RRB16Q0020_A001_RMF_Answers_to_Potential_Offeror's_Questions_Attachment._2_Final.docx

Solicitation No. RRB16Q0020, Amendment A001 Page 1 of 3 Attachment 2 (Answers to Potential Offerors Questions)

Risk Management Framework (RMF) Strategy and Related Services

A. Potential offeror questions, and RRB answers, are incorporated into solicitation RRB16R0020 as follows:

1. Is this a SB set-aside? FBO has N/A next to set-aside.

Answer: No, RFQ No. RRB16R0014 is not set aside for small business. RFQ No. RRB16R0014 is hereby updated and issued with full and open competition.

2. Is there an incumbent? If so, who is the incumbent, and how much was that contract?

Answer: That information is available at www.usaspending.gov, under contract no. RRB12C008.

3. How many contractors were on the incumbent’s team, and what are the labor categories?

Answer: That is proprietary information, and the RRB will not provide that information. See RFP Section II.B.

4. Are there any additional requirements from the incumbent’s contract compared to this new contract?

Answer: The current requirements are stated in RFP Section III. However, the RRB encourages potential offerors to read the RFP in its entirety.

5. The testing is determined to be onsite. Will all the other work be onsite at RRB in Chicago?

Answer: The RRB anticipates that the majority of contract performance will occur off site.

6. How many key personnel, and what are they?

Answer: RFQ section V.B.6.1.b. requires the contractor to designate key project positions.

7. In Section II, should 0001EB, 0001EC, and 0001ED have a period of performance date of 10/01/2020-09/30/2021?

Answer: Yes. Section II, sub-CLINs

8. In addition to the RRB Internet SharePoint, does RRB use any other system of records (such as CSAM)?

Answer: The RRB currently uses SharePoint for all systems of records.

9. How many of the systems have been transitioned to NIST 800-53 rev 4?

Answer: The RRB has transitioned the four information systems stated in the RFP to the latest NIST 800-53 rev 4 moderate controls.

10. When was the last time each system underwent a full authorization assessment?

Answer: The four information systems stated in the RFP have each received a full authorization assessment and are being monitored as per NIST 800-37 Rev 1 (Risk Management Framework) continuous monitoring.

11. When were the system environment descriptions and/or boundary descriptions last updated for each Information System?

Answer: System Environment descriptions and/or boundary descriptions are updated annually. The last update was performed in September 2015.

12. How many different types of user and admin accounts exist for each Information system?

Answer: The RRB does not view this question as relevant in reference to submitting responses to the RFQ. However, the RRB is willing to provide this information to the successful offeror.

13. How many different technologies are used in the infrastructure and application(s) (e.g. Citrix, Java, .NET, mainframe, RACF, OB2, Oracle, LDAP, Windows, Linux, Apache, IIS, etc.?

Answer: The RRB currently has Windows 2008 and 2012 servers, Windows 2007 desktops, IBM z/OS mainframe, RACF, DB2, SQL, Apple mobile devices and Linux appliances.

14. How many applications and databases are part of each Information System?

Answer: See answer to question no. 12 above.

15. Number of interconnections (to systems external to the subject system) for each Information System?

Answer: The RRB employs five interconnections for the general support system.

16. Are the systems accessible via VPN? If so, which services do they use?

Answer: Yes, the systems use Cisco AnyConnect.

17. Do any of the systems have publically accessible information? If so which systems and what type of information.

Answer: Yes, all publically accessible information is located on the general support system at an externally hosted site.

18. If the Information System is separated by internal firewalls and router filters, we must travel to more than one location to assess all components. How many facilities must we visit and what cities are they in, in order to conduct vulnerability scanning of all portions of the system?

Answer: It is anticipated that the successful offeror will only be required to travel to the RRB’s HQ’s facility, located in Chicago, Il.

19. Are any of these Information Systems A-123 systems?

Answer: The RRB is clarifying this question with the vendor that submitted the question. The RRB will respond to this question in Amendment A002.

20. Can the work be accomplished on contractor laptops or does RRB require the work to be done on RRB issued laptops?

Answer: The RRB requires that all vulnerability assessments be performed on RRB issued laptops. However, documentation may be completed on contractor laptops.

21. May offeror’s perform the subject contract remotely off-site?

Answer: See answer to question no. 5 above.

22. Q1: Ref: Section V Proposal Submission Instructions Document Number RRB16Q0020 PROCESSED Page 55 of 59- Are there any page limits for the Business Proposal Submission and Technical Proposal Submission?

Answer: No, there are no minimum or maximum page restrictions for business or technical proposal responses.