Attachment 6.doc

Attachment 6 – Reference Questionnaire

(Sample Cover Letter for Company Letterhead)

Dear Sir or Madam:

The Social Security Administration is soliciting proposals for the acquisition of Independent Verification and Validation support services to meet its information assurance and security mission. We plan to submit a response to this acquisition and have designated you as one of our references. We request your assistance in this process by asking you to complete the attached questionnaire with regard to your evaluation of our experience and past performance.

By submitting this information, you are assisting the Federal Government in determining which Contractor is offering the best value. Please submit your responses to the following address:

ATTN: Christopher Mettee

Social Security Administration

Office of Acquisition and Grants

7111 Security Boulevard

1st Floor, Rear Entrance

Baltimore, MD 21244-1811

Or electronically to Christopher.Mettee@ssa.gov Or by Facsimile to 410-965-9560

The Government must receive responses by Close of Business, July 20, 2012. We appreciate your timeliness in this matter.

Thank you in advance for your assistance.

Sincerely, (Company)

Attachment 6 - Reference Questionnaire (Experience) Date:_____________

Reference for (Prime)_________________________ (Sub) ________________________

Company:______________________________________________

Contact Name:___________________ Contact Phone:__________________________

1. What is your involvement with the contract? What type of organization are you with? Please provide brief explanation.

a. Contracts/Purchasing? b. Program Office?

a. Federal Government? b. State/Local Government?

c. For Profit Organization? d. Non-profit Organization?

2. What type of service did the Contractor provide for your organization?

3. What was the geographic scope of the contract?

4. What is the number of locations supported under the contract?

5. Did the Contractor perform Independent Verification and Validation (IV&V) assessments, Federal penetration tests, Federal risk assessments, and proposed Federal information security policies and procedures? If yes, please identify the frequency.

6. Did the Contractor prepare Information Technology System Security Categorization reviews that adhered to NIST SP 800-60 and FIPS 199 guidelines and standards? If yes, please identify the frequency.

7. Did the Contractor document security authorization boundaries that fully satisfied the best practice guidelines of NIST Security Management & Assurance, Federal Agency Security Practices, Boundary/Scope Memos. If yes, please identify the frequency.

8. Did the Contractor provide IV&V assessment plans that proposed assessment of security control set that adhered to NIST SP 800-53 revision 3 control baseline requirements? If yes, please identify the frequency.

9. Did the Contractor documented results of security control assessments with complete and accurate Security Assessment Reports, identified risk levels for all identified vulnerabilities, and recommended corrective actions?

10. Did the Contractor’s documented results of security control assessments fully satisfy assessment results reporting requirements of NIST SP 800-53 revision 3 and NIST SP 800-37?

Attachment 6 - Reference Questionnaire (Past Performance – Part I) Please answer the following questions regarding the Contractor’s past performance.

1. Did the Contractor perform satisfactorily, or in accordance with the scope of the contract?

2. Did the Contractor/Subcontractor provide service in accordance with the scope of the contract within a reasonable timeline?

3. If a problem arose, did the contractor/subcontractor take the necessary steps to resolve the problem as quickly as possible in accordance with the contract terms and conditions?

4. What are the Contractor’s strengths?

5. What are the Contractor’s weaknesses?

6. Would you do business with this company again? Why?

Attachment 6 - Reference Questionnaire (Past Performance – Part II)

Instructions: Please rate the Contractor on a scale of 1 to 10, 10 being the highest ranking and 1 being the lowest. Consider the following scale when rating the identified factors:

Excellent (8 to 10 Points) – Performance met all contract requirements and exceeded many to the customer’s benefit. Problems, if applicable, were negligible and were resolved in a timely, highly effective manner.

Good (6 to 7 Points) – Performance met all contract requirements and exceeded some to the customer’s benefit. There were a few minor problems which the Contractor resolved in a timely, effective manner.

Neutral (5 Points) – When there is no record of past performance or the record is inconclusive.

Fair (3 to 4 Points) – Performance met contract requirements. There were some problems and corrective actions taken by the Contractor were satisfactory.

Poor (1 to 2 Points) – Performance did not meet most contractual requirements. There were serious problems and the Contractor’s corrective actions were ineffective.

Please enter a numeric value in the space provided for each item or N/A if you consider it not applicable.

Quality of Product and Service

1. The Contractor’s deliverables met contractual requirements. Score____

2. The Contractor was able to always satisfactorily resolve identified issues with required deliverables. Score____

3. The Contractor recommended and demonstrated ability to apply improvements to the customer’s information security program that elevated the level of implemented security controls, thereby improving confidentiality, integrity, and availability assurances. Score____ Schedule

4. The Contractor appropriately protected (based on data sensitivity) documents and sensitive or classified agency information. Score____

5. The Contractor delivered at the time and place defined in the contract. Score____

6. The Contractor submitted deliverables in the prescribed format and media, demonstrating version control and comment resolution. Score____

7. The Contractor remained on schedule and met contractual milestones. Score____ Cost Control

8. The Contractor’s invoices requested funds consistent with work performed, and did not exceed awarded funding ceiling. Score____

9. The Contractor’s travel expenses did not exceed those permissible under the contract. Score____

10. Costs incurred by the Contractor for services delivered were reasonable. Score____

11. Applied skill set, labor categories, and number of resources needed by Contractor to accomplish the IV&V services, penetration testing, risk assessments, and to propose information assurance policies and procedures was appropriate. Score____ Business Relations

12. The relationship between customer organization and contractor was positive. Score____

13. The Contractor demonstrated effective communication, and met with customer to incorporate feedback into deliverables. Score____

14. The Contractor regularly interacted with customer organization to identify issues and raise awareness of task status. Score____

15. The Contractor collaborated with customer organization, providing solutions to resolve issues that threatened to negatively affect the tasks. Score____ Management of Key Personnel

16. The Contractor provided its personnel with a full understanding of the customer operating environment and Federal information security assessment and authorization requirements. Score____

17. Whenever key personnel changes occurred, the Contractor’s replacements possessed necessary qualifications satisfying contract requirements, and contractor integrated new staff into project team in fashion that allowed seamless continuation of schedule. Score____

18. The Contractor’s staff possessed industry recognized professional information security credentials to adequately address Federal information security requirements as prescribed by Office of Management and Budget, National Institute of Standards and Technology, and customer published policies. Score____

19. Customer satisfaction with Contractor’s ability to follow the security procedures of the contract. Score____ Overall Rating

20. Overall customer satisfaction with contractor’s performance. Score____ If you provided the Contractor with a high or low rating, please provide any comments relative to the prime contractor or its subcontractors relative to its performance under your contract.