Amendment No 1 Question and Answers for Solicitation NRC-04-10-127.docx

Question and Answers Solicitation NRC-04-10-127

- The Solicitation is revised to reflect the changes shown below.

Question No. 1. On what platform does the US NRC toolset run?

NRC Response: Primarily the tool set runs on a windows platform. The tools can run on Linux or Mac, but not preferentially.

Question No. 2. Is modification to the toolset expected to be part of the scope of work? If it is, can you provide details about the compilers and development environment that is used to build new versions?

NRC Response: No

Question No. 3. The RFP lists a number of required IT policies which are only available on the internal NRC website. Can copies of the relevant policies be provided? In particular, those quoted in the RFP:

• Computer Security Policy for Encryption of Data at Rest When Outside of Agency Facilities

• Policy for Copying, Scanning, Printing, and Faxing SGI & Classified Information

• Computer Security Information Protection Policy

• Remote Access Policy

• Use of Commercial Wireless Devices, Services, and Technologies Policy

• Laptop Security Policy

• Computer Security Incident Response Policy

NRC Response: These policies are non-sensitive and a copy can be provided via CD or DVD to the vendor, per the vendor’s request, sent to Jeffrey.Mitchell@NRC.GOV or call Jeffrey Mitchell on 301-492-3939.

Question No. 4. It is not clear if all of the IT requirements quoted in the RFP apply to contractors working in their own independent network environment, as opposed to (for example) installation of new equipment in NRC facilities. Is it possible to clarify which requirements, if any, would not apply in such a situation? (For example, are contractor systems within the security jurisdiction of the NRC? Is approval of the NRC Chief Information Security Officer required for system changes (such as installation of public domain software))?

NRC Response: All IT security requirements noted in the RFP apply to contractors working on their systems. As noted in the following IT Security Requirement C-7:

“All work performed at non-NRC facilities shall be in facilities, networks, and computers that have been accredited by NRC for processing information at the sensitivity level of the information being processed.”

To obtain accreditation, the contractor system must meet the IT security requirements (e.g., NRC Security policies, standards and procedures) outlined in this solicitation.

Next, regarding the question of CISO approval of system changes, as noted in the solicitation page C-9:

“Any changes to the system security posture shall have the prior approval of the ISSO. The Contractor shall not have the ability to make changes to the system's security posture without the appropriate involvement and approval of the ISSO.”

Question No. 5. Would the toolsets, input data and other data provided by the NRC for the execution of this contract be considered NRC Classified data? If not, at what security level would such data be considered?

NRC Response: The toolsets, input data and other data provided by the NRC are nonclassified, proprietary materials.

Question No. 6. Considering the specific requirement "All NRC Classified data being transmitted over a network shall use NSA approved encryption", does this apply to data transmitted over an internal network (for example, opening a file from a central file server on a desktop computer over the LAN)?

NRC Response: There will be no classified data under this contract. However all data must be encrypted using FIPS 140-2 validated cryptographic modules operated in FIPS mode (e.g., Secure Zip)

Question No. 7. As contractors working at non-NRC facilities, the use of NRC e-mail accounts for transmitting information would not be possible. What is the process for obtaining CSO approval for alternative mechanisms (e.g. transfer via websites using HTTPS protocol)?

NRC Response: Contractor personnel, working through the NRC Office of Information Services (OIS), can arrange for remote access Citrix connections using certificates for authentication.

Question No. 8. Does the requirement "… backup media is created…to ensure that data can be retrieved and is restorable to NRC systems" apply to contractors working on non-NRC systems? If it does, can details of what backup media and software is supported by the NRC be provided?

NRC Response: Yes - The contractor must ensure a means of backing up all tools and data generated under this contract such that it can be retrieved and restored to the NRC system regardless of where the original tools and data were kept. DVD and CD media are acceptable means of providing restoration copies of toolsets and data.

Question No. 9. In section L.14 (c) two alternatives are described, a written "Technical and Management Proposal" or an "Oral Presentation and Supporting Documentation". Is it intended that this is an option to be determined by the bidder? Are there guidelines for the presentation, e.g. time limit, format, etc.?

NRC Response: There will be no “Oral Presentation”. The information found in section L.14 is boilerplate proposal instruction language to be used for either “Written Technical and Management Proposal” or “Oral Presentation and Supporting Documentation” The NRC Contracting Officer would make this determination and should oral presentations be used the instructions would be found in section L.14(e).

Question No. 10. If the oral presentation option is selected will the oral presentation occur prior to the due date of the proposal? Will the oral presentation material and supporting documentation be due at the same time as the cost proposal and other submitted materials?

NRC Response: No Oral Presentations.

Question No. 11. Section M.2 second line under 1) Personnel Qualifications Experience & Availability references Clause L.8 (e)(1). Should this be L.14 (e)(1)?

NRC Response: Correct. Please omit these references “L.8(e)(1)” found in Section M.2 and replace with “L.14(e)(1)”.

Question No. 12. In section L.14 (e) (2) and (3) the offeror is asked to provide an Estimated Amount and an Obligated Amount for each contract. Is the Estimated Amount the original bid price, total contract ceiling, or some other quantity? Please explain what is desired for the Estimated Amount.

NRC Response: The term “Estimated Amount” would refer to the full potential of the contract value, also known as the total contact ceiling. This word “estimated amount” was used in the event a proposing vendor did not want to disclose an exact amount on any particular contract, as such the estimated amount would be sufficient in gauging the value of the effort.

Question No. 13. The solicitation package includes a file CARS_Qualification_Statement.pdf. Is this form intended to be used for the Past Performance references in addition to the Corporate Experience? There is a potential for redundancy between these two sections [i.e., Sections L.14(e)(2) and L.14(e)(3)]. Should information on contracts be included in both sections for completeness and ease of evaluation at the expense of redundancy?

NRC Response: This form can be used for both or separately. This form is used to assist offeror’s in obtaining Corporate Experience and Past Performance information. This form is not mandatory to be used. It is more important to successfully demonstrate Corporate Experience and Past Performance information that is required in Section L.14(e)(2)&(3).

Question No. 14. The type of audit log review and review frequency that is listed on page C-11 of the RFP seems to be applicable to a classified system. A review of the NRC standards, in particular CSO-STD-2005 indicates a much smaller list of items that are required to be audited for a FIPS-199 (NIST SP 800-60) categorization of “low” or “moderate”. Also, for a “low sensitivity” system, the review of audit logs is to be performed biweekly (as opposed to daily as listed in the RFP). Please confirm whether CSO-STD-2005 will be the governing standard for monitoring of systems that process sensitive information.

NRC Response: CSO-STD-2005 is the governing standard.

Question No. 15. Part 1 section B.3 (a) provides an MOL in terms of hours. In the past MOL has been in funding rather than hours. Will the contractor be required to track and report total cumulative hours over the various task orders? or will the MOL be based on funds rather than hours?

NRC Response: The vendor will be required to track funding not hours. Upon contract award the MOL terms will be converted to a dollar figure.

Question No. 16. The solicitation notes that meeting and travel requirements will be determined in each individual task order. However, for the purposes of costing travel on the base proposal, is there a travel costs not-to-exceed estimate? Or guidelines to the number of trips expected?

NRC Response: It is not necessary to show a cost for travel in your cost proposal. However, it should be noted that the NRC does not pay fee on travel. A statement in your proposal shall indicate your acceptance that (1) No Fee is applied to travel and (2) Travel charges will not exceed those allowed by the Federal Travel Regulation.

Question No. 17. Is there an incumbent for this project? If so, how long have they had the contract and what was the average annual spending?

NRC Response: The previous similar contract to this solicitation was awarded to Information Systems Laboratories under NRC-04-06-068. Contract NRC-04-06-068 has a duration period of three years.

Note: This Amendment No. 1 does not change the proposal due date on October 12, 2010 at 4:00 p.m. EST.