Amendment 004 Questions Responses.pdf

Amendment 004 Solicitation SB1341-12-RP-0019

The purposes of this amendment are as follows:

1. To provide a copy of the Past Performance Questionnaire Template, from Section J.3 of the RFP, in Microsoft Word format at the request of multiple vendors; and

2. To provide official responses to questions submitted by potential Offerors. The questions responded to in this amendment are the only questions received immediately following the Pre-proposal Conference that was held on April 27, 2012. As stated in previous amendments, only questions that are answered via official amendments to the solicitation will have an effect on the solicitation. Any questions that were verbally presented at the Pre-proposal Conference, but not submitted in writing as potential Offerors were instructed to do, will have no effect on the solicitation. The questions and their official responses are presented below.

Questions & Responses

Question #1 Section of RFP: J.2 Task Order 1 PWS Page of RFP Referenced: 91 Paragraph of Page: Table Row 3 Description of Question: “JIRA is referenced as the Change Control/Ticketing solution in place at NIST. Please describe any organizational standards that recommend or mandate specific Application Lifecycle Management (ALM) tools and/or subcomponents of an ALM solution for the following functions: Requirements Management, Process/UML/Data Modeling, Configuration Management, Change Management, Project Management/Analytics, Defect Tracking, Trouble Tickets and Testing. If there are no organizational standards in place, please describe the current environment for the functions listed above.”

Response: For the NVD JIRA is used for Requirements Management, Change Management, Defect Tracking, Trouble Tickets and Testing. There are no standards in place for Process/UML/Data Modeling, and although it is not the only means of communicating and documenting the relevant information, Microsoft Visio is often used for this purpose.

Configuration Management is accomplished through a combination of Maven, subversion, and documentation. There are no standards in place for Project Management/Analytics.

Question #2 Section of RFP: PWS for ITL, Section II Requirements Page of RFP Referenced: 29 Paragraph of Page: Task 3 Description of Question: What database modeling, ETL, and reporting tools are currently in use?

Response: Microsoft Visio is used for database modeling. Data is usually brought into the database through programs written in the Java programming language to process XML formats.

Reports are available through a web interface with software developed using the Java programming language.

Question #3 Section of RFP: PWS for ITL, Section II Requirements Page of RFP Referenced: 31 Paragraph of Page: Task 10 Description of Question: What process modeling, workflow, and document management tools are currently in use?

Response: Currently CSD is using the Kentico Content Management system for internal document management and NIST uses Common Spot for content and web management. Process modeling is conducted using several Entity Relationship Design Tools and models including Visio. Workflow is conducted internally using the Department of Commerce EApproval system but the division currently does not use or own an internal workflow commercial tool.

Question #4 Section of RFP: J.2 Task Order 1 PWS Page of RFP Referenced: 83 Paragraph of Page: II.b Description of Question: What programming, database, and/or scripting skills are needed to support each of the following: SCAPVAL, XCCDF and OVALDI reference implementations?

Response: SCAPVAL requires expertise with the Java programming language, working XML files, and using XSL. XCCDF requires experience with the Java programming language and working with XML files. OVALDI requires experience with the C/C++ programming language.

Question #5 Section of RFP: Section C Page of RFP Referenced: 28 Paragraph of Page: n/a Description of Questions:

Is there an incumbent currently performing tasks outlined in the RFP?

Response: We have been using a Department of Defense contract, for which Booz Allen Hamilton has been the prime contractor.

Question #6 Section of RFP: Sections L and M Page of RFP Referenced: Multiple Paragraph of Page: n/a Description of Questions:

Keith, during the pre-bid conference, it was mentioned you would post the past performance questionnaire in word format. Can you please do that soon? Also, the RFP clearly states that Specialized Experience will take into consideration the experience of the sub contractors.

However, the Past performance section does not state that. We would like to provide past performance questionnaires of our sub contractors (as well as ours), because much of the experience will be with them (which is why we have asked them to be part of our team). Could you confirm, by amendment if needed, that past performance questionnaires may be submitted for sub contractors as well?

Response: I have provided the Past Performance Questionnaire in Word format in this amendment. To answer the second part of the question: Offerors should submit past performance questionnaires for the prime contractor and any key subcontractors. The Government will evaluate both Factors C and D (Specialized Experience and Past Performance) for the prime contractor and any key subcontractors.

Question #7 Section of RFP: H.17 (6) Page of RFP Referenced: 52 Paragraph of Page: 6 Description of Question: It is our understanding that NIST will provide the required functions at no cost to the contractor in order for the SAC, NACI or other security requirements to be met.

This section mentions “sponsor” or Office of Security so we are presuming that NIST Office of Security will provide these required background checks on our behalf and provide the required “sponsorship”. Please confirm.

Response: The NIST Office of Security will be the required Sponsor for all required HSPD-12 PIV Badges to access NIST facilities. NIST Office of Security will sponsor the required background checks on behalf of the support contractor.

Question #8 Section of RFP: J.3 = Part I & Part II Past Performance Questionnaires Page of RFP Referenced: 92-99 Paragraph of Page: All Description of Question: Will NIST provide these two templates in MS Word format so that we can electronically complete the forms and also electronically submit these to our references?

Response: Yes, the complete Past Performance Questionnaire (Parts I and II) is attached to this amendment.

Question #9 Section of RFP: B. 2 Schedule of Labor Rates Page of RFP Referenced: page 23 of 127 Paragraph of Page: First paragraph and following table Description of Question: RFP states “The following is a schedule of the fully burdened hourly labor rates to be applied to each labor category under this IDIQ contract. When submitting a quotation or proposal for a task order under this contract, the Contractor must propose a fully burdened hourly labor rate that does not exceed the ceiling labor rate listed below for the corresponding labor category.”

However, the included table has no entries for ceiling rates. Did the Government intend to provide ceiling rates or are these ceiling rates to be proposed by the Contractor?

Response: The ceiling rates are to be provided by the Offeror in its Business Volume. Section B.2 is written as it currently is to show the Offerors what the resultant contract will look like.

The awardee’s agreed upon ceiling fully burdened hourly labor rates will be inserted into the table in Section B. 2 upon award.

Question #10 Section of RFP: G. 5 IDIQ Contract Information, Para C Task Orders, Page of RFP Referenced: page 39 of 127 Paragraph of Page: sub-paragraph 2 Description of Question: In the paragraph describing procedures for the issuance of task orders should there be multiple IDIQ contracts awarded as a result of the solicitation, sub –paragraph a describes streamlined procedures for task orders that exceed $3000 but are less than $5Million.

In sub-paragraph b the government describes procedures for task orders in excess of $5 Million.

The current explanations are confusing. Will the Government clearly explain the differences in the two procedures?

Response: These requirements are taken from FAR 16.505. To obtain a more clear understanding, you may read this section of the FAR. However, the main different between the ordering procedures for order that exceed $3,000 but are less than $5 million versus orders in excess of $5 million, are that for orders that exceed $3,000 but are less than $5 million, the contracting officer need not contact each of the multiple awardees under the contract before selecting an order awardee if the contracting officer has information available to ensure that each awardee is provided a fair opportunity to be considered for each order and the order does not exceed $5 million. The competition requirements in FAR Part 6 and the policies in FAR Subpart

15.3 do not apply to the ordering process.

This response does not change any terms or conditions of the solicitation as written. It is only provided as clarification.

Question #11 Section of RFP: H. 6 Security Requirements for Information Technology Resources Page of RFP Referenced: page 44 of 127 Paragraph of Page: Paragraph (i) Description of Question: RFP states “For all contractor-owned systems for which performance of the contract requires interconnection with a DOC network on which DOC data will be stored or processed, the contractor shall provide, implement, and maintain a System Accreditation Package in accordance with the DOC IT Security Program Policy. “

Does the government intend to require the any contractor-owned systems to interconnect with a DOC network on which DOC data will be stored or processed?

Response: We do not intend to have any contractor-owned systems to interconnect with a DOC network for this contract.

Question #12 Section of RFP: L. 4 Proposal Preparation/Submission Instructions Page of RFP Referenced: page 11 4 of 127 Paragraph of Page: Paragraph A Management Approach, 1. Recruitment and Retention Plan Description of Question: RFP states in the last lines of this paragraph “This subsection is limited to ten (10) pages in length, excluding diagrams, tables and graphics. The Government will not evaluate any pages after the tenth page of this subsection.”

How does the Government want bidders to present diagrams, tables and graphics so that they can be excluded from the page count?

Response: Diagrams, tables and graphics can be incorporated where they are relevant in the proposal. To avoid any uncertainty, offerors can present each diagram, table, or graphic on a single page. This will make it easier to count 10 pages of text of the proposal.

Question #13 Section of RFP: L. 4 Proposal Preparation/Submission Instructions Page of RFP Referenced: page 11 4 of 127 Paragraph of Page: Paragraph A Management Approach, 3. Program Manager for IDIQ Contract Description of Question: RFP states in the last lines of this paragraph “The Offeror shall provide a resume and a brief description that demonstrates the candidate’s experience with similarly-scoped contracts and demonstrates that he or she meets or exceeds the minimum qualifications for this position. The resume may be submitted as an attachment, and the description of the candidate’s qualifications and experience is limited to two pages in length..”

The Government specifies a 2 page limit for the brief description of the Contract Program Manager’s experience but not for the resume. Is there a page limit for the Program Manager’s Resume?

Response: There is no page limit for the resume.

Question #14 Section of RFP: L. 4 Proposal Preparation/Submission Instructions Page of RFP Referenced: page 115 of 127 Paragraph of Page: Paragraph B Technical Approach, 3. Key Personnel for Task Order 1 Description of Question: The RFP states , “The Offeror may provide a one-page description of their Key Personnel for Task Order 1. However, the resumes may be submitted as an attachment to the Technical Volume.”

Does this mean one page for each key person, or a total of 1 page for all Key personnel?

Additionally, how many pages are allowed for each of the attached Resumes for Key Personnel for Task Order 1?

Response: The one-page description of the key personnel is a page limit for a description of all of the key personnel being proposed. However, there are no page limits on the resumes for each key personnel resume that will be attached.

Question #15 Section of RFP: J.2 Task Order 1 PWS Page of RFP Referenced: 83 Paragraph of Page: II.c Description of Question: What programming, database, and/or scripting skills are needed to support each of the following: National Vulnerability Database Code base, National Checklist Program Website, and software reference implementations?

Response: NVD and NCP both require Java programming experience. MS SQL Server is currently to store the data. Some legacy portions of the NVD are still written in the Adobe ColdFusion language. Software reference implementations are currently most commonly implemented using the Java programming language, but there are some implementations which require knowledge of C/C++. Other programming languages will be used if they are determined to better meet the requirements of the particular reference implementation.

Question #16 Section of RFP: J.2 Task Order 1 PWS Page of RFP Referenced: 78 Paragraph of Page: 6.II.a Description of Question: Please list the names of all applications available in the NIST environment along with their architecture diagrams. What are the tools and technologies used for each application? What are the future plans for technology enhancements in the NIST environment?

Response: The National Vulnerability Database is the application available in the NIST environment. The NVD uses the Java programming language, accompanying JEE5 software libraries, and JSF. Some legacy portions of the NVD are still written in the Adobe ColdFusion language. Some requirements are implemented using Adobe Flex with communication to the data through a REST service layer implemented in Java. Future plans are to finish transition away from Adobe ColdFusion, and to integrate the Kentico CMS which will support the public web interface. The Kentico CMS will then access the data through a REST service layer implemented in Java.