QA_RFQ_TFSADNC17Q0002.docx

Questions regarding Request for Quote TFSADNC17Q0002:

1. How many external IP addresses are in scope for Performance Work Statement (PWS) Requirement 1, the external vulnerability scan?

Answer: 14 possible, 6 are currently live.

2. How many internal IP addresses are in scope for PWS Requirement 2, the internal vulnerability scan?

Answer: Across 3 internal subnets (762 possible internal addresses) 76 IP addresses are live.

3. For Requirements 1 and 2, does the Commission expect vulnerability scans only, or will the Contractor also attempt to exploit select vulnerabilities on approved targets?

Answer: The Commission wants a scan only.

4. How many firewalls are in scope for Requirement 3, the firewall configuration review?

Answer: 1 firewall.

5. What remote access technologies are included in the scope of Requirement 4, the remote access security assessment?

Answer: SSLVPN, Remote Desktop services, EZ Proxy, Outlook Web Access

6. Is wireless network testing included in the scope of work? If so, how many wireless networks are included?

Answer: Yes, there are two wireless networks.

7. Are travel and per diem expenses allowed?

Answer: The contractor may be required to travel in support of this PWS. The contractor will be authorized travel expenses consistent with the substantive provisions of the Federal Travel Regulation (FTR) and the limitation of funds specified in the award. All travel requires Government approval/authorization and notification to the COR.

8. Is there an incumbent for this requirement or is this a new requirement?

Answer: Yes there is an incumbent.

9. If this is not a new requirement, please provide the name of the last successful vendor and the amount of the contract from the previous performance year.

Answer: Digital Securus LLC; TPD-DNC-12-0005; $26,250.00

10. Further, if there is an incumbent, what is the reason that the Bureau of Fiscal Service is looking to contract a new vendor for this requirement (e.g. poor performance by previous vendor, conflict of interest issues, etc.)?

Answer: The current contract expires 5/31/17 and a new award for services must be made.

11. During evaluation of proposals received, will any preference/points be awarded for vendors that submit references from government organizations? Is it preferred that the contractor have government experience?

Answer: It is preferred that the contractor have government experience but is not a requirement.

12. During evaluation of proposals received, will any preference/points be awarded to vendors that are local versus out-of-state?

Answer: No preference will be given to in-state verses out-of-state for scoring purposes.

13. Is it acceptable for the project to be performed remotely using VPN access in order to eliminate travel costs?

Answer: No it is not acceptable to just use VPN

14. Is there a specific/prescribed format for the proposal or can the vendor choose their own?

Answer: Please refer to the Proposal Instructions.

15. Are there special considerations for 8(a), woman-owned, or minority-owned small businesses?

Answer: No.

16. Are there any specific “Invoice Terms” and/or “Payment Terms” that the Bureau of Fiscal Service prefers? Or would you be ok with a vendor’s terms?

Answer: Offerors may propose payment terms.

17. Please confirm that the scope of the project is essentially an external network vulnerability scan and an internal network vulnerability scan. Is this understanding correct?

Answer: Yes, this is the scope of the project. The scope does include manual review of network settings.

18. Is it also required to manually review individual configurations of various network devices or is the automated scan the only requirement? If individual configuration review is required, how many firewalls are in scope?

Answer: Yes, manual review of network devices is required. The Commission has one firewall.

19. How many modems, fax machines, and other telephonically networked devices are in scope? Also, will these telephone numbers be provided to the vendor or is it a black box assessment?

Answer: The telephone numbers will be provided. There is one fax machine and approximately 25 phone numbers.

20. For the remote access assessment, is it required to manually review configurations related to the remote access methods or is the expectation that the automated scan will pick up remote access related vulnerabilities as well and that’s what the vendor is required to report?

Answer: Yes, manual review of remote access configurations is required.

21. Again, for the anti-virus software assessment, is it required to manually review individual configurations of the anti-virus software or is the expectation that the automated scan will pick up anti-virus related vulnerabilities as well and that’s what the vendor is required to report?

Answer: Yes, manual review is required.

22. Please provide the approximate number of live external IP addresses in scope.

Answer: There are 6 live IP addresses.

23. Please provide the approximate number of live internal IP addresses in scope.

Answer: There are approximately 74 live internal IP addresses.

24. I would like to confirm that an electronic delivery of .doc, .docx or .pdf is acceptable?

Answer: Please refer to the Proposal Instructions.

25. I would like to confirm that the due date is November 28, 3 pm EST?

Answer: To address the questions the due date is being extended to December 06, 2016, 3 pm EST.

26. Can you give me an estimated number of IP addresses both internal and public/Internet facing?

Answer: Estimated numbers of IP addresses are 14 external with 6 live external. Internally across 3 internal subnets there are 762 possible internal addresses and around 74 are live.