RRB11Q041 - Logical Access Control - Amend A-1.docx

REQUEST FOR QUOTATION NO. RRB11Q041 8 | Page

LOGICAL ACCESS CONTROL

AMENDMENT A-1

A. This amendment is issued to answer questions received from potential offerors, corrects an administrative error in the solicitation and amends Attachment 1. NOTE: electronic submission of offers is encouraged.

Question

1. What specifically is the success criteria for the POTP stage in order to move into the next level of evaluation?

Answer

The RRB will evaluate the Contractor’s ability to complete the installation of the product into the RRB Active Directory Test Environment and successfully enable a test of up to 5 users at Test Environment workstations in that domain. The RRB evaluation of this POPT performance will be included in the technical assessment as an evaluative factor of (1) the LACS software’s capabilities and (2) the Offeror’s ability to provide and install a LACS solution in the RRB’s Active Directory environment. The POPT will be a portion of the Technical evaluation and not a pass-fail stage. Only offerors who decline to offer to conduct the on-site POPT would not be further considered for award.

Question

2. With respect to the expectations for actual integration activities, what specific use cases would the RRB like to have ‘proven’?

Answer

Attachment 5, “POPT Requirements” is hereby incorporated to provide specific use cases that RRB would envision from this RFQ.

The RRB evaluation of this POPT performance will be included in the technical assessment as an evaluative factor of (1) the LACS software’s capabilities and (2) the Offeror’s ability to provide and install a LACS solution in the RRB’s test environment. The POPT shall ‘prove’ successful installation of PIV Middleware to Test Workstations with SCCM, successful installation of PIV Middleware to Test Workstations directly without SCCM, PIV Card logical access logon for Test Workstations, and PIV Card logical access from a VPN Test workstation.

Question

3. Does the RRB have a test environment that may be utilized, and accessed remotely for set-up activities?

Answer

Yes, RRB has a test environment but the environment may not be accessed remotely.

Question

4. Are there rules of engagement, acceptable use policy, or guidelines for the XXX team when interfacing with the RRB systems, and to what extent must RRB staff be utilized/present while production or test systems are ‘touched’?

Answer

All personnel interfacing with RRB systems will be required to read and acknowledge their responsibilities as defined in the RRB Rules of Behavior for Information Technology Systems pamphlet.

RRB staff must be utilized/present while production or test systems are touched.

Question

5. What is driving the current requested schedule for completion?

Answer

The RRB requires completion of this project prior to end of year to complete other previously scheduled activities.

Question

6. What are the current PIV middleware products in place at at RRB?

Answer

The RRB has four (4) users with the ActivIdentity PIV Middleware product ActivClient for report submission purposes to outside systems.

Question

7. Assuming that there are not any PIV middleware products in place at RRB, is there a preference for a specific product?

Answer

There is not a preference for a specific product.

Question

8. Are there additional systems outside of AD, Cisco VPN and Microsoft outlook that the PIV needs to enable access for?

Answer

The RRB as stated in Section III desires to establish a single sign on capability to all internal systems. However the RRB at a minimum requires the above 3.

The scope of this procurement is to receive services and any requisite software/hardware to provide PIV Card Logical Access logon to PCs, Active Directory, PIV Card VPN remote access (Cisco), and functionality for secure email (signature and encryption) with Microsoft Outlook. Systems that are not necessary to achieve this objective are outside of the procurement’s scope. The RRB seeks solutions that support future efforts to fully leverage the PIV card, make better use of cryptographic capabilities, and automate and streamline capabilities to increase efficiency and improve security. Any value-added technical characteristics and functionalities beyond the scope of the procurement will be considered in the technical evaluation as stated in Section VI. D. 2. B. and Section V. B. 6. e. 2 of the RFQ.

Question

9. Are there any other "software" applications (existing or future) that RRB intends to bring under the PIV Card LACS purview ?

Answer

Additional “software” application integration information is not available at this time. The scope of this procurement is to receive services and any requisite software/hardware to provide PIV Card Logical Access logon to PCs, Active Directory, PIV Card VPN remote access, and secure email (signature and encryption) functionality

Question

10. Does RRB have any SSO infrastructure to provide seamless access to multiple applications to users who log into them once, using the PIV card?

Answer

The RRB does not have SSO infrastructure to provide seamless access to multiple applications to users who log into them once, using the PIV card.

Question

11. What impact does OMB M11-11 have on the planned integration with existing or future software applications at RRB?

Answer

RRB is a federal government agency which is governed by policy and directives issued by OMB.

Question

12. In order to accommodate the schedule outlined in the RFP, is RRB prepared with Microsoft System Center Configuration Manager (SCCM) installation in order to assist in the automation of the deployment to client workstations of the software?

Answer

Microsoft System Center Configuration Manager (SCCM) is installed in the RRB environment for deployment to client workstations.

Question

13. Is there an integrator currently working on the requirements at RRB? If so who is that integrator?

Answer

There is not a LACs integrator currently working on the requirements at RRB.

Question

14. The cover states that in order to be considered for award our offer must be received by your office no later than 11:00 a.m. local time on September 7, 2011. In the RFQ it states that “proposals shall be submitted on or before 12:00 Noon, Central time September 1, 2011.” For clarification, which date is the proposal due?

Answer

The due date is September 7, 2011 at noon central time. (See B.2. and C. of this amendment)

Question

15. The Proof of Product Test (POPT), is that before or after award?

Answer

The POPT is can be scheduled between August 29 and September 7, 2011. Proposals are due September 7, 2011. Please review pages 38 through 45 of the solicitation.

Question

16. Currently, how are PIV cards provisioned to the active directory?

Answer

The GSA USAccess MSO Credential Program issues the RRB HSPD-12 PIV cards.

Question

17. Is the scope of this procurement to simply provide PIV card log on to Active Directory, PCs and for remote access or is the RRB intending to implement a fully compliant Federal Identity, Credentialing and Access management Roadmap and Implementation Guidance solution as directed by OMB M-11-11?

Answer

The scope of this procurement is to receive services and any requisite software/hardware to provide PIV Card Logical Access logon to PCs, Active Directory, PIV Card VPN remote access, and secure email (signature and encryption) functionality. The RRB seeks solutions that support future efforts to fully leverage the PIV card, make better use of cryptographic capabilities, and automate and streamline capabilities to increase efficiency and improve security. Any value-added technical characteristics and functionalities beyond the scope of the procurement will be considered in the technical evaluation as stated in Section VI. D. 2. B. and Section V. B. 6. e. 2 of the RFQ.

Question

18. Can you provide a government cost estimate for this procurement?

Answer

RRB will not provide a government cost estimate for this procurement

Question

19. Typically, the MOBIS schedule does not include products. Will the RRB accept a proposal utilizing our GSA IT Schedule 70?

Answer

RRB will accept an offeror’s proposal based on their GSA IT Schedule 70.

Question

20. Cover letter , Statement of Work, Page 39 of 45; “Technical Proposal,” section 6.d, and Statement of Work, Page 42 of 45; Section VI Evaluation and Award; Paragraph B.4 each state “Each prospective offeror must provide evidence that their product is FIPS 201 approved at the time of submission of the proposal. Offerors are cautioned that the Railroad Retirement Board will not consider a LACS solution unless it is on FIPS 201, APL.” Please note that systems used to manage PIV cards for use in logical access control systems, with the exception of middleware, are not evaluated under the FIPS 201 Approved Products List. Please see the list of technologies at http://fips201ep.cio.gov/index.php

Answer

The RRB understands that systems used to manage PIV cards for use in logical access control systems, with the exception of PIV Middleware, are not currently evaluated under the FIPS 201 Approved Products List.

Question

21. The SF1449 indicates this acquisition is a Request For Proposal (RFP) but the accompanying Statement of Work (SOW) suggests this is a Request For Quotation. Please clarify.

Answer

An administrative error indicated RFP instead of RFQ. This is a Request for Quotation.

Question

22. Statement of Work, Page 8 of 45; Section J reads as follows: “Project Completion

· RRB desires the Contractor to complete the LACS solution implementation by October 14, 2011.

· RRB requires the Contractor to complete the LACS solution implementation by November 18, 2011. “ Please clarify the apparent duplicate reference.

Answer

Please note the words “desires” verses “requires”. The RRB prefers that a contractor complete the LACS solution implementation by October 14, 2011. The contractor shall complete the LACS solution implementation by November 18, 2011.

Question

23. Statement of Work, Page 8 of 45; Section N describes Inspection and Acceptance. Please provide specific details of what this acceptance test is to address in terms of features and functionality.

Answer

The Testing and Acceptance process will include inspection and approval of the solutions’ successful implementation of features and functionalities to ensure all requirements as stated in Section III. of the RFQ are met. The solution shall enable 2-factor authentication for on-site and remote access of RRB users with GSA USAccess MSO Credential Program issued HSPD-12 PIV cards and existing smartcard readers.

Features and functionalities include successful installation of PIV Middleware to all workstations with SCCM, successful configuration of PIV Middleware on all workstations, successful PIV Card two-factor authentication and logical access on workstations, successful PIV Card two-factor authentication and logical access from remote system users equipped with RRB issued workstations, complete Active Directory (AD) integration for the entire RRB Forest and subordinate domains, and complete integration into Microsoft Outlook, including the ability to digitally sign and encrypt electronic mail messages with PIV certificates.

Question

24. Statement of Work, Page 37 of 45; Section RRB Supplemental Instructions to Offerors, paragraph 2 indicates Proposals shall be submitted on or before 12:00 Noon, Central time September 1, 2011. However the SF 1449 indicates proposals are due on September 7, 2011 with no time indicated. Please clarify.

Answer

See answer to question 14

Question

25. Statement of Work, Page 6 of 45; General Requirement C. “The Contractor’s solution shall integrate seamlessly into the existing RRB network. This shall include but not be limited to, all integration factors specific to the offeror’s product, such as and not limited to, a method of Certificate Authentication, deployment at the Active Directory, network server, and desktop workstations.” Please define what operating system is in used for your user workstations and for Active Directory.

Desktop workstations and laptops – Microsoft Windows XP, for RRB Domain Active Directory – See Attachment 1 Question

26. Statement of Work, Page 6 of 45; General Requirements, “The contractor’s PIV Card Logical Access Control Systems solution must include, but not be limited to.” How many applications are in use today? What platforms do they run on? Will additional applications be added in the future? If so, can you provide an estimate of how many applications will be added? Will you provide a document similar to Attachment 1 that identified all of the applications used within the RRB enterprise that would be accessible through the proposed LACS?

Additional application integration information is not available at this time. Also, see answer to question No. 17.

B. The following provisions of the solicitation are hereby revised to read:

1. Section III.A. - “The contractor shall provide RRB non-exclusive, non-transferable perpetual license to use their computer software program for (6) six administrators and (1,194) eleven hundred ninety-four users, inclusive of their solution, shall provide all devices, cables and support systems, including but not being limited to: installation, and configuration of equipment, software, peripherals, and other components. The solution shall enable 2-factor authentication for on-site and remote access of RRB users with GSA USAcess MSO Credential Program issued HSPD-12 PIV cards and existing smartcard readers.” (See answers to question 14, 24 and Item C. of this amendment)

2. Section V.B.2 - Proposals shall be submitted on or before 12:00 Noon, Central time September 7, 2011. Mark outside of the envelope “RRB11Q041 Enclosed” and offeror’s name and address. Address package to: U.S. Railroad Retirement Board, Acquisition Management-Procurement, 844 North Rush Street, Chicago, IL 60611-2092.

3. Attachment 1 - Information Technology Overview – RRB has been revised to include the agencies desktops.

C. The hour and the date specified for receipt of offers remains September 7, 2011, noon, central time. Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation as amended above by completing and returning 1 copy of this amendment.