SP7000-24-Q-0004 P0001 Attachment 1 Questions and Answers.pdf

DEFENSE LOGISTICS AGENCY

DLA CONTRACTING SERVICES OFFICE

5404 J AVENUE, BUILDING 404

NEW CUMBERLAND, PENNSYLVANIA 17070-5059

Questions and Answers

SP7000-24-Q-0004

1. If OEM/Large Businesses have direct relations with SAM they can do it cheaper and I’d be wasting my time and yours. Is it worth putting a proposal together?

Answer: This is an unrestricted Acquisition. All vendors will be given an opportunity to respond.

2. Would the Government consider revising the evaluation criteria from the Lowest Price

Technically Acceptable (LPTA) to the Best Value? This change would permit trade-offs between price and non-cost factors, allowing the government to assess proposals beyond merely the lowest-priced options. By adopting the Best Value approach, we can ensure the benefits justify any extra costs and remain competitive with other vendors' offerings.

Answer: No, the Government will be using the Lowest Price Technically Acceptable (LPTA) Evaluation Criteria. No value is realized when quotes exceed the minimum technical or performance requirements. DLA clearly and comprehensively defines its requirements. Each DLA requirement is set forth in meticulous detail explaining precisely what DLAs customer requires.

Additionally, were a quote to exceed DLA’s customers’ needs, DLA would realize at best extremely minimal value and more realistically no value. For example, based on Section III of the PWS, DLA’s requirements are separated into VBs. Some of the differences between VBs is speed (pages per minute or “PPM”) and estimated usage. As can be seen on PWS pages 3-4, VB3 devices require a minimum 45 PPM, VB4 devices require a minimum 50 PPM, and VB5 devices require a minimum 60 PPM. Because of this tiered-structure, DLA would realize no value if, for example, a holder offered a VB1 device that exceeds 25 PPM. Instead, DLA would satisfy its needs by going up to the next VB tier (VB2 in this example). Thus, there is no value added for quotes exceeding the stated requirements and specifications.

3. In the requirement stating that quotes must be submitted electronically to the points of contact listed below, does the term 'below' refer to the location specified in the FAR 52.212-1 Addendum on page 2, paragraph...? In other words, are the points of contact for submitting quotes actually listed above this section in the document?

Answer: This is a typographical error and should state: “Quotes must be submitted electronically only to the points of contacts listed above.” Quotes must be submitted to: Primary POC:

Contracting Specialist: Yvonne Cone, E-mail Address: yvonne.cone@dla.mil. Secondary POC:

Contracting Officer: Chad Parent, E-mail Address: chad.parent@dla.mil.

4. Would NPTU consider exempting devices from the locking mechanism requirement if they are equipped with AES256, the industry's strongest hard drive encryption, and have a Trusted Platform Module (TPM) chip that conforms to the ISO/IEC 11889 standard?

Given that the TPM chip ensures cryptographic keys are integrated, making the hard drive unusable in other devices, is this level of security?

Should the requirement for a locking mechanism remain, it will lead to delays in repair times, as service technicians will have to wait for NPTU personnel to remove their locking mechanisms before they can access the equipment for maintenance or repair?

Answer: NPTU IS&T requires a locking mechanism to prevent theft/removal of the hard drive as it has the potential to contain Classified information even if encrypted at AES levels. NPTU IS&T is sufficiently staffed to support the removal of the locking mechanism on demand if the locking mechanism needs to be temporarily removed. Removal of the locking mechanism has never delayed copier repair work during the period of the existing copier contract.

5. Would the government clarify whether the inclusion of an analog fax capability is a mandatory requirement for the equipment specified in the PWS?

There are sections within the PWS where fax functionality does not appear to be listed as a requirement. Is this an oversight or is fax capability intentionally not mandatory in certain areas of the PWS?

Given that analog fax presents a security vulnerability, it should not be a requirement.

Answer: NPTU IS&T does not require or desire fax capability on any of the copiers.

6. Will the Government confirm that compatibility with the Thales 930 card must be affirmed prior to the award?

If confirming compatibility is not a mandatory requirement, could the government provide a more detailed timeline for when this requirement needs to be implemented during the contract period?

Answer: Thales 930 card support must be provided by 3/1/25. Delivered copiers must support Gemalto IDPrime MD830B cards upon arrival as these cards are currently used on the existing copiers located at NPTU for network scanning.

7. Concerning the firmware updates for transitioning from the current CAC to the Thales ID Prime

930 Smartcard:

When are the firmware updates expected to be completed in relation to the contract timeline – before network testing, before the contract award, or within a specific timeframe after successful testing and installation?

Answer: Thales 930 card support must be provided b 3/1/25.

8. DLA has not specified whether only OEM supplies are required, or if third-party remanufactured/compatible supplies are permissible for provision to DLA. We recommend that DLA include language mandating the exclusive use of OEM supplies, as third-party supply manufacturers often produce much lower quality items that necessitate more frequent replacements. Additionally, toner cartridges have microchips that communicate with the device, creating a security risk if the microchip is sourced from a third-party company of unknown origin.

Answer: OEM Supplies are required.

9. Should vendors assume that the devices listed in the chart below correspond to the current print volumes as specified in the same chart? If the actual print volumes exceed the estimated monthly impressions listed, will the government provide additional devices to accommodate these higher volumes?

Answer: What is being asked? The chart corresponds to what the customer requires.

10. In order to avoid delays affecting the minimum monthly availability rate of the device, will the government establish a procedure for the timely exchange of tools/locks and tamper-proof seals between service personnel and NPTU IT, to facilitate controlled access for maintenance purposes?

Answer: Bolt cutters and security bolts are only authorized for use by NPTU IS&T personnel.

NPTU IS&T always maintains a sufficient amount of security bolts/seals on hand for support of computer/copier repairs. NPTU IS&T personnel will always be made available when work needs to be completed on copiers that require security bolt removal and will not affect availability rates.

11. The government specifies that all devices must be capable of integration with a Print on-demand solution (such as 'Follow Me,' 'Follow You,' 'Push,' or 'Pull' printing), enabling end-users to release print output on any network device.

Are the requirements for this system going to be part of the existing solicitation, or is it anticipated that they will be incorporated at a future time? If these requirements are to be included in the current solicitation, is it possible to create an additional CLIN for them?

Answer: Copiers must be able to support network printing upon arrival. Secure Print functionality is not required at this time but is expected to be enabled in the future.

12. If a device is incapable of authenticating specifically with the Thales ID Prime 930 Smartcard but meets the criteria to be assigned to one of the Volume Bands as outlined in Section III, will it still be eligible for testing?

Answer: The device must be capable of authenticating with a Gemalto IDPrime MD830B card upon arrival. The device must support the Thales 930 smartcard by 3/1/25.

13. How do the network and DLA testing requirements specified in this solicitation relate to the

Thales ID Prime 930 Smartcards? Specifically, how will these testing requirements impact the evaluation and acceptance of the Thales ID Prime 930 Smartcards?

Answer: Copier must support the SMB protocol for scanning. Smartcards are only utilized at the copier for scanning and not for Secure Print or network printing. As stated previously in the requirements documentation, the copier must meet NPTU security requirements for 802.1x authentication and custom CA certificates.

14. Can the government provide details on what constitutes "locally designed" in the context of security brackets/bolts used to prevent access to the hard drive, and are these security brackets/bolts the same as the locking mechanisms mentioned in the requirements?

Could the government provide clarification on the meaning of "locally designed" in the context of the RFQ? Specifically, does this imply that the brackets and bolts are to be manufactured or designed by the end user? Additionally, could the government provide more details about these brackets and bolts?

Answer: If a Kensington lock solution cannot be provided for securing access to the hard drive, NPTU IS&T will manufacture brackets that can be attached to the hard drive enclosure to prevent access. A security bolt will be attached to the bracket to prevent removal of hard drive by personnel other than IS&T admins. This may require minor alterations to the enclosure.

15. Will the locking mechanisms be provided by NPTU IT, or are they expected to be supplied by the vendor?

Answer: The locking mechanisms/hardware will be provided by NPTU IS&T.

16. Page 4, paragraph 2 indicates that the Contractor will supply digital cards. I would like clarification on what this entails, as it is not a common practice for contractors to provide such items.

DLA should consider removing the requirement for the Contractor to supply digital cards, as this is not a standard procedure in DOD security.

Answer: NPTU IS&T will supply the Gemalto IDPrime smartcards for use by the end user at this site per security requirements.

17. Would the government confirm when the Period of Performance (PoP) starts upon delivery of the first printer?

Answer: The POP will begin upon delivery of the last printer.