Attachment_4_Questions_and_Answers.pdf

SP7000-16-Q-0038 Attachment 4: Questions and Answers

Questions and Answers

Q1. When it comes to the removable hard drives the boxes for 9.6.1.1 are not ticked. We can offer removable hard drives but do not offer lockable cabinet doors. Will this be required and sufficient?

Could you maybe give a bit of background to better understand the requirement?

A1. This section was not checked because it is not required. Locked Hard Drive STIG quoted:

STIG ID: MFD08.001 Rule ID: SV-7030r1_rule Vuln ID: V-6805

Discussion:

If the hard disk drive of a MFD can be removed from the MFD the data on the drive can be recovered and read. This can lead to a compromise of sensitive data.

The IAO will ensure the device has a mechanism to lock and prevent access to the hard disk.

Check Content:

The reviewer will, with the assistance of the SA, verify that the device has a mechanism to lock and prevent access to the hard disk.

What we are looking for here is a locking mechanism with a key securing the hard drive or the case access to the hard drive. The lock will be locked or this is a finding.

Note: This is not required if physical security measures are in place, if the drive is not easily removable, if drive is encrypted, or if there is zeroization or other strong protection mechanism.

Fix Text:

If the lock is not locked, lock it.

If there is no lock see if the vendor makes one and if so acquire it an lock the drive.

If the vendor does not supply a lock, acquire an aftermarket lock that will secure the drive so that it cannot be accessed. Even a drive that cannot be removed but the connectors can be removed is vulnerable.

IA Controls:PECF-1, PECF-2

Q2. Section 11.2.3.1 Secret Internet Protocol Router Network (SIPRNet) Token: The contractor shall supply a SMARTCARD PKI Solution with SIPRNet token capability, which is compliant with DoD requirements for PK-enabling and interoperability as set forth in DODI 8520.02/8520.03. The contractor shall provide card readers that are capable of reading and processing all approved SIPRNet token cards.

Support Systems that incorporate the use of PKI for encryption of information in transit or at rest. Be compatible with 3.3 volt SafeNet SC650 token. Compatible with the 90Meter Middleware solution for CAC known as CAC Smart Card Manager-90. The contractor shall maintain compliance with DOD wide SIPR and DOD PKI standards, and support all approved physical cards and firmware during the full lease period Question: Please note that the SIPRNET configurations do not include a card reader at this point - but maybe later. The card reader needs to be supplied by the customer at this stage. Will this be acceptable for DLA?

A2. This is a required part of the contract; the card reader shall be supplied by the vendor.

Q3. Section 1.2 All deliveries or services provided under this contract require a Customer Acceptance Form (attached) be signed and dated by the DLA Document Services’ customer. Upon completion of any installations, deliveries, relocations, removals, maintenance services, or any support action, the contractor will provide the receiving customer with the Customer Acceptance Form, for their signature as a means of consent by the receiving agency/command that the action was completed. This Customer Acceptance Form will be signed to include the following: (1) Activity Name, (2) Model and Serial numbers; (3) date of removal; (4) removal locations (to include building numbers, room numbers, (5) Information Assurance Managers (IAMs) or their designated assignee’s name, phone numbers, email addresses and their validating signature confirming receipt of the devices status. This Customer Acceptance Form must be submitted to the DLA Document Services Point of Contact within 10 calendar days of completing the install/removal.

Question: Could the Customer Acceptance Form be limited to document deliveries, installations, relations & removals and exclude maintenance services or support actions and exclude standard maintenance calls and support actions?

A3. The Customer Acceptance Form is required for all items specified in the SOW.

Q4. Section 1.3 Invoices will be submitted via Wide Area Work Flow (WAWF) and will include the Installation Report and spreadsheet with the serial numbers and locations of each device on a monthly basis. Invoices will be in United States Dollars. The first invoice will not be paid unless the installation report spreadsheet referenced in Paragraph 6.2 of the Statement of Work has been provided. No Invoice will be approved without a fully completed spreadsheet and the signed Customer Acceptance Form.

There will be no interest penalty incurred by the government for delay of payment due to a vendor delay in providing the Installation Report.

Comment: Our invoice process is automated. We can only generate standard invoices that will be transferred via a defined interface. If requested we can provide you an example. The invoice will include a device list with the monthly fee. This is also our current process. We can provide the customer Acceptance Forms for installations, deliveries, relocations and removals separately - but only at the time of the event.

Question: Will this be accepted?

A4. Invoices need to be submitted through WAWF and the documentation listed is needed.

Q5. Section 1.4, the final invoice must include the Removal Report referenced in Paragraph 2.5 of this Statement of Work. Failure to provide the Removal Report will result in an invoice rejection. The government will not pay the final invoice until such time as the Removal Report has been furnished

IAW Paragraph 2.5. There will be no interest penalty incurred by the government for delay of payment due to a vendor delay in providing the Removal Report.

Question: What will happen if a device goes missing and cannot be removed? Does this effect the whole invoice? What are the steps from DLA to ensure that every device can be removed (e.g. correct and up to date local POCs, availability of local POCs for pickups etc.?)

A5. If a device is missing, document the Removal Report that it is not in the location that was given on the delivery schedule and verify there were no modifications to the contract that moved the device IAW Section 8 of the SOW.

Q6. Section 2.4.1 Upon termination or expiration of the contract, the hard drive and/or any component containing residual data, will be removed by the vendor/contractor and turned over to DLA Document Services (or its designated assignee) and provide written verification to the designated DLA Document Services Point of Contact (POC) . In all cases where the customer or DLA Document Services requests to own the hard drive at the term of the contract and at time of removals, the contractor, as part of their quoted price, shall provide a replacement hard drive to ensure equipment is fully operational.

Question: We understand by this, that if a device is removed and the hard drive is removed that the end customer has the right to keep the hard drive? Is this correct or does this include additional things?

A6. The customer has the right to keep the hard drive.

Q7. Section 4.1 Maintain each device at a minimum 95% monthly available rate based on the 21 standard federal work days in a month. Maintaining the devices includes, but is not limited to, preventive maintenance, repairs, troubleshooting, connectivity and maintenance as required, to correct hardware and software malfunctions within 10 business days, and to mitigate high risk findings identified by customers running DOD approved network scanning tool as well as all associated labor and travel.

Question: Could the availability rate be changed to

a) Maintain the average (instead of each) device at a minimum…

b) 95% yearly (instead of monthly) available rate…?

A7. The SOW will not be changed for this particular requirement but it will be taken into consideration for future requirements.

Q8. Section 6.1 Provide to the designated DLA Document Services (POC) a quarterly usage report in electronic (Microsoft compatible) format on the total and average monthly production volumes by serial number for all devices. Quarterly usage reports are due each December, March, June and September within 15 business days after 3 months of usage is completed. In addition, the DLA Document Services (POC) may request adhoc usage reports by serial numbers.

Comment: In order to provide accurate date, the devices would either be connected and provide automatic meter reads or every end user needs to report the monthly print volume of each device to a defined format to a defined email address. Otherwise the usage can only be estimated based on the last service calls.

Question: Can this be organized by DLA? Or could Point 6.1 be deleted from this request as we are talking about fixed flat rates.

A8. No and Point 6.1 cannot be removed.

Q9. Section 6.3 Provide service history reports containing frequency of service calls, production volume between repairs, type of repairs, parts required, and device down time to the designated DLA D (POC) within 5 business days upon request for information.

Comment: To organize the data means a lot of efforts as it can only be done per single device.

Question: Could the request be limited on “problem” devices only?

A9. NO

Q10. Section 6.6 The contractor shall report all contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the Defense Logistics Agency via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address: http://www.ecmra.mil/.

Reporting input will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, beginning with 2014. Contractors may direct questions to the help desk at: http://www.ecmra.mil/.

Comment: We are with our current IT Infrastructure not able to generate a labor report.

Question: Could Point 6.6 be deleted from the SOW?

A10. No, this is a requirement under the DLAD 37.103-90(e)(1)

Q11 Section 9. Devices & Configurations/ Volume Bands page 16-24/9.1.4.9 Equipment must be capable of operating using standard U.S. office 120/220 volt 15 amp 60 Hz AC electrical current or U.S.

office 120/220 volt 20 amp 60 Hz AC electrical current. No transformers will be used as an exception.

In the event the later (20 amp) is offered, the Contractor will clearly identify these models in proposals and in all price lists.

Have electrical power capability and power cable/plug as checked:

220 VAC 50Hz Identify Power Plug Part Number Require Comment: We currently have a gap in our 220V TAA compliant product portfolio. This affects 25% of the devises in this contract. It applies for all volume bands that require a minimum speed of 30 ppm or faster color or a minimum of 40 ppm or faster b/w. We are working hard on fixing this but are not sure if we can meet your timeline to come up with a “perfect” solution.

Question: To close this gap we would like to make two suggestions:

a) Would it be possible to use transformer for the critical volume bands?

A 11a. No,

b) Could the speed requirements for the VB be lowered? The devices are able to handle the higher volumes as the required.

A 11b. No these are standardized speeds.