Questions and Answers 1305M323QNWWV0151.pdf

Requirement: Information System Security Officer (ISSO) Services for the National Oceanic and Atmospheric Administration (NOAA) Request for Quote (RFQ) 1305M323QNWWV0151

Questions & Answers

Q: Is there any special preference toward security clearance levels?

A: Moderate Security Clearance

Q: Does the candidate need to have a Top Secret clearance?

A: No.

Q: Do you have a specific criterion for the ISSO professional? For example, do you require any special certifications? Education level? Number of years of experience?

A: As identified in the Performance Work Statement (PWS) Section 3.1:

● At a minimum one (1) certification listed below or proof that an applicable employee(s) is significantly along (at a minimum of one (1)-year) in the process of attaining at least one of the following professional certifications required by DOC Information Technology Security Baseline Policy (DOC ITSBP) Version 1.0, Annex C-1: Information System Security Training for Significant Roles for an Information System Security Officer:

o CompTIA A + o CompTIA Network + o CompTIA Security + o GIAC Certified Incident Handler (GCIH) o GIAC Security Expert (GSE) o GIAC Information Security Professional (GISP) o GIAC Security Leadership Certification (GSLC) o ISC2 Certified Authorization Professional (CAP) o ISC2 System Security Certified Practitioner (SSCP) o ISC2 Certified Information System Security Professional (CISSP) o Certified Information Systems Auditor (CISA) o ISACA Certified in Risk and Information System Control (CRISC) o Security Certified Program Security Certified Network Professional (SCNP) o Security Certified Program Security Certified Network Architect (SCNA) o Security Certified Network Professional (SCNP) o Security Certified Network Architect (SCNA)

Q: What is the minimum education requirement for proposed key personnel?

A: As stated in Section 3.1 of the PWS:

The minimum qualifications for the IT Security Specialist III are as follows: Must have at least six (6) years of experience in the IT security field. Must have at least six (6) years or experience on projects (of progressive experience) - some of which must include Federal Government projects/contracts that covered the following:

● Advising on IT security requirement solution options inclusive of developing documentation and/or white papers

● Leading the development of the solution migration and implementation plans on IT security requirement solutions

● Creating IT security policies and procedures

Q: Was this requirement previously competed as woman-owned small business (WOSB)?

A: This is a new requirement.

Q: What requirements have changed from the existing contract to the new?

A: This is a new requirement.

Q: Is there an incumbent contractor? If there is an incumbent, can the government provide the name and contract/task order number for the incumbent? Is the incumbent eligible to bid on this project?

A: No. This is a new requirement. There is no incumbent.

Q: Will the majority of the work be performed on-site or can the contractor personnel work remotely?

A: Remote work will not be permitted. Telework will be allowed. See Section 4.2 of the

PWS.

Q: Will the Government consider Key Personnel that are fully remote from Anchorage, AK?

A: No. Remote work will not be permitted. Telework will be allowed. See section 4.2 of the PWS.

Q: Would the Government consider a contractor-site support staff for this requirement? The type of ISSO services covered can be provided remotely, particularly after COVID-19 regime.

A: No. Remote work will not be permitted. Telework will be allowed. See section 4.2 of the PWS.

Q: Does this requirement allow for remote/telework? If so, what percentage of on-site work is required?

A: Remote work will not be permitted. Telework will be permitted (see Section 4.2 of the PWS). The Government cannot estimate at this time what the exact percentage of on-site work may be.

Q: What duties are expected to be performed on site and what duties are believed to be accomplished offsite?

A: Varied. Documentation, team meetings and interviews of staff for on site and off site.

Q: What other sites will the contractor be required to travel to?

Based on the travel budget identified, can the Government list the expected frequency of travel?

A: Up to (but not limited to) 6 times a year, by automobile:

National Tsunami Warning Center 910 S. Felton Street Palmer, AK 99645

Annually, by air:

Pacific Tsunami Warning Center 1845 Wasp Boulevard Honolulu, HI 96818

Q: Is task 2 expected to be ISSO support for the Federal Information Security Management Act (FISMA) system/systems? And if so, generally how many ISSO staff is expected or historically been used?

A: Yes. One federal employee is currently used. The current staff member will be a back up to this contractor.

Q: Can the Government provide the FISMA categorization of the systems that need to be supported?

A: FISMA High

Q: How many FISMA systems and accompanying sub systems are in scope for this? (ie: 1 Fisma system with no sub systems, 1 FISMA system 3 sub systems, 2 FISMA systems with 0 additional sub systems in the FISMA systems etc.)

A: 1 FISMA system with 0 subsystems.

Q: What is the historical total number of Full Time Equivalents (FTEs) and number of FTEs per task?

A: 1 FTE in total for the entire single FISMA system and all tasks.

Q: Can the Government state the current number of FTE(s) currently supporting the tasks listed in the PWS?

A: One.

Q: What is the expectation regarding ISSOs per system?

A: To manage controls and ensure timelines and objectives in a timely manner. Be aware of encroaching security issues and inform leadership and IT staff of roadblocks or concerns so alternate solutions can be implemented when necessary.

Q: Can the Government provide the expected level of effort (LOE) on this contract?

A: This is not an LOE-type contract. This is planned to be a hybrid Firm-Fixed-Price/Time-and-Materials contract and is being solicited using FAR Part 12 and 13 procedures.

Q: What tools and technologies are being used on the current contract?

A: Windows laptop assigned to ISSO, Tenable Nessus, Arcsight, FireEye, BigFix and

CSAM.

Q: Will the government specify the number of systems requiring ISSO support services?

A: One FISMA system of approximately 125 devices split between two physical sites.

Q: Section # 5 is missing from the RFQ. Will the government clarify if Section 6.0 was intended to be 5.0?

A: The section numbering in the RFQ, Attachment 1, PWS is off. There is no missing section.

Q: Will the government provide a master list of systems including classified and unclassified systems that will be part of this contract?

A: No. However, all are unclassified and primarily consist of Microsoft Windows, Red Hat Linux and Cisco.

Q: How many systems will require an ATO during base year?

A: The entire FISMA system of approximately 125 devices.

Q: How many ATO packages are currently maintained by NWS Alaska and Pacific Regions? On average how many new ATO packages are added to the NWS Alaska and Pacific Regions system inventory on an annual basis?

A: One package annually only.

Q: Will the government provide a list of artifacts expected to be created and/or maintained for each system? E.g., BIA, IRP, PIA, etc.

A: Yes.

Q: Will the government clarify monthly, quarterly, annual metrics that shall be tracked and reported?

A: Yes.

Q: Will the government clarify if the total estimated price range for this procurement $630,000.00 – $650,000.00 is for one year or does it include base and option years?

A: The estimated price range identified in the RFQ is for the total contract price across the entire period of performance. It includes the base and all options.

Q: Although not a scored factor and not a mandatory contractual requirement to subcontract with AbilityOne, could the Government clarify that each offeror must endeavor to describe proposed plans to utilize the AbilityOne program even if offerors are not partnered with AbilityOne?

A: No. There are no mandatory contractual requirements to subcontract with AbilityOne.

This section is not scored.

Q: Will the Government please consider providing metrics supporting the work activities across the various task areas in order to properly size the work and skill efforts?

A: At this time, the Government does not have that information readily available.

Q: Is there any insight that can be provided to the current vulnerability management process?

A: Vulnerability scans are done using a few different tools to include Big Fix and Tenable Security Center (Nessus). These reports are run by the ISSO, and solutions are prepared by the ISSO and delivered to the system administrators to bring into compliance.

Q: Are there any specific pain points or challenges that you’ve identified?

A: Ensure follow systems are kept up to date and in compliance while working alongside the system administrators and reporting to management any gaps or where assistance by management may be needed.

Q: Can the government provide an estimate of how many IT Security Policies and Procedures will need to be drafted and issued during the period of performance of the contract annually?

A: Less than 12 annually.

Q: Based on my reading of the RFQ, it seems to be for a single role (IT Security Specialist III).

Could you kindly confirm this or are there multiple roles involved?

A: This is a single role, IT Security Specialist III only.

Q: Is IT Security Specialist III the only role designated for ISSOs/A-ISSO? Additionally is there only 1 key personnel or is there more than 1 IT Security Specialist III designated as key personnel?

A: This is a single role and level III was chosen to obtain the minimum years of experience. There is a federal ISSO assigned currently for this FIMSA system and one other. Each position, the contractor and the federal employee will split the load by each being assigned to one FISMA.

Q: Is task 1 expected to be compliance support for the FISMA system/systems? And if so, generally how many compliance support staff is expected or historically been used?

Additionally, is the compliance staff additional to the ISSO or is this an additional duty of the ISSO on the project?

A: Yes. One staff only is needed and historically only one has been used along with a compliance team at the NWS Headquarters as the umbrella support role to all NWS FISMA systems. This is a normal duty of an ISSO and they work together with the system administrators to evolve local policies specific to the system.

Q: Is task 3 expected to be shared by existing support staff for the FISMA system/systems, or is it expected to be independent staff utilized for training? And if so, generally how training staff is expected or historically been used?

A: Shared by existing support staff. This is historically a joint effort with system administrators and the ISSO.

Q: Is task 4 expected to be for a team or staff to conduct the security control assessment of the FISMA system/systems, or is it expected for the ISSO to support the assessment team by providing artifacts and co-ordinating the assessments artifact collection and interviews with the assessment team? If this is for providing an assessment team, generally how training staff is expected or historically been used and is it desired for an assessment team to be provided under a separate sub contractor?

A: The ISSO will represent the FISMA system and provide artifacts to the assessment team while acting as the liaison to interface the system administrators with the assessment team.

Q: Is task 5 expected to be for a team to track and do Quality assurance of the FISMA system/systems POA&Ms, or is it expected for the ISSO to track and ensure POA&Ms are closed on time? If the expectation is for a POA&M quality assurance team generally how training staff is expected or historically been used?

A: It is the sole responsibility of the ISSO to track POA&Ms, including meeting deadlines for closure. Quantity assurance is managed at the national level.

Q: Is task 6 expected to be for a project manager or project management team or is it expected for the ISSO to fulfill these duties? If the expectation is for a Project Manager or team generally how many project management staff is expected or historically been used?

A: The ISSO will work with local IT and act as the subject matter expert in security compliance.

Q: “Factor 2 – Personnel Experience + Resumes: The Offeror shall also provide at least three (3) project descriptions detailing the similarity and relevance of the contractor employee’s prior experience to the subject requirements.” Question: Will the Government accept CPARS?

How does the Government intend to verify prior experience?

A: No. CPARS (Contractor Performance Assessment Reporting System) or past performance are not evaluation factors. The Evaluation of experience will factor in the length and degree of experience in the relevant technical areas.

Q: “CAR 1352.237-75 KEY PERSONNEL (APR 2010): (a) The contractor shall assign to this contract the following key personnel: ● IT Security Specialist III; (TO BE DESIGNATED AT AWARD)” Question: Please explain what is meant by “TO BE DESIGNATED AT AWARD”, Because under Factor 2 – Personnel Experience + Resumes, the Key Resume is required at Proposal Submission, Not Award: For the individual designated as Key Personnel, the Offeror shall provide a resume which clearly demonstrates the extent that the personnel meets or exceeds the required minimum qualifications.

A: This is place-holder language since a specific, named individual to fill this role has not been selected yet. Upon award of the contract to the most successful offeror, we will either replace the “TO BE DESIGNATED AT AWARD” language in the clause with the name of the individual employed by the successful offeror, or we will include an attachment to the contract identifying this individual by name.

Q: Will the Government extend the proposal due date to Aug 31?

A: The Government does not anticipate extending the solicitation due date at this time.

Q: What is the anticipated start date of this project?

A: In accordance with CAR 1352.270-70 PERIOD OF PERFORMANCE (APR 2010) of the RFQ, the anticipated start date is planned for 15 September 2023.

Q: Is the contractor position under this RFQ (IT Security Specialist III) subject to Wage Determination/SCA?

A: Yes. The applicable Wage Determination number is 2015-5681.