ITISS solicitation?

No, we will not identify the current contractors, but we believe this is public information. All companies are eligible to bid on the ITISS solicitation.

Response Package 3 4/27/2010 Page 20 of 21

357 Q&A ID #134, Response Package 1 dated April 20 In response to question #134, the Government confirmed that the additional required information such as the SF1449, Reps/Certs, Subcontracting Plans, etc. should be placed in the appendices. Please specify which appendices belong in Part 1, Cost Proposal, and Part 2, Technical and Management Proposal. Typically, the SF 1449, Representations and Certifications, and Organizational Conflict of Interest disclosures would be submitted in the Cost/Contract Documentation/Business Proposal whereas the subcontracting plan would be submitted in the Technical and Management Proposal.

Correct, please place the SF 1449, Representations and Certifications, and Organizational Conflict of Interest disclosures in the Cost/Contract Documentation/Business Proposal, and the subcontracting plan in the Technical and Management Proposal.

358 Q&A ID #134, Response Package 1 dated April 20; RFP Section E.14, Proposal Presentation and Format

Please confirm that the Quality Control Plan, required in the Program Management section, should be placed in the appendices and excluded from the page count.

Correct.

360 B.2, Project Title RFP Section B.2 states that the title of this project is “Information Technology Infrastructure Services and Support (ITISS).”

However, throughout the RFP, including the SOW, the title of the project appears as “Information Technology Infrastructure and Support Services (ITISS).” Please clarify if what is stated in RFP Section B.2 is correct.

The Title of the project is Information Technology Infrastructure and Support Services, RFP section B.2 is incorrect.

361 E.9, Timely Receipt of Proposals RFP Section E.9 stipulates that all hand carried offers must be delivered to the NRC loading dock security station located at 11545 Rockville Pike, Rockville, Maryland 20852 and received in the depository located in Room T- 7-I-2. The synopsis on FedBizOpps states the delivery address is 11555 Rockville Pike. Please confirm if the 11545 Rockville Pike address in RFP Section E.9 is the correct address for proposal delivery.

The correct address should be 11555, not 11545.

Response Package 3 4/27/2010 Page 21 of 21

362 Q&A ID #80, Response Package 1 dated April 20 The answer to question 80 indicates that vendors have latitude not included in the RFP to propose different contract types. Please confirm the Government’s intent to allow vendors to propose their own different mix of FP, FUP, and Labor Hour contract CLINs. Will the Government incorporate these instructions in an amendment to the RFP?

Please explain how these will be evaluated.

We realize the prior answer caused some confusion - please disregard that instruction. All vendors should simply propose based upon the contract types listed in B.1. for uniformity of evaluation.

363 Q&A ID #36, Response Package 1 dated April 20; Pricing Template

The answer to question 36 indicates that the 3% increase growth estimate indicated in the SOW “refers to the rate, not the number of hours or pieces of equipment.” To which rate does the answer refer? Is the Government asking vendors to bid a specific escalation rate rather than a competitive escalation rate?

We realize that costs increase over time. To account for this, the schedule contains an average estimated escalation rate of 3%. It is left to the vendor's discretion if they wish to propose an alternate percentage.