QUESTIONS SP3300-24-Q-5009 DDJC ESS 7.18.24.xlsx
XLSX spreadsheet 25 KB Posted
- Attached to
- Electronic Security System Maintenance Support Services, DLA Distribution San Joaquin, California
- Solicitation number
- SP3300-24-Q-5009
- Issued by
-
Defense Logistics Agency Distribution
About this file
This document is a compilation of questions and answers related to a federal contract opportunity for Electronic Security System Maintenance Support Services at the DLA Distribution San Joaquin, California (DDJC) location.
The key details are:
- The contract requires the contractor to provide technical services for the Lenel OnGuard Access Control System, Pelco CCTV, and Global Facilities Management Systems (GFMS) Key Control at DDJC. Services include installation, maintenance, operations testing, cybersecurity support, upgrades, patches, migrations, enhancements, inspections, and corrective/preventive maintenance.
- The Performance Work Statement outlines specific requirements such as personnel certifications, training, configuration management, cybersecurity, and transition support.
- There are clarifications provided on topics like patching responsibilities, scanning/remediation requirements, and network/authentication details.
- The solicitation number is SP3300-24-Q-5009 and the contract is being awarded by the Defense Logistics Agency Distribution.
View the file
Other files
Show all 14
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
SP3300-24-Q-5009 Questions
| Question # | Source Document | Subsection | Question | Government's Response |
| 1 | Attachment 1 - DDJC ESS Maintenance PWS | 12.0, Key Personnel | The Systems Administrator requirements state: Systems Administrator shall have certification that meets DoD 8140.03-M IAT-II Information Assurance Technical (IAT) and Computing Environment certifications. |
| Can DLA please provide a copy of the 8140.03-M and specify what LCAT the Systems Administrator maps to? | IT (Cyberspace) – DoD Cyber Exchange - This link will point you to the qualifications (KSATs) for Systems Administrators and Database Administrators and other work roles. A copy of the 8140.03-M will be provided by email. | |||
| 2 | Attachment 1 - DDJC ESS Maintenance PWS | 7.0, Training | The PWS states: The Contractor shall provide any necessary training to ensure the site is capable of operating and managing all ESS applications, HW/SW, equipment, or other system aspects as required. |
| How many site training sessions are expected each year and for how many personnel? | 8140 certs and qualifications are required for those personnel needing privileged access to a system or network. During the J62 and J61 review of PWS prior to solicitation, J61 helps determine what cybersecurity language (including 8140) is needed based on the requirements. We mostly see 8140 apply when the contractor is an application/system administrator and will need to get a DLA M and/or D account(s) to manage apps/servers/workstations. Therefore, the contractor shall provide proof that the administrator of the system has the required training/experience to maintain the ESS. | ||||
| 3 | Attachment 1 - DDJC ESS Maintenance PWS | 3.1.4, Enterprise Configuration Management | Request 21 days prior to changes? Does this ECM include patch management in the Cyber CM requirement? If so, this is going to mean that the system will always be a cycle behind. Unless it is our intent to mobilize to perform scans, demobilize, submit the request, and then remobilize to perform remediation. | The ECM does not include patch management. We do not submit ECRs to patch the system. This is used for version upgrades and hardware upgrades. The 21 day requirement allows for processing the ECR prior to the planned install/upgrade. Patches happen as the system administrator recognizes or is notified of vulnerabilities. | |
| 4 | Attachment 1 - DDJC ESS Maintenance PWS | 3.1.6, Work Schedule | "Non-scheduled" visits will be scheduled 5 days in advance...? | Some work will be done on a regular schedule, but there are some maintenance items that come up outside of those regular scheduled items, such as a vulnerability mitigation that may interrupt service. These type of non-scheduled maintenance visits require coordination 5 days in advance. | |
| 6 | Attachment 1 - DDJC ESS Maintenance PWS | 3.1.12, Transition Support | The PWS states a transition plan is due within 15 days of the request, however it isn't listed in Table 1: Deliverables. |
| Will the government add the transition plan to the deliverables table? | I do not believe that we need to add this to the deliverables table because it is only required if there is a transition from one contractor to another. Then, the current contractor will assist with transitioning support over to the new contractor. This will not be required if the contract never changes hands. | ||||
| 7 | Attachment 1 - DDJC ESS Maintenance PWS | 3.2 Task 2 | Will the contractor actually be patching the server OSes or will DLA be patching the OS via their centralized patch management solution? | The contractor will be patching the systems. J6 will only provide this support when applicable. For instance, the contractor may provide some support of their application on a database server, but the DB team does not allow the contractor to make any other changes. | |
| 8 | Attachment 1 - DDJC ESS Maintenance PWS | 3.2.2, Sustainment | The PWS states that a Sustainment Plan is required, but it isn't listed in Table 1: Deliverables. |
| Will the government add the Sustainment Plan to the deliverables table? | Sustainment Plan has been added to Table 1 Deliverables. | ||||
| 5 | Attachment 1 - DDJC ESS Maintenance PWS | 3.3.1, Application System and Network Requirements | Requiring 802.1 or port security "for authentication"... We would want to make sure that the author understands that port security doesn't provide authentication and to implement 802.1 we'd need an authentication appliance at the least. | It depends on what hardware we are talking about and where it will be connected. Most likely all that will need to happen is ESS mac addresses getting added to ISE. ESS is typically deployed on the ICS/OT network. DLA is currently NOT doing dot1x on ICS/OT. It is just MAC Address Bypass (MAB). | |
| 9 | Attachment 1 - DDJC ESS Maintenance PWS | 3.3.2, Information and Operational Technology Infrastructure Requirements | VM's? Are we intending to go nuts & bolts? | The PWS clearly states that J6 will provide VM's and OS's. If the vendor provides the 3 VM/hardware, it will become the property of DLA after it's configured. This paragraph does not state that we will provide all the nuts and bolts, but it outlines what DLA and the contractor will provide and be responsible for. | |
| 10 | Attachment 1 - DDJC ESS Maintenance PWS | 3.3.2.1.d, Information and Operational Technology Infrastructure Requirements | We assume that Trellix will be the required antivirus software vs McAfee which has been deprecated. Also, please clarify if ePO has been rebranded or if it is still the server-side software for Trellix. | McAfee was renamed Trellix, so everything is still basically the same. They still use ePO. | |
| 11 | Attachment 1 - DDJC ESS Maintenance PWS | 3.4, TASK 4 - CYBERSECURITY REQUIREMENTS | What's the difference between the listed architecture diagram and the authorization boundary? the Authorization Boundary is a component included in the network diagrams that we generate. | The Authorization Boundary is a different diagram than the Network Diagram. The contractor will be provided a template of both to help them complete the requirement. | |
| 12 | Attachment 1 - DDJC ESS Maintenance PWS | 3.4.2, Completion Of System Hardening (Scan/Fix/Scan) Testing and Analysis | Will the contractor actually be performing the vulnerability scans of the systems, or would that be performed by DLA? | If the contractor provides the HW/SW and the system is standalone, the contactor will scan the systems. There have been cases where the contractor configures the HW and needs to scan the system before connecting to the network. They scan and STIG before connection. Other than that, DLA will scan and the contractor will fix. | |
| 13 | Attachment 1 - DDJC ESS Maintenance PWS | 3.4.2, Completion Of System Hardening (Scan/Fix/Scan) Testing and Analysis | Will the DLA Windows/Database Team be performing/providing the Windows OS and Windows DB STIG Checklists? | Normally the DB Team will provide the configuration on the database VM, this includes the OS STIGs. | |
| 14 | CSS SP3300-24-Q-5009 | L29 Section 508 Requirements (OCT 2021) | The RFP states "Offerors shall complete the current revision of the Voluntary Product Accessible Template (VPAT) Rev 508", however the VPAT is not listed in the submission requirements for E-FILE III. |
| Are offerors required to submit a completed VPAT with the proposal response? | Procurement Note L29 is hereby removed. The offeror does not need to include a proposal for this. | |
| 15 | CSS SP3300-24-Q-5009 |
Attachment 1 - DDJC ESS Maintenance PWS Quote Preparation Instructions Agenda to FAR 52.212-2 Evaluation
12.0 Key Personnel
The instructions for E-FILE I state resumes for the Contract Project Manager (CPM) and System Administrator(s) positions must be submitted with the E-FILE I: Technical volume. The CPM resume, however, is not listed in the E-FILE I evaluation criteria or in the Key Personnel.
| If the CPM resume is required, will the government provide the Labor Category requirements for the CPM and the criteria by which the CPM resume will be evaluated? | Add to E-File I | |||
| 16 | Attachment 1 - DDJC ESS Maintenance PWS | 12.0 - Key Personnel | The PWS states that the Systems Administrator shall have certifications that meet DoD 8140.03-M IAT-II Information Assurance Technical (IAT) and Computing Environment certification requirements. |
| Can DLA please clarify what level (Basic, Intermediate, or Advanced) of foundational qualification is required? Additionally, what certifications will meet the environment specific requirements for the CE cert? | • | Minimum of seven (7) years of overall professional experience in the systems administration field with five years of overall experience in Microsoft Windows client and server operating systems. |
| • | Preferred - Minimum five (5) years of experience with electronic security systems, specifically hands-on experience in installing, configuring, maintaining, and resolving issues with Intrusion Detection Systems, Access Control Systems and Closed Caption TV, specifically with Lenel OnGuard. Preferred Lenel OnGuard Certified Expert (LCE) certification. |
Minimum Certifications See Section 11.3 “Privileged Access” for DoD 8570.01-M/DoDM 8140.03 certification/qualification requirements. They should met the requirements under the Basic column.
| 17 | Attachment 2 - Schedule of Supplies and Service | Cells E6-E8 | This specific cell indicates "Camp Carrol Korea Vertical Lift". Please confirm this is an inadvertent carry over and should, instead, reflect the Sustainment Services as outlined in the PWS. | This an administrative error and will be correct to "DLA Distribution San Joaquin - ESS Maintenance" |
| 18 | CSS SP3300-24-Q-5009 | CSS, E-FILE II, pg. 17 – Past Performance | a. Page 17, paragraph 12: Recent performance is defined as a contract that has performance within the last five (5) years from the date of this solicitation issuance. b. Page 17, paragraph 13: The vendor may submit up to three (3) recent (within 3 years of solicitation issuance). Question - Will the Government please clarify if Offerors may submit Past Performances within the last five (5) years or three (3) from the date of this solicitation issuance, as the RFQ appears to be a state both (5) years or three (3). | Recent performance hereby means within the last five (5) years. |
| 19 | PM Frequency | Attachment # 3 | Based on the attachement#3 PM Frequency document (PDF), There are multiple areas but for an example, it lists the BMS devices need to have # of PMs per year. They list the QTYs of 12x, 4x, and 1x while all of them have the same QTY of devices. Do you think we need to ask for clarification on these items or specifically write in our response that we will provide X number of PMs per year for each device to clarify? Again, there are multiple areas that they list the amount of PMs this way (Card readers, strikes, PIRs, duress, Etc) | J7-AB |
| 20 | PWS | General | The PWS states that the project as a whole is designated as CUI. With the series of deliverables and overall communications that will transpire, please confirm that all submitted documents require CUI markings. | Yes, all submitted documents require CUI markings. |
| 21 | N/a | General | Will the government provide the Lenel system ID number? | Yes |
| 22 | N/a | General | Is there an approved Network Time server or will we be providing one? | Yes, there is a network time server, but we have not been able to get the server info from LAN Management. |
| 23 | N/a | General | Is the system a CRN (Closed Restricted Network)? Sometimes it sounds like we may be connecting into an existing architecture. This can dictate the classification of the system which would inherit the classification of the host network and can affect the LoE. | No |
| 24 | N/a | General | If the system is a CRN, then are we providing a Domain Controller? In the absence of a DC, we would not have the ability to implement cyber security controls via Group Policy which would require me to implement the controls manually on every windows box. This would significantly impact the LoE for both initial configuration and the cyber security CM requirements. | No |
| 25 | N/a | General | If the system connects to a host network, is there a DC that the ESS will be a member of? If this is the case, we would need to have credentials to be able to manage group policies relevant to the ess OU (Organizational Unit) to perform cyber security CM tasks. | Yes, the system admin acknowledged there is one, but we have not been able to get the server info from LAN Management. |
| 26 | N/a | General | What shall we assume is the classification of the system? Typically, we would classify an ESS system as Low/Low. This will affect the LoE. | Our current FIPS 199 has the Lenel system rated at Mod-Mod-Low. |
| 27 | N/a | General | We have had some difficulty downloading the controlled documents. Is there any other way to obtain them? | Yes, if you need any of the documents please contact Steven Lesh at steven.lesh@dla.mil and request the documents. |
| 28 | N/a | General | Will a one-week extension be considered. | Yes, the solicitation will be extended. |
https://cyber.mil/wf-element-sub/it-cyberspace/
File details come from the government source that posted it. Updated .