RFP-33-11-325 USNRC ITISS Responses Package 4 to Vendor Questions.pdf

U.S. Nuclear Regulatory Commission Responses to Questions Information Technology Infrastructure and Support Services (RFP-33-11-325)

Response Package 4 4/30/2010 Page 1 of 5

ID RFP Reference Question Response 159 1Reference: SOW Section

C.6.1.2, Monitoring, page 75.

Additional information is required regarding NRC’s facility systems alarm capabilities (e.g., for the air conditioning, humidity, power distribution, UPS, etc.). Specifically, please clarify if these systems provide alarm outputs that trigger when an anomaly occurs and, if so, the format of the alarm output and the interface specification for each alarm output. Please provide additional details about the facilities systems alarm systems and interface specifications for these alarms.

At the current time, a variety of temperature and humidity monitors are in place. Many are associated with the display panel of the UPS and/or air conditioning units. There are no interfaces currently in use, however, improvements to environmental monitoring are always being sought. No single broad-based initiative is current planned or funded, although some incremental environmental monitoring improvements are currently being considered and may be implemented should funding become available.

232 SOW-C.5.2.2.5.2 Maintain and perform specified disaster recovery and failover procedures; What is the failover period to restore service? What are the failover criteria? Are there multiple recovery time objectives dependent on variables defined?

If so, what are the objectives and variables?

The responses to Q ID # 234 & # 235 that were provided on 4/27/2010 speak to the current state of Disaster Recovery at the NRC. The agency will be consulting with the ITISS awardee along with others to determine the most appropriate policies to provide a disaster recovery capability for the agency.

233 SOW-C.5.2.2.5.2 Provide support for failing over the production environment to the warm standby environment located in another NRC facility; What is NRCs definition of warm standby in terms of failover time?

The NRC defines warm standby as a Return to Operations (RTO) from between 8 to 24 hours after the "disaster" occurs.

343 C.6.9 Does the NRC have an estimated initial capacity as well as an annual growth projection for the proposed document management solution?

Please see Q ID # 347 and #350

344 C.6.9.3 Is the NRC's expectation that the offeror will filter out all duplicate records? Should there be any special handling, error handling or reporting of duplicate records?

The requirement is that the ITISS awarded will identify duplicate documents before they are scanned or added to the E-Safe repository.

347 C.6.9.3 At present does the NRC have a storage solution for the EMC's Documentum product?

Currently, E-Safe is running on the platforms described in the inventory for SLES. However, the agency is in the process of installing a Dell EqualLogic PS4000X, 6.4TB storage solution that is GFE equipment.

348 C.6.9.3 How much storage space does the NRC have for the EMC's Documentum product now?

At the time of ITISS award, there will be 6.4TB of storage available for E-Safe. Currently, about 500 GB of data are being stored in this system.

Response Package 4 4/30/2010 Page 2 of 5

349 C.6.9.3 How much storage space does the NRC anticipate they will need per user for the EMC's Documentum product?

The NRC believes that the 6.4 TB of storage that are planned to be in place by the time that the ITISS contract is awarded will be in excess of space requirements for all anticipated users.

350 C.6.9.3 What annual storage space growth does the NRC anticipate per user for the EMC's Documentum product?

Before E-Safe (within the last few years), all Safeguards data was in paper form. The core volume of Safeguards data has been converted to electronic files and is being stored in E-Safe. Although there are some paper safeguards data collections still in the agency that need to be converted, the NRC anticipates that this is only a small volume compared to the amount of data that has already been converted (~500 GB of existing data). It is anticipated that the capacity (6.4 TB) is significantly in excess of any storage requirement that the NRC can anticipate at this time.

239 SOW-C.2.2.6.2 Perform periodic security assessment to ensure compliance with security procedures and processes and make report available to NRC IT security oversight bodies; What frequency? What support is needed? What is done during tests? Please provide a copy of the current plan?

The requirement here is on how the ITISS awardee views the NRC IT Operational Security posture at the time of the assessment with a focus on where the Agency's vulnerabilities lie and what can be done to improve security. It is expected that this assessment will be performed at least quarterly. This is not an audit, it is a self-assessment so the level of effort will be dependent on how strong the agency's security posture is at any time and perhaps more importantly, how consistent and mature the ITISS offeror’s processes are for implementing the ITI and the security around the ITI.

340 SOW Appendix A.4.1 Table 1 Time to provision a new BlackBerry device (1 day for

VIP1/VIP2)

Delivery for regional Blackberries will be at least 1 day. Will the Government consider modifying the SLR to read “1 day to configure and ship”?

Yes

Response Package 4 4/30/2010 Page 3 of 5

308 RFP Attachment F NRC ITISS

Inventory List Personal Computing Tab Active Directory Software Bundle

Please provide detailed descriptions for the components of this “software bundle”, and all current license, support and maintenance agreements in place covering them.

The software in question is all provided by the incumbent ISSC contractor. The Offeror will need to provide licenses, support, and maintenance for the products. The software that is currently provided on each workstation are the following:

Active Directory Software: Reporter, ActiveRoles, Spotlight on Active Directory, Recovery Manager for Active Directory, Windows Rights Management Services, Forefront, Security Suite, InTrust

Communications/Collaboration Software: Microsoft Professional Suite (See Q ID # 310, from Responses dated 4/19/2010), Exchange Server Enterprise, SharePoint Server Enterprise, Office Communications Server standard/Enterprise, Exchange Recovery Manager, Quick Connect, Spotlight on Exchange

38 Statement of Work-Section C.4.4.1.2 Pages 11 & 12

The government provides a list of software of which much is incumbent provided. There may be licensing agreements between the vendor and the incumbent which prevent sale/transfer to any entity other than the government.

Please amend the list to reflect such restrictions (i.e. Service Desk Express (BMC)). Please advise which licenses NRC intends to convey?

All software listed as GFE in the SOW and in the inventory will be available to the offeror. For purposes of the proposal, unless it is otherwise stated in the SOW, Offeror's should assume that they will have to obtain software licensing for their proposed solution from a different source than the incumbent ISSC contractor.

The Offeror's particular example of BMC Service Desk Express is owned by the incumbent and the NRC will not force the transfer of the software licenses from the incumbent ISSC contractor to the ITISS awardee.

118 SOW, C.4.2 - 8 With dedicated support staff at the regional offices, it is assumed that the need for travel by ITISS support personnel between headquarters and the regional offices should be minimal. Please indicate the average annual travel experienced by the current contractor support team.

Based on historical experience with the incumbent ISSC contract, the agency expects that the ITISS contractor will require about 12 trips per year.

Response Package 4 4/30/2010 Page 4 of 5

370 C.5.1.6 3) In section C.5.1.6 “Remote Computing” the government states: “The VPN shall be configured to require a hardware authenticator (i.e. a hardware “token”) which generates a unique key on a timed schedule (approximately every sixty seconds). The remote computer user must enter the generated key along with their password to gain access to the encrypted VPN tunnel.”

Q: Is it the Government’s intent that the offeror propose a hardware token solution and provide the necessary systems, administration/management, and 6,000 tokens (quantity based upon the Government’s response to question #48).

Q: If so, where should the Offeror provide this pricing, as Remote Access Pricing Item U013 only provides for remote access support for 1,200 concurrent users?

Please see Q ID # 280.

280 SOW-C.5.1.6 The VPN shall be configured to require a hardware authenticator (i.e. a hardware “token”) which generates a unique key on a timed schedule (approximately every sixty seconds). The remote computer user must enter the generated key along with their password to gain access to the encrypted VPN tunnel. Is it acceptable to use a PIV/PIV- I credential? Or, can the solution use a software token?

CORRECTION TO SOW: Offerors should NOT provide a solution with a unique key generator on a timed schedule.

A PIV/PIV-I credential is an acceptable solution to this requirement. The NRC is currently in the process of providing PIV-I credentials to all NRC employees and badged NRC contractors. These credentials will be supplied by the government and should not be provided by the Contractor.

49 Pricing Template, Wireless Communications Services- The government asks for pager provisioning and support for NRC end-users.

Pager support and provisioning is not included in the SOW.

Please clarify this requirement. There are currently 140 pagers distributed to users in the agency. These devices have been in the environment for several years. Attempts have been made in recent years to recover/replace these devices, but most users have failed to come forward with them.

The service that needs to be provided for the remaining few devices tends to be limited to battery replacements and limited service.

Response Package 4 4/30/2010 Page 5 of 5

368 Reporting Requirements, C.6.4.2.2, Item 1.

The government states the reporting requirement, yet states another contractor is running the service desk. Yet, the government states the offeror responds to these requests. Except for the blackberry, the requirements for the items listed are not defined. Please clarify this requirement

The NRC is requesting support from the Offerors to provide a technical solution and pricing for cellular phones in addition to BlackBerry devices. The agency is attempting to phase out cellular phones and replace them with BlackBerry devices to reduce management complexity. In addition, we are requesting that the Offeror manage the distribution of government calling cards that are obtained through GSA telecommunications contract vehicles.

359 Q&A ID #134, Response Package 1 dated April 20;

RFP Section E.14, Proposal Presentation and Format

The RFP states: “List any awards received, provide letters of commendation, etc., that will demonstrate your record of past performance. Provide any other pertinent information that will aid in the evaluation of your performance record.”

Please confirm that letters of commendation and other pertinent information should be placed in the appendices and excluded from the page count.

Correct.

365 Q&A ID 120, Response Package 1 dated April 20;

Price Schedule Templates – A-4

The answer to question 120 indicates that offerors have flexibility to propose additional labor categories. How will these be evaluated in regards to Total Overall Price?

Offerors may propose alternate labor categories to those listed in the price Schedule, but must explain how the new labor category relates to, and addresses the same need as, the category originally listed in the price Schedule.

None RFP Page E-20, paragraph 3.(b) Past Performance.

The first sentence of 3rd paragraph, states: “Offerors shall list and discuss all prior contracts terminated for default and whether any show cause letters, cure notices, or poor performance letters have been received.”

This requirement is limited to contracts of any size that are similar in scope from the past three (3) years.