Q A61609.doc

CLARIFICATION QUESTIONS/RESPONSES

In support of Solicitation Number

TIRNO-09-R-00017

Amendment 0003

Question 1:

1. RFP requires a system design document, with proposed system architecture, p L5. Can the government clarify what high level means?

Government Response:

Per RFP Section L, Volume I, Tab 2 – System Architecture, the Offeror shall describe the proposed solution in the following (but not limited to) four architecture levels: (Offeror may study Treasury Enterprise Architecture Framework, Version 1, July 2000, or the Zachman Architecture Framework as a reference.)

Contextual Level: The government is asking for a descriptive list of system functions organized logically in a hierarchical manner that best explains the proposed solution.

Conceptual Level: The government is asking for a solution concept that best meets the business needs (i.e., the SCPMaR CONOPS and BSRR).

Logical Level: The government is asking for a detailed functional description of system, subsystems in the proposed solution. The Offeror may choose to use UML, SysML, or Functional Flow Block Diagram (FFBD) to explain the functional relations of identified logical subsystems or components.

Physical Level: The government is asking for a detailed physical description of system, subsystems in the proposed solution. The Offeror shall allocate each functional block identified in the logical level to a physical computing / internetworking component.

Question 2: How will the government ensure the contractor receives in a timely manner any proprietary information required for an integrated solution? p C7.

Government Response:

The TIRNO-09-R-00017 is not a system integration/development effort. The Offeror proposed solution shall meet the Minimum Mandatory Requirements specified in the government provided BSRR.

Question 3: What are the expectations around the SCAP validation with NIST, how will the IRS facilitate the validation? pC2

IRS does not and will not facilitate vendor’s SCAP validation effort. The Offeror proposed solution shall meet the Minimum Mandatory Requirements specified in the government provided BSRR.

Question 4: The RFP states to design, develop, and maintain a solution. This implies that the solution does not currently exist. Is the entire solution subject to SCAP validation or only the software portion?

As the government has stated in MR-1 of Minimum Mandatory Requirements in BSRR, “The solution shall use NIST-defined Security Content Automation Protocol (SCAP) and agency-wide security configuration policies (e.g. IRS policies and NIST National Checklist Program) and provide Federal Desktop Core Configuration (FDCC) compliance reports using the NIST-defined SCAP-based reporting format. At a minimum, the solution must be SCAP validated as a FDCC Scanner, Authenticated Configuration Scanner, and Authenticated Vulnerability and Patch Scanner.”

Question 5: Does the solution have to support all facets of FISMA compliance or confirm the technical controls are in place for each GSS and Major application? Please clarify.

Government Response: The government seeks a proposed solution that best meets IRS operational needs as stated in provided SCPMaR CONOPS and BSRR.

Question 6: Will IRS consider an extension for the proposal submission to allow a full review of the Q & A’s when released.

Government Response:

The government has extended the proposal due date to June 25, 2009, 10:00am EST.

Question 7: MR-3 - What is the IRS’ policy for Windows-based servers?

Government Response:

The government has a set of security configuration policies for Microsoft Windows 2000 and 2003. They are listed as a part of Internal Revenue Manual (IRM) and can be found at http://www.irs.gov/irm/part10/index.html . These paper-based policies have been translated into SCAP benchmarks.

Question 8: MR-8 - Are these “patches” IRS “home-grown”? If so, what are these patches? If not, are these patches industry standard that IRS chooses?

Government Response:

The list of IRS-specified patches originates from US-CERT Technical Cyber Security Alerts which are based on the vendor released patch ID. The government only selects and enumerates patches that are specific to the IRS operating environment.

Question 9: MR-18 - We understand “role-based” policies, what are the IRS’ “job functions” as defined by the IRS’ policies?

Government Response:

Per MR-18, “a set of user-defined…” The Offerors proposed solution shall provide RBAC capability, per NIST INCITS 359-2004 RBAC standard, that allows the government to define user roles for user assignment (UA) and permissions for permission assignment (PA).

Question 10: MR-22 and MR-23 - What are these benchmarks?

Government Response:

NIST Security Content Automation Protocol (SCAP) is composed of a set of industry standards. For SCAP v1, the standards are: CVE (Common Vulnerability Enumeration), CCE (Common Configuration Enumeration), CPE (Common Platform Enumeration), XCCDF (eXtensible Configuration Checklist Definition Format), OVAL (Open Vulnerability Assessment Language), and CVSS (Common Vulnerability Scoring System). The benchmarks uses SCAP; therefore, per MR-1, in the BSRR: “The solution shall use NIST-defined Security Content Automation Protocol (SCAP) and agency-wide security configuration policies (e.g. IRS policies and NIST National Checklist Program) and provide Federal Desktop Core Configuration (FDCC) compliance reports using the NIST-defined SCAP-based reporting format. At a minimum, the solution must be SCAP validated as a FDCC Scanner, Authenticated Configuration Scanner, and Authenticated Vulnerability and Patch Scanner.”

Question 11: MR-27 - What specifically is this “data” that the IRS needs to import or integrate?

Government Response:

Proposed solutions must have a minimum of three SCAP validations as specified in MR-1. In addition to this SCAP functionality, proposed solutions must be able to import or integrate standards-based data from other SCAP-enabled systems.

Question 12: MR-30 - What specifically are the IRS’ reporting processes?

Government Response:

Please review Section 3.3 of the provided Concept of Operations for the Security Compliance Posture Monitoring and Reporting (SCPMaR) Solution, Version 1.4.3 document.

Question 13: Page L-10 of the PWS states, “Volume II – Cost and Price Volume II is not page limited; however, it is strictly limited to applicable information. Information in Volume II that can be construed as belonging in Volume I or II will be so construed and will be returned to the Offeror without being evaluated.

Should we presume that second sentence should read” Information in Volume II that can be construed as belonging in Volume I will be so construed and will be returned to the Offeror without being evaluated.” Nowhere else in the RFP is a Volume III referenced.

You are correct, the sentence should read as presumed. The reference to a “Volume III” was erroneous and is hereby removed.