Amendment 007 Questions Responses.pdf

Amendment 007 Solicitation SB1341-12-RP-0019

The purposes of this amendment are as follows:

1. To provide official responses to questions submitted by potential Offerors. The Government is working on official responses to several remaining questions submitted before the deadline for submission of questions, and will post an amendment as soon as possible with those responses.

The questions and their official responses to the present questions are presented below.

Questions & Responses

Question #:1 Section of RFP: J.3 Page of RFP Referenced: 92 Paragraph of Page: n/ Description of Question: The RFP requires that the Part I be completed by the contractor and Part II will be completed by the client and sent directly to NIST. Is there a preferred way to identify the Past performance so that it is clear to which Team submission this applies?

Response: Part II of the questionnaire has a block for the name of the contractor being evaluated.

Question #: 2 Section of RFP: J.2 Page of RFP Referenced: n/a Paragraph of Page: n/a Description of Question: Task Order 1 references the requirement for on-site support several times. Can you provide information on the number of on-site personnel anticipated for this task?

Response: NIST has provided the estimated total number of labor hours and the number of required key personnel for task order 1. It is up to the Offerors to estimate from there the division of their proposed staff.

Question #: 3 Section of RFP: n/a Page of RFP Referenced: n/a Paragraph of Page: n/ Description of Question: For bidding purposes, the standard contractor man-year is 1920 hours. Is that the case for the proposal?

Response: For task order 1 of this RFP, Offerors shall assume a standard labor year is 2,080 hours.

Question #: 4 Section of RFP: n/a Page of RFP Referenced: n/a Paragraph of Page: n/a Description of Question: For the purposes of the response, we have selected members for our team. Is there any prohibition on adding specific members after award?

Response: It depends on if the “selected members” are key personnel on the first task order or base contract, or if they are not key personnel. The requirements of the key personnel clause should be reviewed.

Question# 5 Section of RFP: Section B- SCHEDULE OF LABOR CATEGORIES Page of RFP Referenced: 7 Paragraph of Page: 3 Description of Question: Is the program manager needed to be an onsite resource 100% as a mandated requirement by the government?, if not what is the minimum onsite presence required to successfully conduct the program?

Response: Each offeror needs to determine the best level of on-site PM engagement relative to his/her technical solution and labor mix.

Question# 6 Section of RFP: J, Performance Work Statement: Task Order 1- Security Automation Services Page of RFP Referenced: 84 Paragraph of Page: 2.III Description of Question: What is the scope of SCAP release planned (IR 7511 Rev 4?) for the first 6 month as part of the TO1?

Response: The document is expected to mature from ‘draft’ to ‘final’ status. This will include resolving outstanding comments from the feedback period, quality assurance, and document preparation for processing through the NIST Washing Editorial Review Board (WERB).

Question# 7 Section of RFP: J, Performance Work Statement: Task Order 1- Security Automation Services Page of RFP Referenced: 84 Paragraph of Page: 2.I Description of Question: We understand through references provided, SCAP is applicable for windows platform only, For the SCAP release planned, is there a scope for non-windows platform validation as part of this release?

Response: SCAP is applicable to windows and non-windows platform. The SCAP validation program also provides validations for Red Hat Linux. USGCB SCAP content is posted on the NCP for Red Hat Linux. The SCAPVAL utility used for content validation can evaluate SCAP content for a variety of platforms supported by the OVAL-DI and OCIL reference implementations including both windows and non-windows platforms and applications.

Question# 8 Section of RFP: J, Performance Work Statement: Task Order 1- Security Automation Services Page of RFP Referenced: 84 Paragraph of Page: 2.II.b Description of Question: Is the offeror expected to provide an initial compliance validation testing service as well before it is sent to the third party vendor for the validation? If so can this be done offsite?

Response: Some of the reference implementations discussed in 2.II.b are used in the SCAP validation program by NVLAP accredited laboratories. The offeror is expected to ensure the reference implementation(s) properly implement the specifications (i.e that SCAPVAL correctly implements the NIST Special Publication 800-126.)

Question# 9 Section of RFP: Section C

Page of RFP Referenced: 29 Paragraph of Page: Task 3 Description of Question: It is stated “Service may also include the need for identification and authentication mechanism to control access to applications”. Does the government want the offeror to implement any specific technology for Identity and Access Management? Also since there seems to be multiple applications, is there a need for Single Sign on (SSO)? If so, any specific technology mandated such as SAML2.0?

Response: NIST may have a requirement for implementing an access control mechanism for identification and authorization to applications created in support of task 3, but only as identified in future task orders. NIST will use the PIV/HSPD-12 card for an identity credential that will be used for the tokens for identification and tokens used for authorization. This is the only technology specifics for requirements of this task.

Question# 10 Section of RFP: Section J, PAST PERFORMANCE INFORMATION QUESTIONNAIRE FOR

SOLICITATION NO. SB1341-12-RP-0019

Page of RFP Referenced: 76 Paragraph of Page: 2 Description of Question: If one or more of the reference did not respond at all or did not respond in a timely manner on the past performance Questionnaire, what is the impact of this on the selection of the offeror?

Response: The Government will only evaluate the past performance questionnaires (both parts I and II) that are submitted by the response deadline given. However, Offerors are reminded that no record of past performance will not result in the Offeror being evaluated favorably or unfavorably on past performance.

Question #: 11 Section of RFP: J. 3 PAST PERFORMANCE QUESTIONNAIRE Page of RFP Referenced: 92 - 99 Paragraph of Page:

Description of Question: Can we use past performance of our subcontractors when submitting the Past Performance Information Questionnaires?

Response: Yes.

Question #: 12 Section of RFP: J. 3 PAST PERFORMANCE QUESTIONNAIRE Page of RFP Referenced: 92 - 99 Paragraph of Page:

Description of Question: If we are permitted to use our subcontractors past performance, how should the Offeror (Prime Contractor) be identified in the submission of the questionnaire from the subcontractors reference?

Response: Offerors should make it as clear as possible on the first page of Part I and the first page of Part II what the name of the prime contractor is. However, NIST will not “eliminate” or “disregard” questionnaires that do not do so. This is just for clarity purposes, and Offerors will not be penalized if this is not done.

Question #: 13 Section of RFP: L. 4 PROPOSAL PREPARATION/SUBMISSION INSTRUCTIONS

Page of RFP Referenced: 116 Paragraph of Page: 1 Description of Question: Is there a minimum or maximum number of past performance references and questionnaires that should be included in the response?

Response: Please read the response to Question 8 of Amendment 006.

Question #: 14 Section of RFP: C Page of RFP Referenced: 29, 31 Paragraph of Page: 3, 3 Description of Question: Please clarify the difference between the deliverables and technology customers for Task 4 and Task 11. We interpret Task 4 as delivering technical expertise to support NIST professionals by developing tools for end users access content of NIST guidance, and Task 11 as operational support to technology used in ongoing NIST business management. Is that correct?

Response: Tasks 4 and 10 are for internal CSD business processes. Task 11 is for design, development and use of reference materials used by external stakeholders and customers to access and use CSD deliverables.

Question #: 15 Section of RFP: M Page of RFP Referenced: 126 Paragraph of Page: 2 Description of Question: For purposes of price evaluation, or the IGCE, has NIST prepared any estimated hours estimates for each of the required labor categories. If so, please provide it so that we can better understand the likely mix of work and offer the most reasonable pricing.

Response: Please read Section 2. Scope of Work, Subsection IV in the Task Order 1 PWS. The estimates for the labor hours required for Task Order 1 are given there. The Government will not provide any further estimates for the labor hour requirements.

Question #: 16 Section of RFP: M / Amendment 006 Page of RFP Referenced: 126 / Question #33 Paragraph of Page: N/A Description of Question: In Amendment 006 Question #33 NIST states “The evaluation of Factor E for the IDIQ contract and Task Order 1will focus on whether the proposed rates are fair and reasonable and consistent with the Offeror’s technical and management approaches.” Can the government elaborate on their basis for “fair and reasonable”?

Response: The FAR provides contracting officers with many different ways to determine whether a price is fair and reasonable, including competition, empirical pricing data, among others.

Question #: 17 Section of RFP: M / Amendment 006 Page of RFP Referenced: 126 / Question #33 Paragraph of Page: N/A Description of Question: In Amendment 006 Question #33, NIST statement “The evaluation of Factor E for the IDIQ contract and Task Order 1will focus on whether the proposed rates are fair and reasonable and consistent with the Offeror’s technical and management approaches.” Does NIST intend to utilize salary standards, such as Government Service (GS) levels or salary surveys such as those performed and published by the Bureau of Labor and Statistics (BLS) that are generally accepted as baselines for salary data in their determination of “fair and reasonable”? If so, which standards or data sets?

Response: See response to Question 16 above.

Question #: 18 Section of RFP: M / Amendment 006 Page of RFP Referenced: 126 / Question #14 Paragraph of Page: N/A Description of Question: In Amendment 006 Question #14, NIST responds with the statement “As stated in the RFP, The Offeror’s fully burdened hourly labor rates must reflect the current market labor rates with any discounts provided.” Can NIST please provide the market rate source they intend to use for evaluation?

Response: Each offeror is responsible to propose what he/she considers competitive, fair and reasonable rates in the current marketplace.

Question #: 19 Section of RFP: C / Pre-Proposal Conference Page of RFP Referenced: 29, 31 Paragraph of Page: 3, 2-3 Description of Question: During the pre-proposal conference and the overview of the eleven task areas NIST described Task Area 4 as being internally focused on NIST CISD business processes (to summarize). Later in the briefing the NIST representative corrected himself and offered that it was Task Area 10 or 11 that we more internally focused. It was not clear to us if this applied to both Task Area 10 and 11 or just one of them. Please clarify specific to all three Task Areas (4, 10 and 11).

Response: Tasks 4 and 10 are for internal CSD business processes. Task 11 is for design, development and use of reference materials used by external stakeholders and customers to access and use CSD deliverables.

Question #: 20 Section of RFP: J.3 Page of RFP Referenced: 85 Paragraph of Page: 2. IV.

Description of Question: Does the estimated hours to perform the task (11,700 for base period and 23,400 for option year) match the current incumbents hours on task, (23,400 per year)? If not, how many hours did the incumbent spend on task, per year?

Response: NIST will not provide a response to this question.

Question #: 21 Section of RFP: J.3 Page of RFP Referenced: 85 Paragraph of Page: 2. IV.

Description of Question: How many total annual labor hours are assumed for a full time employee?

Response: See response to Question 3 of this amendment.

Question #: 22

Section of RFP: J.3 Page of RFP Referenced: 85 Paragraph of Page: 4.

Description of Question: Approximately what percentage of work under Task Order 1is expected to require on site resources versus remote resources?

Response: It is up to the Offerors to determine the most suitable division of labor among their proposed staff.

Question #: 23 Section of RFP: J.3 Page of RFP Referenced: 85-86 Paragraph of Page: 5. and 6.

Description of Question: Please clarify the relationship between the General Tasks identified in Paragraph

5. and the Specific Tasks identified in Paragraph 6.

Response: General tasks further narrow the scope for this particular task order. Specific tasks provide an even narrower scope than the general tasks.

Question #: 24 Section of RFP: J.3 Page of RFP Referenced: 87 Paragraph of Page: 6. III. b.

Description of Question: Is there a typo in the first bullet item? Should it read as two bullets:

• SP800-61 rev2 (the current version of SP800-61)

• SP800-150 – a new NIST Special Publication focused on “(inter-organization) Coordinated

Incident Handling”

Response: Yes, this is a typo. There should be a total of 4 bullets under this section with the 2nd bullet starting with SP800-150 as you have noted.

Question #: 25 Section of RFP: J.3 Page of RFP Referenced: Various starting on page 88 Paragraph of Page: Various Description of Question: For Task Order 1, Exactly what tasks are required to be done on-site and which ones can be done remotely.

Response: The on-site/remote requirements are dynamic depending on the current task and phase and will be determined by the government task leads. For Specific tasks I, and II, onsite work is expected with the ability to telework as directed by the government task lead. Specific task III has a greater degree of flexibility; however, the government task leads will determine the need for on-site vs. remote activity.

Question #: 26 Section of RFP: J.3 Page of RFP Referenced: 92 Paragraph of Page: 3rd column of table, top row.

Description of Question: Task III.A of Page 92 state: Alpha, Beta, and Final Webservice posted to NVD following the posting procedures as defined by the NVD development task lead. Is the NVD development task lead referring to a NIST employee or one from the awardee of the TASK Order. If from NIST, is it possible to get a summary of those procedures?

Response: The NVD development task lead is a NIST employee. The procedures for posting new code to production webservers follows industry standard practices of unit testing, testing in a sandbox environment that mirrors the production environment and post deployment testing.

Question #: 27 Section of RFP: J.3 Page of RFP Referenced: 89 Paragraph of Page: 2nd row on table, task I.A.

Description of Question: For Task I.A, is it correct that no verification is to be done on the CVE/CCE data streams provided.

Response: The NIST analysis work stated in Task I.A includes verification of the data streams received from MITRE Corporation.

Question #: 28 Section of RFP: J.3 Page of RFP Referenced: 90 Paragraph of Page: I.E Description of Question: For Task 1.E of Task Order 1, For USGCB content, is production of VHDs part of the responsibility of the contractor? If so, will the government provide GFE or should the contractor plan for building that lab?

Response: No, the contractor is not responsible for creating the VHD; however, the contractor is responsible for verifying the correctness of the VHD. The government will provide GFE for the verification process.

Question #:29 Section of RFP: J.3 Page of RFP Referenced: Various starting on page 88 Paragraph of Page: Various Description of Question: Is the contractor to supply any software or equipment for Task Order 1, or is all of the equipment to be GFE?

Response: All equipment is GFE.

Question #: 30 Section of RFP: J.3 Page of RFP Referenced: 87 and 92 Paragraph of Page: III.B, middle of page Description of Question: Paragraph III.b. on page 87 of the PWS describes a new NIST IR on the generic handling of both online and insider threat issues. However, the page 92 on the PWS contains a chart that calls for a NIST SP on Online Incident Handling. Is it an IR or SP?

Response: The exact document type is not yet decided. Our expectation is that it will be a Special Publication; however, the final determination will be made by NIST management.

Question #: 31 Section: L.3

Paragraph of Page: Volume II .A

Description of Question: There is a statement on the RFP: “Offerors are asked to consider reduction or elimination of costs/pricing of the escalation of labor hour rates during the performance period of this contract.” What does that statement mean?

Response: The Government is asking Offeror to reduce or eliminate any escalation in their labor rates from one contract period to the next. So, for instance, from the Base Period of the contract to Option Period 1.

Question #: 32 Section of RFP: Section L Page of RFP Referenced: N/A Paragraph of Page: N/A Description of Question: Would the Government accept a two-page executive summary, outside of the other sections’ page count?

Response: Offerors can submit an executive summary of up to two pages; however, it will not be evaluated/rated.

Question #: 33 Section of RFP: J.2 Task Order 1 PWS, 2. Scope of Work Page of RFP Referenced: 77 Paragraph of Page: 7 Description of Question: What specific areas of Task 9 are in the scope of work for Task Order #1?

Response: The PWS for TO 1 provides sufficient details of the requirement.

Question #:34 Section of RFP: Section L - VOLUME II – BUSINESS VOLUME Page of RFP Referenced: 117 Paragraph of Page: B Description of Question: The RFP states, “The pricing information for this task order shall show the derivation of the proposed ceiling price.” Can you please give us the Governments definition of derivation.

Response: This statement simply means that Offerors shall show how they arrived at their ceiling price.

Question #: 35 Section of RFP: L.4 Proposal Preparation / Submission Instructions Page of RFP Referenced: 116 Paragraph of Page: D. Past Performance Description of Question: Is there a page limit for Past Performance narratives (exclusive of Part I of the Past Performance questionnaire)?

Response: There is no page limit to the Past Performance Questionnaires. We can use any other sources of contractor evaluation data, including NIST personnel’s experiences within the last 36 months.

Question #: 36 Section of RFP: L.4 Proposal Preparation / Submission Instructions

Paragraph of Page: D. Past Performance

Description of Question: The RFP states “The Offeror shall submit Part I of the questionnaire with its proposal as an attachment to Section B of the Technical Volume.” As we understand, the Past Performance is part of Section D not Section B. However, does the Government intend that Part I of the questionnaire shall be an attachment to the overall Technical Volume?

Response: Yes, the Past Performance Questionnaires should just be submitted as an attachment to the overall Technical Volume. It is acceptable for them to be attached to any of the sections included in the Technical Volume, as long as it is clearly marked and visible.

Question #: 37 Section of RFP: General Page of RFP Referenced: N/A Paragraph of Page: N/A Description of Question: Can we include an Executive Summary in our response? If yes, what is the page limit for the Executive Summary?

Response: See response to Question 32 of this amendment.

Question #: 38 Section of RFP: I. 50 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO

IMPLEMENT STATUTES OR EXECUTIVE ORDERS--COMMERCIAL ITEMS (MAR 2012)

Page of RFP Referenced: 71 Paragraph of Page: b.17 52.219-6 52.219-14, Limitations on Subcontracting (Dec 1996) Description of Question: The referenced FAR clause states: “At least 50 percent of the cost of contract performance incurred for personnel shall be expended for employees of the concern.” Is the “concern” the prime contractor or a combination of all proposed small business team members?

Response: The concern is the prime contractor.

Question #: 39 Section of RFP: B Page of RFP Referenced: 6-22 Paragraph of Page: Schedule of Labor Categories Description of Question: From reading the entire RFP, it doesn’t appear that you are requiring resumes for all 19 listed labor categories but are leaving it up to the offeror to include as many or as few as they like, beyond those of key personnel that are specifically asked for in the RFP, especially since the resumes can be included as attachments and not count towards the page limitations. Is this true or do you want resumes for all 19 labor categories?

Response: For the base contract, the Government only requires the resume of the Program Manager for the entire IDIQ contract (see Section L.3, A. Management Approach, 3. Program Manager for IDIQ Contract). For Task Order 1, the Government requires the resumes of the proposed key personnel for this task order.

Question #: 40 Section of RFP: B Page of RFP Referenced: 6-22 Paragraph of Page: Schedule of Labor Categories Description of Question: If resumes are to be included, whether required or discretionary, are there any page limitations for individual resumes (i.e., not to exceed two pages each, or three pages each, etc.)? The RFP doesn’t specify.

Response: There are no page limits for resumes.

Question #: 41 Section of RFP: L Page of RFP Referenced: 114 Paragraph of Page: A. Management Approach, subparagraph 3. Program Manager for IDIQ Contract Description of Question: The requirement states that a resume is required for the IDIQ contract Program Manager but it doesn’t specify any page limitation for that resume, only that there is a two-page limitation for a “description of the candidate’s qualifications and experience” and that the resume can be included as an attachment. So there are several questions here, some mutually exclusive:

a. Is there a page limitation for the resume itself? Some resumes for people this qualified can run on for 9 or 10 pages.

b. If the resume is included in the body of the text (i.e., not as an attachment), does it count toward the 2-page limit?

c. Does the description of the candidate’s qualifications and experience have to be a narrative apart from the resume (in the same font and type size as the rest of the text) or can it be included in the resume as a summary paragraph and then have that, along with the rest of the resume, fill the 2-page limit?

d. If the answer to 4c above is that the candidate’s qualifications and experience has to be a separate narrative apart from the resume, can that narrative be repeated as a summary paragraph in the resume, or do you want the resume’s summary paragraph to be a different narrative?

Response: a: No page limit for the resume itself. B: If the resume is included in the body of the text, it does not count towards the page limit. C: This description can be included as a summary paragraph with the resume. D: N/A.

Question #: 42 Section of RFP: L Page of RFP Referenced: 115 Paragraph of Page: B. Technical Approach, subparagraph 3. Key Personnel for Task Order 1 Description of Question: The requirement states that the offeror must provide a minimum of three key personnel—i.e., Project Manager (Task Order Level), Lead Vulnerability Analysis Specialist, and Developer (Lead)—but can propose additional key personnel if it so desires. Then the requirement states, “The Offeror may provide a one-page description of their Key Personnel for Task Order 1.” Does that mean one page per proposed key personnel for a minimum of three pages, or that all key personnel must be described on one page total, presumably as a paragraph each?

Response: It means that all key personnel must be described on one page total. It is expected that the resumes of the key personnel will provide much of the information required for evaluation.

Question #: 43 Section of RFP: L Page of RFP Referenced: 115 Paragraph of Page: B. Technical Approach, subparagraph 3. Key Personnel for Task Order 1 Description of Question: Again referring to the resumes of key personnel—is there a page limit for each individual resume (i.e., not to exceed two pages each, or three pages each, etc.)?

Response: No

Question #: 44

Section of RFP: L

Paragraph of Page: D. Past Performance Description of Question:

a. Is there a limit to the number of past performances that can be submitted? The RFP doesn’t specify.

b. Is there a minimum number of past performances that should be submitted (e.g., three)? The RFP doesn’t specify.

c. Is there a page limit for individual past performances (i.e., not to exceed two pages, or not to exceed three pages, etc. per past performance)? The RFP doesn’t specify.

d. If there is a limit on the number of total past performances and the offeror has a subcontractor, how many past performances should be from the Prime and how many from the Sub? For example, if a total of three past performances were required, would it be preferable for two to be from the Prime and one from the Sub, or could the Prime submit one and the Sub submit two?

Response: A: No, this was specified in an earlier amendment. B: No, this was specified in an earlier amendment. C: No. D: It is up to the Offeror how many questionnaires they decide to submit for the prime and/or subcontractors.

Question #45 Section of RFP: Amendment_004_Questions_&Responses Page of RFP Referenced: page 5 of 6 Paragraph of Page: Question #12 and Corresponding Response Description of the Question: The Government’s response as provided in Amendment 004 (text provided in text box below) was related to the Management Approach, 1. Recruitment and Retention Plan Description. Is the Government’s response regarding tables and graphics applicable to the entire Technical Volume, or just to the section cited in the question?

Response: For the entire Technical Volume: diagrams, tables and graphics can be incorporated where they are relevant in the proposal. To avoid any uncertainty, offerors can present each diagram, table, or graphic on a single page.

Question #46 Section of RFP: L.4 PROPOSAL PREPARATION/SUBMISSION INSTRUCTIONS Page of RFP Referenced: page 113-115 Paragraph of Page: N/A

Question #12 Section of RFP: L. 4 Proposal Preparation/Submission Instructions Page of RFP Referenced: page 11 4 of 127 Paragraph of Page: Paragraph A Management Approach, 1. Recruitment and Retention Plan Description of Question: RFP states in the last lines of this paragraph “This subsection is limited to ten (10) pages in length, excluding diagrams, tables and graphics. The Government will not evaluate any pages after the tenth page of this subsection.” How does the Government want bidders to present diagrams, tables and graphics so that they can be excluded from the page count?

Response: Diagrams, tables and graphics can be incorporated where they are relevant in the proposal. To avoid any uncertainty, offerors can present each diagram, table, or graphic on a single page. This will make it easier to count 10 pages of text of the proposal.

Description of the Question: Will the Government accept a 2-3 page Executive Summary for the Technical Volume—excluded from page count as defined in Section L?

Response: See response to Question 32 of this amendment.