Amendment 005 Questions and Responses.pdf

Amendment 005 Solicitation SB1341-12-RP-0005

The purpose of this amendment is to provide responses to questions posed by potential offerors. The questions and their responses are detailed below:

Questions & Responses

1. Can offerors provide a 3 page Executive Summary section at the beginning of the proposal that is not counted in page count?

Response: Yes. Offerors may provide an Executive Summary at the beginning of the proposal, in the Technical Volume. This Executive Summary is limited to five (5) pages in length.

2. Is the ISSO at Boulder (Key), a permanent position for the duration of the base year, or will he or she only be placed on contract for the 7-month duration of Task Order One?

Response: Any contractor personnel on task order one are only required to work for the duration of task order one. The base period of the IDIQ contract is simply the base “ordering” period.

3. On page 78 of 82, Volume II Business Volume, item B. requests us to provide a ceiling number of hours. In order that all competitors be judged equally on price, we request the government provide the ceiling number of hours.

Response: NIST will provide a response to this question as soon as possible through a forthcoming amendment to the solicitation.

4. On pages 76 Volume I A.1, A.2, A.3, A.4, the government “excludes diagrams and graphics” from the page count. Please confirm this is correct. If correct, how would the government like competitors to verify page count within designated limits?

Response: See response to Question 12 of Amendment 004 to the solicitation.

5. On page 9 of 82, the PWS states “the contractor shall be able to provide at least four Key

Personnel contract employees for each individual task order”. On page 76 of 82 (4.ii, Task Order

1) “the offeror must assign, at a minimum, one contractor employee as key personnel . . . at the NIST Gaithersburg and Boulder campuses”. Please clarify (1) the number of key personnel per task order and (2) the number of key personnel resumes required to remain compliant with section 4.ii, Task Order 1.

Response: The IDIQ PWS states that for each task order, the contractor shall be able to provide at least four (4) Key Personnel contract employees. This simply states that the contractor shall be able to do this. For Task Order one, NIST is requiring that the contractor assign, at a minimum, one contractor employee as key personnel at the NIST Gaithersburg campus and one as key personnel at the NIST Boulder campus. For Task Order one, it is up to the Offeror how many employees they propose to assign as key personnel, as long as those minimum requirements are met.

6. Is there a minimum and maximum number of past performance questionnaires required?

Response: See response to Question 6 of Amendment 004 to the solicitation.

7. Page 12 of 82, Section V. Contractor Personnel Requirements, paragraph 2 states . . .IAW an Individual Development Plan (IDP). For candidates and key personnel who are currently under an IDP, if the IDP is included with their resume – would this go against page count?

Response: No, an Individual Development Plan (IDP), if provided, should be submitted with the resume of the respective candidate, and the resumes (including the IDP) will not be counted against the page limits.

8. On page 7 of 82, Section B.3 Labor Categories & Rates, the government requests base hourly labor rates. On page 2 of 82, SF 33 under Unit Price the government indicates a QTY 1.00 – LO Not To Exceed requirement. Does the government want contractors to provide a single hour labor rate here? We are concerned about the binding legal ramifications of doing so as this is both FFP and LH , per Section III Contract Type as shown on page 10 of 82.

Response: Section B.3 indicates that the chart shown there is where the accepted fully burdened hourly labor rates for each applicable labor category will be inserted. These labor rates are for the base IDIQ contract, and the contractor, upon award of the IDIQ contract, will be required to adhere to those labor rates when submitting a proposal for future task orders upon request by the Government. Because this is an IDIQ contract, the CLINs on page 2 of the solicitation document need not be filled out. The Business Volume of the Offeror’s proposal should contain all pricing information to be evaluated.

9. Are there predefined LCATS? If yes, what are they?

Response: If “LCATS” means labor categories, then no, there are no predefined LCATs.

Vendors should propose the LCATs they deem necessary to get the work done.

10. Assuming contractor is prohibited from using any non-NIST issued HW, will equipment and access be provided for all personnel that may work offsite?

Response: Contractor personnel are expected to work onsite, with the exception of occasional teleworking that may be granted by the government, and government furnished equipment will be provided for this work.

11. Since this is a TO based IDIQ, will there be awards to multiple contractors?

Response: NIST intends on awarding one IDIQ contract to a single prime contractor.

12. Can key personnel be proposed by contingent hires? If yes, what are the documentation requirements?

Response: The following response is given assuming that “contingent hires” means the Offeror will hire the candidate if the Offeror is awarded the IDIQ contract. If an Offeror proposes key personnel employees for Task Order one and the Government accepts the Offeror’s proposal, the Offeror is required to adhere to their proposal, as it is a legally binding document.

13. Can NIST provide info on how often Task Orders will be issued?

Response: Task orders will be issued on an as-needed basis throughout the period of the IDIQ contract.

14. Paragraph VIII, Place of Performance, states that the contractor shall submit a proposal for non-local travel. Is NIST considering any travel costs as part of the overall ceiling value of this IDIQ and if so, should we include anticipated travel costs as part our pricing volume?

Response: Occasional travel between Boulder, CO. and Gaithersburg, MD may be needed on an as needed basis. Additionally, short-term travel may be required during the period of performance to perform assessments of prospective vendors that may provide services to the government.

15. Can NIST provide a list of potential places where travel may take place and how often travel might be anticipated?

Response: Occasional travel between Boulder, CO. and Gaithersburg, MD may be needed on an as needed basis. Additionally, short-term travel may be required during the period of performance to perform assessments of prospective vendors that may provide services to the government.

16. The RFP states “Contractor personnel that work directly on task orders under this contract must obtain and maintain a professional security certification (e.g. CISSP, GIAC, CAP)…” Does the security certification have to be from these three or can it be any type of security certification such as CEH, Security+, FITSP-M/D/O/A, CISM, CISA, SDSO, ISSE, etc..

Response: The list of security certifications provided is not all inclusive and should be considered examples of the types of certifications that would meet the government’s requirements.

17. Can you provide clarification on the requirement to staff a base period and the first TO? Are these concurrent or separate requirements? Do you anticipate that there will be base personnel assigned throughout the POP, such as the PM? If yes, how many?

Response: There is no requirement to staff the base period of the IDIQ contract. On page 76, the Base Contract section of the instructions states “The Offeror shall provide its Staffing Plan. The Staffing Plan shall identify the Offeror’s proposed labor categories for the base contract, and describe the minimum skills and experience required for each proposed category. The labor categories and their minimum skills and experience requirements will be incorporated into Section B of the contract upon award.”

18. Can you clarify how you anticipate the bids to be constructed, specifically for firm fixed price for the task orders when a number and size of the task orders is not provided?

Response: The instructions provided for preparing the proposal for Task Order one is an indication of how the proposals will be required to be constructed for future task orders. The type of task, whether it be labor hour of firm fixed price, may potentially change this structure.

19. Can you provide an accurate system count, to include size of systems, and the anticipated number of TOs associated with the number/size of systems?

Response: A list of systems is provided on page 15 of the RFP. Details regarding these systems will be provided upon award, as necessary based on work performed.

20. Can you confirm the incumbent(s) on the task and provide the number of incumbent personnel on the current task?

Response: The incumbent is KT Consulting Inc. The current task order includes five contractor personnel.

21. Each subsection of the Technical/Management approach speaks to a page limitation. In each instance the RFP states “This subsection is limited to X pages in length, excluding diagrams and graphics. The Government will not evaluate any pages after the X page of this subsection.” This is a bit confusing. We respectfully suggest designating an upper page limit that would include all diagrams and graphics.

Response: Please see response to Question 4 of this amendment.

22. The Task A summary states, “contractor may be responsible for part of or all of the security documentation, in accordance with NIST A&A templates… that will be provided by NIST…” (page 11 of 82). In addition, the description of Deliverables #a states, “Security Authorization Package for NIST IT systems. Format: Completed NIST-provided templates stored on the secure share drive.” In order to accurately evaluate the complexities of the NIST Assessment & Authorization work, would the government provide the referenced A&A templates and any related operating procedures? If sending the templates is not a viable option, is there a web address where the templates can be downloaded or viewed?

Response: NIST A&A templates are considered sensitive and will be provided upon award.

However, all templates and operating procedures align with latest versions of NIST Special Publications (SP), including but not limited to SP800-18, SP800-37, SP800-53, SP800-53A, SP800-60.

23. Would it be possible to get some further clarification regarding key personnel? On page 9 of 82 (page 1 of 8 of the IDIQ PWS) it states that the contractor shall be able to provide at least four Key Personnel contract employees for each individual task order. However, the level of effort required for individual task orders my reach up to ten Key Personnel contract employees.

However, on page 57 of 82 (page 5 of 10 of the Task Order 1 PWS) it states: The Contractor shall perform the majority of the task order onsite at NIST’s offices in Gaithersburg, MD, with one contractor key personnel employee working full time in Boulder. CO. On page 76 of 82, in section 4.ii. it states that: The Offeror shall provide a brief description of the key personnel staffing plan for Task Order 1. The Offeror must assign, at a minimum, one contractor employee as key personnel at the NIST Gaithersburg, MD campus and one contractor employee as key personnel at the NIST Boulder, CO campus. All three references state that the employee at Boulder will be identified as key. Regarding the personnel working at Gaithersburg, how many are actually required to be key, and is the requirement different for the IDIQ and Task Order 1?

Response: See response to Question 5 of this amendment.

24. Page 10: What security applications or tools does Government use in addition to Tenable Security Center and HP WebInspect, i.e., for continuous monitoring and FISMA compliance?

Response: No other major COTS applications are currently used.

25. Page 10: What applications or tools does Government use for Program Management or Task Order management, e.g., Microsoft SharePoint?

Response: Cyber Security Assessment & Management (CSAM), Microsoft SharePoint, Microsoft Word and Excel.

26. Page 10: What applications or tools does Government use for Knowledge Management?

Response: Microsoft SharePoint, Microsoft Word and Excel.

27. SF 33 page 2 of 82. Can you define LO?

Response: “LO” stand for “Lot.”

28. SF 33 Base Period quantity 1 asking for unit price and total amount, what are you looking for to be filled in? IDIQ labor rate? There are multiple labor categories, , this is not clear, please clarify. Vol II guidelines are clear what DOC wants. How does that correlate with what SF 33 wants?

Response: The Offeror shall include all pricing information in their business volume. The CLIN structure in the SF33 is provided strictly to show the structure of the IDIQ contract upon award.

The IDIQ contract is non-funded, and funds will only be obligated through task orders that are issued under the contract. Offerors should not include any pricing information in the CLIN structure on page 2 of the SF 33 because the ceiling amount has already been identified as $9,000,000.00 for the entire IDIQ contract.