CLARIFICATION QUESTIONS

CLARIFICATION QUESTIONS/RESPONSES

In support of Solicitation Number

TIRNO-09-R-00017

Question 1: I would appreciate verification if this RFP is a small business set-aside. I see that under “General Information” on the page of the announcement on Fed Biz Ops, it is indicated that Set-Aside is “N/A” but in the solicitation under Section I, a reference is made to Total Small Business Set-Aside. I would appreciate clarity so I will know how and if I am able to respond.

Government’s Response:

This is indeed a Small Business Set-Aside.

Question 2: Is Solicitation TIRNO-09-R-00017 officially released or is it currently on hold?

Government’s Response:

Solicitation TIRNO-09-R-00017 was officially released on May 20, 2009.

Question 3: I am a little confused and hope you can help. The solicitation calls for a full and open competition but utilizes NAICS 511210 which I have been told has a restriction that companies over $25 million in revenue can not participate. Is that true?

Government’s Response:

The solicitation notice is intended for 100% Small Business Set-Aside. Please see the listing under the modified link for the posting. The size standard for this RFP is $25 million in revenue or less.

Question 4: Just to confirm your recent amendment…Due date has changed from August 8th to June 11th and it is a 100% Small Business Set-Aside?

Government’s Response:

You are correct. Amendment 0001 corrected the date of August 8th that was listed on the cover page of the RFP (Standard Form 33). The date June 11, 2009 was correctly listed on Fed Biz Ops and in Section L of the RFP. The requirement is a 100% Small Business Set-Aside.

Question 5: Are all of the mandatory requirements go/no-go requirements? For example, if a product doses not currently use a FIPS 140-2 validated cryptographic module (but will be in the future), can it be considered?

Government’s Response:

Section M.1 of the Solicitation states the following:

“In order to be considered for the competitive range, the Offeror’s proposal must meet “ALL” the Government’s minimum mandatory requirements in the Performance Work Statement of this solicitation. This part of the evaluation will take the form of a “pass” or “fail” rating as to the question of an Offeror’s compliance with each minimum mandatory requirement. Each “fail” will be determined to represent a proposal deficiency as defined at FAR 15.001. Offeror’s whose proposal deficiencies are not eliminated prior to the contracting officer’s request for final proposal revision will not be eligible for selection for award.

This means that all mandatory requirements are go/no go.

Question 6: If the IRS receives no proposals that meet ALL of the mandatory minimum requirements, can an award still be made? And if so, how would a decision be reached?

Government’s Response:

In response to your question, I must emphasize the fact that the RFP states that all minimum mandatory requirements must be met for a proposal to receive further evaluation, meaning that an award could not still me made.

Question 7: The original solicitation notice stated that this requirement will be a set aside for small business Schedule 70 holders. The most recent modification states that this requirement is a 100% SBSA. Will the government accept proposal submissions and consider award to prime contractors who have a GSA Schedule 70 with the designation of small-business?

Government Response:

The FedBizOps pre-solicitation notice that you reference stated that GSA Schedule 70 small businesses would be considered. Once the actual synopsis/solicitation was issued on May 20, 2009, that procurement strategy of the agency was changed and duly noted.

This requirement is a 100% Small Business Set Aside. This means that it does not utilize the GSA Schedule 70.

Question 8: What is the NAICS code for this procurement?

Government Response:

The NAICS Code is 511210.

Question 9: The most recent amendment moves the proposal due date up nearly two months. In order to provide a comprehensive technical solution, would the IRS provide a minimum 30 day extension to the proposal due date?

Government Response:

The FedBizOps notice states that the due date is June 11, 2009. Section L of the RFP also stated June 11, 2009. The SF 33 incorrectly stated August 30, 2009. An oversight which was swiftly corrected though amendment on May 21, 2009, which as I am sure you know, becomes a part of the RFP.

In consideration of this solicitation being a 100% Small Business Set-Aside, the government is extending the proposal due date to June 25, 2009, 10:00 am EST.

Question 10: Will the hardware and software required for, and in support of the deployed solution be provided entirely by the IRS? If not, what must the contractor provide?

Government Response:

The proposed solution shall meet the required capability described in attachment J-1, “Business System Requirements Report”. The IRS can provide the server hardware required to host the software-based solution/ however, this does not exclude appliance- based solution.

Question 11:

Can the IRS provide details as to the number and types of Software Licenses for Servers and Workstations?

Government Response:

A description of the operating environment can be found in Attachment J-3, “Concept of Operations for the Security Compliance Posture Monitoring and Reporting System”, section 2.5. Vendors should propose licensing schema that will provide the best value to the Government.

Question 12:

Will the IRS please identify the numbers and types of each document that is to be prepared?

Government Response:

Concerning CLIN 0004C, and other CLINS, please refer to Section C as all CLINS track directly back to the Performance Statement of Work.

Question 13: The RFP includes a number of requirements for integration of the solution with various products at the IRS. Integration between products is usually driven by te market. Our offering is designed to be open, and readily integrates with a number of products, usually with the help of some professional services work. Is the offeror’s capability to integrate with the named solutions sufficient, or must the product be able to demonstrate effective integration with the named solutions at the time of order?

The integration points specified in the Minimum Mandatory Requirements are driven by the current IRS operating environment. The Offeror should describe the proposed solutions’ current capability and the level of configuration or tailoring required for the solution to meet integration requirements. Proposals should include any associated cost or schedule impacts.

Question 14: Would you (the IRS) consider/accept a proposal that did not align with the implementation and/or delivery schedule? Our approach provides the desired capabilities but in different phases for design, development, and implementation.

Government Response:

Offerors proposals must describe how all project deliverables will be produced and proposed solutions must meet all minimum mandatory requirements. Proposal schedules should provide the proposed solution within the required timeline.

Question 15: Will all clarification questions and answers be released to all interested parties or will answers only be directly to the interested party that posed the question? We request that for fairness and full disclosure, all questions and answers be released to all interested parties, in a non-attributable way.

Government Response:

Yes. All questions and responses will be posted in a non-attributable way.

Question 16: In Section 1.6, “Assumptions and Constraints” of the BSRR it states:

“The solution shall integrate with existing IRS systems including but not limited to:

· The solution shall integrate with other NIST SCAP validated products.

· The solution shall integrate with the IRS Network Admission Control (NAC) solution.

· The solution shall integrate with Active Directory and SiteMinder.”

Yet in J2 - SCPMaR_Requirements_Checklist_v1_5.doc, there is no mention of a mandatory requirement to integrate with the IRS Network Admission Control (NAC) solution.

Government Response:

IRS NAC solution will be determined after the source selection of TIRNO-09-R-00017. However, source selection of the IRS NAC solution may or may not be predicated on the SCPMaR solution.

Question 17: Is there a requirement to integrate with the IRS Network Admission Control (NAC) solution and, if so, what application programming interfaces (API’s) or are there other integration points available to this system?

Government Response:

IRS NAC solution will be determined after the source selection of TIRNO-09-R-00017. However, source selection of IRS NAC solution may or may not be predicated on the SCPMaR solution. Specific solution requirements are listed on Attachment J-1 of the RFP.

Question 18: There is not a clear one-to-one mapping of IT systems that are required for integration as stated in the body of the BSRR and those stated in the SCPMaR_Requirements_Checklist_v1_5.doc. Could the Government please provide a definitive list of all of the IT systems that shall be integrated with the SCPMaR solution and could the Government identify, on a system by system basis, if 1) these systems are a COTS, GOTS, or internally developed IRS systems and 2) if the solution must only import data from each system or if the solution must communicate with the system bi-directionally?

Government Response:

Information flow diagram is predicated on the proposed solution. The Government does not wish to constrain all possible solutions; hence the desired integration points are located in Section 4.3.1 of BSRR instead of Section 3 Minimum Mandatory. Offerors are to use Volume I, Tab 2 – System Architecture to explain their proposed solution.

Question 19: In section 1.3 “Project Vision”, in the Technology subsection, it states:

“For interoperability with the existing IRS IT investments, the solution shall be able to import or integrate data from existing IRS systems and tools including but not limited to:

· The solution shall integrate with Microsoft Active Directory to facilitate the management of Group Policy Objects (GPO)

Yet in the J2 - SCPMaR_Requirements_Checklist_v1_5.doc, it requirement M-14 specifically states the SCPMaR solution must integrate with NetIQ Group Policy Administrator.

Government Response:

Per Section 1.5 of BSRR, “The IRS IT computing infrastructure operates in a geographically diverse environment in multiple domains…” Not all Microsoft domains are controlled exclusively by the NetIQ Group Policy Administrator. As it was specified in Section 1.6 of BSRR, it is assumed that the solution shall at minimum, integrate with Microsoft Active Directory.

Question 20: Is it the Government’s intention that the only means to satisfy the requirement to “integrate with Microsoft Active Directory to facilitate the management of Group Policy Objects (GPO)” is to integrate with NetIQ Group Policy Administrator? Are other means acceptable?

Government Response:

Per Section 1.5 of BSRR, “The IRS IT computing infrastructure operates in a geographically diverse environment in multiple domains…” Not all Microsoft domains are controlled exclusively by the NetIQ Group Policy Administrator. It is the Government’s desire to leverage existing investment in tools and trained personnel; however, the Government is open to alternative solutions. Offeror shall explain possible impacts/risks of the proposed solution in Volume I, Tab 4 – Project Management Plan.

Question 21: Mandatory Requirement 11 states that, "the solution shall provide both networked and non-networked assessment solutions." Please describe the use case by which non-networked assets will be assessed.

See Section 3.2.3 of Concept of Operations for SCPMaR Solution. Not all IRS computing assets are directly connected to IRS network. The proposed solution shall provide “a portable assessment capability to perform an on-demand security compliance posture assessment using an IRS defined security configuration baseline managed within the SCPMaR system. The security assessment result shall be imported into the SCPMaR system.”

Question 22: On the table on Page L-4 the entry for Volume I Tab 7 provides neither a maximum page count nor an indication of "No Limit". Please clarify.

No limit to Volume I, Tab 7 – Past Performance. Per Section L.6 of RFP, “Offeror’s are to submit references for actual performance on up to four (4) ongoing or completed contracts they consider to be relevant to the work contemplated in this solicitation…” “The Contracting Officer will contact the reference provided and forward a Past Performance Questionnaire that will help the Government to assess the Offeror’s level of relevant past performance.”

Question 23: There are requirements in the RFP that use the word “should” instead of the word “shall”. Please describe how the requirements listed using the word “should” will be weighted during the evaluation. What is the relative importance of these “should” statements?

Government does not wish to constrain all possible solutions; hence the Minimum Mandatory Requirements uses the word “shall” and important and desired capabilities are described using “should” instead of “shall”.

Question 24: In section 3.2 of the Concept of Operations (CONOPS) document, it states:

“The assessment of the IRS security posture consists of three types: security configuration, patch-level, and enumeration of vulnerabilities. The assessment of the security configuration shall be conducted based on an IRS approved baseline for a specific system. Each recorded weakness shall become a part of the assessment result record. The assessment of the patch-level shall be based on an IRS approved baseline. Each non-conformance found shall become a part of the assessment result record. The enumeration of vulnerabilities ingested from ISS Internet Scanner and Nessus shall be correlated to a specific computing system.”

The third type of security posture assessment, “enumeration of vulnerabilities” states the solution shall only be capable of ingesting vulnerability information from Nessus and ISS Internet Scanner. Yet, in sections 3.2.1 and 3.2.2 (scheduled automated assessment and on-demand security assessments) the security posture assessment shall be automated. This implies the SCMPaR solution must assume command and control capability over the identified vulnerability scanners.

Could the Government please clarify if the SCMPaR solution must control the initiation of Nessus and ISS Internet Scanner scans from the solution itself or does the solution only need to consume enumeration of vulnerability data from these scanners?

Government Response:

Offeror may propose “command and control” capability to vulnerability scanners; however, as described in Section 1.5 of BSRR, “The IRS IT computing infrastructure operates in a geographically diverse environment in multiple domains” and in Section 1.3 of BSRR, “Enterprise-wide, there are eighteen project stakeholder organizations (i.e. six MITS service organizations and twelve mission-focused business units.)” Not all vulnerability scans will be controlled by the SCPMaR solution.

Question 25: Even though these questions are submitted after the advertized Q&A window of time where the Government has guaranteed answers, we are requesting a response to these questions in order to ensure that we can provide a comprehensive, compliant and competitive response to the solicitation.

Government Response:

Agree.

Question 26: The effort required to prepare a response to this RFP is considerable given the complexity and quantity of the requirements. This is a significant effort for any bidder who does not have prior knowledge of the work and mission of MITS. For this bidder, it has taken until now to conduct a thorough analysis of the RFP requirements, prepare questions, and formulate a solution. Preparing a response to this solicitation as outlined in Section L represents a significant effort for small businesses. In addition, answers to the questions above will have an impact on the preparation of our response. Will the government consider extending the submission date for this solicitation? We feel that additional time will provide increased competition, more comprehensive proposals and better solutions from offerors.

Government Response:

The SCPMaR project implemention schedule is predicated on the “Tax Calendar” (IRS Publication 509). Any schedule delay would severely impact Government’s ability in meet its Congressional mandated mission specified in 26 C.F.R. Section 601.101(a).

However, in consideration of this solicitation being a 100% Small Business Set-Aside, the government is extending the proposal due date to June 25, 2009, 10:00am EST.

Question 27: This solicitation had a very short turnaround time of just over two weeks and in order for companies to respond with a professional and competitive solicitation require more time. Is the IRS willing to consider extending the due date?

Government Response:

In consideration of this solicitation being a 100% Small Business Set-Aside, the government is extending the proposal due date to June 25, 2009, 10:00 am EST.

PAGE