AMENDMENT 0009 TO RFQ SP3300-20-Q-0053.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

1. CONTRACT ID CODE

2. AMENDMENT/MODIFICAITON NO. 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQ. NO. 5. PROJECT NO. (If applicble)

7. ADMINISTERED BY (If other than Item 6) CODE

STANDARD FORM 30 (REV. 10-83)

Prescribed by GSA FAR (48 CFR) 53.243

FACILITY CODE

9A. AMENDMENT OF SOLICIATION NO.

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NO.

10B. DATED (SEE ITEM 11)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended, is not extended.

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a)By completing items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment your desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPIRATION DATA (If required)

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER

NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15C. DATE SIGNED

15A. NAME AND TITLE OF SIGNER (Type or print)

16C. DATE SIGNED

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

PAGE OF PAGES

6. ISSUED BY CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code) (X)

CODE

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

16B. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

NSN 7540-01-152-8070

Previous edition unusable

Amendment 0009 SP3300-20-Q-0053

Amendment No. 0009 is incorporated into Request for Quote SP3300-20-Q-0053 and shall become a part of any resultant contract.

A) Following are questions about the solicitation that DLA Distribution received from a contractor, and DLA Distribution’s responses to those questions.

Contractor Statement: “The DLA’s technical requirement is comprehensive, but there are some sections where clarification is necessary to ensure the contractors are providing equitable level of effort to ensure mission objectives are met. Specifically;”

1) “Does the scope of the work effort require a full NIST RMF support effort to obtain an ATO? See section 3.4.G for language that would make it seem so.”

DLA Distribution Response: The requirement is for the Contractor to complete the Cybersecurity Assessment Checklist that DLA J6 will provide upon award, additionally, to keep all DISA STIGs applicable to the system compliant, and comply with NIST Special Publication 800-82.

2) “Does the scope of the work effort require the drafting of all Policy and Procedure documents to support obtaining an ATO or does it primarily just entail creation/update of the SSP and PPP? (i.e. -DR, IR, CM, etc.) Section 2.1.C seems to only be providing SSP and PPP where section 3.4.G conflicts and appears to require the entire ATO.”

DLA Distribution Response: As stated in the PWS, the Contractor shall be responsible for hardening the applications in compliance with the latest STIGS and NIST Special Publication 800-82. The Contractor shall provide all documentation including the Software (firmware) Security Plan (SSP) and Program Protection Plan (PPP) required for a favorable cybersecurity assessment (Authority to Connect (ATC) or similar using the DLA Level 1 Cybersecurity Assessment (LCA) Process) for all application installs/upgrades. The Contractor shall work closely with a Government assigned Information System Security Manager (ISSM) reviewing the SSP, PPP and other STIG/NIST requirements.

3) “Is there a preferred cadence for performing vulnerability scans and for ongoing patching OS and software/firmware on systems and devices? Section 2.1.C refers to DLA Level 1 Cybersecurity Assessment (LCA) Process.”

DLA Distribution Response: Upon award, the LCA checklist states the methods in which the scans and patches shall be conducted through. The requirement is for the Contractor to complete the Cybersecurity Assessment Checklist that DLA J6 will provide upon award. All systems must be compliant with DISA STIGs and NIST Specialist Publication 800-82 as stated in Section 2.1c. As stated in other responses, DLA uses the LCA checklist/process to ensure that all systems are compliant after this process and checklist and completed then reviewed and approved by J6.

B) The hour and date specified for receipt of quotes is not extended and remains as 4:00 PM Eastern local time on July 2, 2020.

ACQUISITION OPERATIONS (J7)

430 MIFFLIN AVENUE SUITE 3102A

NEW CUMBERLAND, PA 17070 - 5008

717-770-6030 daniel.herring@dla.mil

SEE ATTACHED PAGE 2 OF 2.