Amendment 2 Questions.doc

SOCIAL SECURITY

Office of Acquisition and Grants

July 9, 2012

TO:

All Interested Parties

FROM:

Christopher Mettee

Social Security Administration

Office of Acquisition and Grants

7111 Security Boulevard

Baltimore, MD 21244-1811

RE:

Solicitation SSA-RFP-12-1036 for Independent Verification and Validation Services, Amendment 2 To Whom It May Concern:

SSA provides Amendment 2 to the Solicitation SSA-RFP-12-1036 to respond to solicitation inquiries. The questions (in blue), with their respective response from SSA (in red), are as follows:

1. How were the estimated work hours for the CLINs calculated?

We estimated the work hours based on historical averages for similar work. More complex Information Technology systems require more resources to assess.

2. Are the Estimated hours per event or total for all the CLINs combined?

We provided the estimated hours based on the following:

· Functional Area 1 - Per security assessment

· Functional Area 2 – Per Penetration Test

· Functional Area 3 – Per CLIN ordered

· Functional Area 4 – Per CLIN ordered

3. Do all systems currently have valid security credentials?

All SSA Major Applications and General Support Systems are currently operational and possessing Authority to Operate.

4. Will the awarded contractor have access to the previous reports and data?

Yes, the awarded Contractor will have access to previous reports and data. Due to the sensitivity of that information, SSA cannot provide previous reports as part of the Solicitation.

5. Are there current Information Assurance policies and procedures that require updating or will they have to be developed from scratch?

SSA has robust published information systems security policies and procedures. Therefore, the winning Contractor will not need to develop these procedures from scratch. However, changes to Information policies and procedures are frequent, and it is SSA’s intention to work with the winning Contractor to recommend policies and procedures based on best industry practices as applicable (see Functional Area 3).

6. What Risk Management Framework is currently in use within the SSA?

The agency presently uses a Federal Information Security Management Act (FISMA)-compliant Risk Management Framework.

7. Will the contractor be allowed to connect contractor owned equipment to the SSA network to perform assessments or other functions as directed by task order?

No, with the exception of some Penetration Tests. The Rules of Engagement for Penetration Test may allow the Contractor access to SSA’s network with its own equipment.

8. Sections B 2.2-2.3 - The security assessment and the penetration testing sections reference analytical, senior analytical, and subject matter expert. Do these three positions constitute the complete team for these efforts?

This is a performance-based service contract, and SSA does not require a certain staffing level, with the exception of key personnel Penetration Test Manager and Program Manager positions. Therefore, the Offeror’s proposal should address the constitution of its IV&V team, especially in its CLIN Breakdown for each task.

9. Section B 3.9 – are all security required upon contract commencement or will waivers be granted?

The Contractor must have affirmative suitability determinations prior to beginning work. Due to the sensitivity of this contract, the agency will not provide any waivers to this process at this time.

10. Once a background check has been completed will it meet the requirement for the duration of the contract or will a background check be conducted every time access is requested?

SSA suitability determinations remain active for up to five years from date of issuance. The anticipated contract has an ordering period of five years; therefore, it is possible that if the agency issued a Task Order on the last date to order, Contractor personnel could require new suitability determinations.

11. Will individuals with verified clearances still have to complete the eQIP process?

Upon the successful Offeror’s request, individuals with an active suitability determination at SSA at the same clearance level (i.e. Level 6C, AIS High Risk) may receive clearance under this anticipated contract. After award, the successful Offeror should provide a list to the Contracting Officer’s Technical Representative including the full name, date of birth, old contract number, and new contract number to have already suitable personnel work under this anticipated contract.

12. RFP page 8: Section B-2.2 Functional Area 1: Security Assessments—States, “CLINs RA01 through RA03 represent a Firm-Fixed Price per report for the Contractor to perform Security Assessments on designated SSA Major Information System(s). Each CLIN includes varying degrees of complexity and time required.” Could the Government please define “complexity” and provide examples of the differences between “high,” “medium,” and “low” complexity systems?

The agency considers Security Assessment complexity by such things as volume of subsystems within security authorization boundary, system interconnections, and subsystem geographical configuration. As the volume increases, the security assessment becomes more complex. Based on historical estimates, low complexity risk assessments typically require 550 work-hours, but may take up to 687 work-hours. Medium complexity risk assessments typically require 800 work-hours, but may take up to 1000 work-hours. High complexity risk assessments typically require 1100 work-hours but may take up to 1,375 hours. SSA predicated these work-hour estimates upon the overall combined hours of Analytical, Senior Analytical, and Subject Matter Expert engineering labor, based upon the definitions of those positions in Attachment 2.

13. RFP page 10: Section 2.6 Miscellaneous Travel-Related Expenses—It is estimated that 20 percent of the Security Assessments/ Penetration Tests will include travel requirements greater than 50 miles from SSA Headquarters. Further the contractor must provide a fixed price that includes all travel related costs. Can additional information regarding the locations to be visited within the eastern and western US be provided? For example, are the sites Field Offices, Disability Determination Services, Program Support Centers or Regional Offices?

Locations that the Contractor must visit might possibly include sites suggested, but more likely are sites of SSA Contractor-owned or operated externally hosted subsystems.

14. RFP page 10: Section 2.6 Miscellaneous Travel-Related Expenses— Please confirm the number of travelers expected for each site trip.

The number of travelers will vary dependent upon the requirements of the Task Order. The Contractor should assume that each CLIN represents one traveler. If the Task Order requires multiple travelers, then the agency’s intent is to use multiple quantities of the applicable CLIN(s).

15. RFP page 11: Section B-3.1 Background –Is the contractor responsible for supporting the development of the annual Federal Information Security Management Act Report to OMB and Congress at the end of each fiscal year?

Under Functional Area 3, CLINs LH5 and LH6 may require support for report generation, which could include assistance with FISMA report generation.

16. RFP page 12: Section B-3.3 Security Assessment Requirements—Currently there are 22 major systems in scope, the RFP states that security assessments would be performed on these systems on a tri-annual basis. Please confirm the maximum amount of systems to be tested each year would be 8.

The solicitation’s Attachment 1 clarifies anticipated volume of security assessments. The contract maximum is $12 million over the anticipated contract’s five-year ordering period.

17. RFP pages 12-13: Section B-3.4 Penetration Test Requirements— In addition, please confirm if the penetration testing for the major systems would follow the tri-annual schedule for security assessments. If so, please confirm the maximum number of penetration tests to be performed each year would be 8.

Attachment 1, second tab, clarifies anticipated volume of penetration tests. The agency routinely, once every three years per major system, requires Penetration Tests. However, the agency sometimes has more frequently if it identifies a security issue that may require additional testing.

18. RFP page 15: Section B-3.6 Section (c) —Does “…component developed security documentation” refer to documents such as organizational division or subdivision policies and procedures including but not limited to incident response plans, disaster recovery plans, account management plans, and rules of behavior/acceptable use policies?

All of those documents identified in the question are good examples of component developed security documentation.

19. RFP page 16: Section B-3.7 Deliverables—Does SSA use CSAM, Trusted Agent FISMA or another centralized security authorization documentation repository? If so, are contractors required to post deliverables created within the security authorization process to such a system once approved?

SSA does use a centralized security authorization document repository. However, the agency does not require the successful Offeror to post its deliverables.

20. RFP page 20: Section B-3.9 Assumptions –States, “…the Contractor must ensure that it has all the equipment, software and tools routinely used in industry to accomplish the contract objectives.” – What is the SSA approval process to use contractor-provided penetration testing tools? Does SSA have any preference with regards to a particular tool or set of tools?

As part of the Rules of Engagement process, the Government and Contractor will negotiate the contractor’s proposed penetration testing tools prior to the penetration test execution. Upon agreement of those tools, the Rules of Engagement will identify the tool set used during the penetration test. The tool set required is dependent upon nature of specific assessment under consideration. SSA will approve of the Contractor’s toolset selection if it can demonstrate it based its selection on industry best practices.

21. RFP page 21: Section B-3.11 Section (b) and (c)—(b) Removal of Key Personnel states, “During the first year of performance, no key personnel substitutions can occur unless an individual’s sudden illness, death, disciplinary action, demotion, promotion, or termination of employment necessitates such substitutions.” (c) Substitution Process states, “After the first 180 days of performance, the Contractor must provide at least 30 days advance notice for all substitutions and additions of key personnel.” There appears to be a conflict between (b) and (c) (one year vs. 180 days), therefore which time period governs?

The Government’s intent was for the first 180 days of performance, the Contractor not make key personnel changes except in the specific instances mentioned. SSA revised the Solicitation under Section B-3.11 to clarify the requirement. The agency highlighted changes in yellow.

22. RFP page 85: Section E-2.5 Volume III.A—Relevant Experience Information—This section does not state a page limit for this volume, can the government please provide a page limit to this volume?

For relevant experience information submitted by the Offeror, the Offeror must limit its submission to more than 20 pages. SSA revised the Solicitation under Section E-2.5 to clarify the requirement. The agency highlighted changes in yellow.

23. Is the incumbent eligible to compete for this contract and, if so, is that considered an independent security review?

Yes, the incumbent is eligible to compete. The agency interprets this question to mean that should the incumbent receive an award, would the agency have a truly independent verification and validation. The incumbent’s role under the current contract is to review agency-implementation of security controls. Under the new proposed contract, the successful contractor will not review past work under the previous contract, but whether the agency’s major information complies with applicable information security standards and regulations.

24. Since this will be a single award, how the Agency expect to maintain the independence of the following task by the same company?

The Agency requires IV&V services under four functional areas that support the Agency's information security, including:

1. security assessments;

2. penetration tests;

3. development of information assurance policies and procedures;

4. and risk management framework support

The agency develops its requirements for support services to ensure the necessary level of independence. SSA considers independence as separate and distinct from the SSA system owners. The Contractor is neither an SSA entity nor a system user/owner. Since the Contractor is a third party, we consider this review as an independent verification and validation of the agency’s major systems. Moreover, the contractor services provide only recommendations related to agency policies and procedures, and agency personnel ultimately develop, review, and approve those policies and procedures.

25. Does SSA have Application in the Cloud Environment or have plans to migrate to Cloud Environment?

SSA’s implemented major systems do not currently include cloud environments; however, it is possible that the agency may introduce future major systems that must comply with SSA policies and procedures demonstrate FISMA compliance, including Federal Risk and Authorization Management Program (FEDRAMP) compliance. Should the agency implement cloud-based solutions, the agency considers IV&V functions for those major systems as within the scope of the anticipated contract.

26. Appendix B, Section B-2 Pricing Table (p7) of the RFP provides estimated work-hours for the various functional areas. To effectively identify the required uncertainty and estimated hours, we respectfully request the following asset information for each complexity category:

Category High:

Application Architecture (e.g. .Net, Java, Other):

Avg Number of Tiers per system (e.g. 2, 3)

Total Number of Servers (per category)

Server Type (e.g. Physical, Virtual):

Storage (e.g. On board or SAN):

Operating System Type: (e.g. Windows, Linux, UNIX)

DBMS Type (e.g. SQL Server, Oracle)

Application Server Type (e.g. Websphere, JBoss):

Web Server Type (e.g. IIS, Apache):

Category Medium:

Avg Number of Tiers per system (e.g. 2, 3)

Total Number of Servers (per category)

Server Type (e.g. Physical, Virtual):

Storage (e.g. On board or SAN):

Operating System Type: (e.g. Windows, Linux, UNIX)

DBMS Type (e.g. SQL Server, Oracle)

Application Server Type (e.g. Websphere, JBoss):

Web Server Type (e.g. IIS, Apache):

Category Low:

Avg Number of Tiers per system (e.g. 2, 3)

Total Number of Servers (per category)

Server Type (e.g. Physical, Virtual):

Storage (e.g. On board or SAN):

Operating System Type: (e.g. Windows, Linux, UNIX)

DBMS Type (e.g. SQL Server, Oracle)

Application Server Type (e.g. Websphere, JBoss):

Web Server Type (e.g. IIS, Apache):

No, that information is not readily available and security concerns make it ill advised to release architecture information about the agency’s major applications. The agency derives security assessment complexity by considering such things as volume of subsystems within security authorization boundary, system interconnections, and subsystem geographical configuration.

27. Can you identify the locations where the penetration testing will be performed?

CONUS, more specific information yet to be determined.

28. Will the penetration testing be limited to interfaces or also include special consideration of specific end users? If so, how many?

These issues will be dependent upon the scoping requirements of each penetration test. The agency will incorporate the scope of each penetration test into the Rules of Engagement approved by SSA and the contractor prior to initiation of the execution phase.

The contractor must follow common vulnerability assessment and penetration methodologies to ensure consistent and repeatable evaluations. Methodologies used include the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-115, Open Source Security Testing Methodology Manual (OSSTMM) and Open Web Application Security Project (OWASP) testing guide.

29. What are the total numbers of IP addresses to be tested externally, internally, and agency to agency?

The agency interprets this question to relate to penetration tests. The development of the Rules of Engagement (see Section 3.6 of Addendum B) will include information regarding the total number of Internet Protocol (IP) addresses for testing externally, internally, and agency to agency (if applicable). The number will vary based upon the nature of penetration test.

30. What is the total number of web apps to be tested?

This is unknown at this time.

31. Is wireless access part of the network and/or application to be tested? If so, what is the approximate square footage of the building(s), and total number of buildings to be tested for wireless?

It is possible that applications for testing will include major systems based on wireless technology. It is unknown at the current time which building(s) will have testing at this time. The agency will define this information at a Task Order level.

32. Will the penetration testing have to penetrate databases or is it limited to applications? If so, how many databases and what are their sizes?

The Offeror should assume that it may have to penetrate databases operated under applications. The number of databases and sizes depend on the application. The agency will provide the successful Offeror with specific information about databases employed within SSA as part of Security Assessments/Penetration Tests on an as-needed basis.

33. Is the time(s) of day for the penetration testing to be at the discretion of the contractor, or are their restrictions on when the penetration testing can be performed?

The agency and the successful Offeror will negotiation any applicable restrictions prior to penetration testing execution phase as part of the Rules of Engagement.

34. Is there a timeframe for the completion of each penetration test? Is there any additional information that can be added to the narrative in B-3.7 and B-3.10 to clarify the duration of the actual performance of the penetration test?

This is dependent upon parameters associated with each penetration test under the Rules of Engagement. The agency has yet to determine the scope of specific penetration tests.

35. Are there any particular tools and/or equipment that SSA currently uses in performing the penetration testing services as outlined in the SOW?

This is dependent upon scope of each penetration test, which is yet to be determined. The Contractor should use industry best practices and included those tools within the Rules of Engagement. Historically, a sample of potential tools that could conceivably come into play for some penetration tests include, but are not limited to:

36. Who is currently performing the penetration services and Security Assessments as outlined in the SOW?

Presently, combinations of Federal and contractor personnel perform IV&V services.

37. Are there any restrictions/limitations on subcontracting or teaming? If so, what are the restrictions/limitations?

Yes, there are restrictions/limitations on subcontracting and teaming. The agency stated applicable restrictions in the Solicitation. For example:

· Addendum E-2.3(k) regarding 8(a) Joint Ventures;

· Federal Acquisition Regulation (FAR) Clause 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment

· FAR Clause 52.219-14, Limitations on Subcontracting;

· FAR Clause 52.219-8, Utilization of Small Business Concerns

38. Will there be a pre-bid conference?

No, there will not be a “pre-bid conference.”

39. Oral presentations provide an opportunity for the Government to meet the proposed Key Personnel, and other team members. Will the government consider adding an Oral Presentation as part of the RFP?

No, the Government will not consider oral presentations as part of the Solicitation. The agency considers relevant experience and past performance to be the best indicators of successful future IV&V performance.

40. It seems that most of the applications are running on a mainframe. Please confirm that all these are CICS applications.

While the majority of applications within SSA presently run on mainframes, not all applications involve CICS.

41. Page 5 of attachment 2 mentions mainframe and distributed environment. What comprises the distributed environment?

SSA considers a distributed environment as comprising of web applications interfacing with non-mainframe system components, enterprise assets deployed outside agency firewall, and externally hosted applications that are a part of the SSA enterprise.

42. Are the databases used for the various systems all VSAM databases?

While some databases used within SSA systems use VSAM, not all use VSAM.

43. Is it possible to get an IT roadmap or a system architecture document that defines the Hardware, Software and Tools used by SSA?

No, the agency will not release documentation concerning its information technology roadmap or system architecture. SSA will provide this information to the successful Offeror after award, where the contract binds the Contractor to protect that information from unauthorized disclosure.

44. Are there any page limits for Volumes III.A or III.B?

There is no page limitation for Past Performances Questionnaires. For relevant experience information submitted by the Offeror, the Offeror must limit its submission to more than 20 pages. SSA revised the Solicitation under Section E-2.5 to clarify the requirement. The agency highlighted changes in yellow.

45. Would you provide the complexity rating for each of the applications in Attachment 2?

Most applications are moderate, a few high, and a few low. The solicitation, Attachment 1, outlines the volume per year of each complexity level that the agency anticipates.

46. In order for business with the required capabilities and experience to compete on a level playing field with the incumbent or companies with access to SSA’s systems and application, is there a library or other source where we access the information available to the incumbent?

We believe the solicitation offers a level playing field. Task Order requirements call for agency to supply supporting documents, including past assessment information, to assist the successful Offeror in tasks under contract.

47. Would SSA consider extending the proposal submission deadline for all interested companies to have enough time to review the answers you provide and have time to get more familiar with the applications, systems, and networks – perhaps at a pre-bid conference?

Submission of proposals under Stage II has not begun; therefore, the agency will not consider extending the submission deadline. The agency will not have a pre-bid conference.

48. Section B.4, pp12-13 Penetration Testing Requirements: What are the approved Penetration Test Tools in the SSA Toolbox?

The penetration testing tools used are dependent upon scope of each penetration test, which is yet to be determined. Historically, a sample of potential tools that could conceivably come into play for some penetration tests include, but are not limited to:

49. Is the incumbent, Veris Group LLC eligible to re-compete on this contract?

Any Offeror that complies with the requirements of the Solicitation may compete on this contract.

50. Reference 1: SSA-RFP-12-1036 document, Addendum B Continuation of Standard Form, section B-2.6 – Miscellaneous – Travel-Related Expenses, page 10, and Addendum C – Contract Clauses, Appendix: Regional Security Offices, pgs 48-49

Question 50a: Page 10 references 6 scenarios to bid for infrequent travel. Are the destinations the cities listed in the Regional Security Offices on pages 48-49?

No, the Offeror should not consider destinations limited to the cities listed in Addendum C, Appendix. The locations that the Contractor must travel to typically are externally hosted subsystems.

Question 50b: The travel scenarios TR1-TR6 include number of days for each. Is number of days inclusive of travel time?

Yes, the Offeror should consider the number of days to include travel time.

Question 50c: What is the geographical definition of Eastern/Western Continental U.S.

The Offeror should consider the definition of Eastern Continental United States to mean any state to the East of the western border of the following states: North Dakota, South Dakota, Nebraska, Kansas, Oklahoma, and Texas. The definition of the Western Continental United States means any states within the continental United States that are not included in the Eastern Continental United States definition.

Question 50d: Will travel be reimbursed based on the FFP funding; or actual incurred expenses?

The agency will reimburse travel based on the firm-fixed price CLINs TR1 through TR6. Under these CLINs, the Contracting Officer must first authorize travel, in writing, in a funded Task Order. The Contractor then must receive the written approval of the Contracting Officer’s Representative prior to traveling.

In addition, SSA made the following clarifications to the Solicitation:

· Addendum B, Section 3.11: The Contractor must not make key personnel changes, except in certain instances, for the first 180 days of performance

· Addendum E, Section 2.5: Submission of experience information must be no more than 20 pages.

SSA highlighted all changes in yellow in the attached Revised Solicitation Addenda.

Should you have any questions regarding this Amendment, please contact Christopher Mettee at Christopher.Mettee@ssa.gov.

Respectfully, Christopher Mettee

Contract Specialist

SOCIAL SECURITY ADMINISTRATION BALTIMORE MD 21235-0001