Vendor Draft SIR Q _FINAL SIR 693KA8-20-R-00017.pdf

SIR 693KA8-20-R-00017- Vendor Draft SIR Questions with FAA responses

# DOCUMENT Page INDUSTRY & ASSOCIATED

DOC/SECTION FAA RESPONSE

1 Pricing Wksheet

Is the number of FTE’s denoted in the pricing sheet a static number requested or can the contractor propose alternate solutions?

The price worksheet is static. The Offeror cannot change the labor mix or level of effort.

2 Pricing Wksheet

The Labor Schedule includes pre-set amounts of labor of 95,880 hours per year; half at FAA HQ and half at WJHTC.

That equates to 51 FTEs. Do the level of effort requirements over past years reflect that as a realistic approximate of the level of effort that will be required in this effort, or will that simply be used for comparison purposes?

See M.5.1 for information on how FAA will use the price worksheet in the evaluation process. FAA will set the contract ceiling (B.3) based on the successful Offeror's total evaluated price as defined in M.5.1.

3 Attach. J002

Labor Category Descriptions and Qualifications, Allowable Substitutions, does not include years of experience that can be substituted for the Masters degree. Please include those experience years, presumably with a Bachelors degree that can be substituted for a Masters degree (e.g. Bachelors + 3 years of relevant experience).

See SIR attachment J002, Section 2 for Master’s degree equivalencies.

4 Attach. J002

The Degree/Experience Requirement for Cyber Analyst Level I is "Masters / certification, 15 relevant years’ experience". Please clarify that the education requirement is for a Masters Degree or for a Certification plus a Bachelors Degree.

Attachment J002 has been updated to clarify the labor category requirement.

Pre Award – Market Survey

Would the government consider issuing this requirement under GSA Schedule or SDVOSB set-aside? Please clarify what is meant by a "Total Smal Business Set Aside". Do teaming partners need to be classified as Small Business or just the lead?

FAA will not issue this under GSA Schedule or as a SDVOSB set-aside. The Offeror (prime Contractor) must be a small business under the NAICS code specified in SIR Section L.2.4. The Offeror may propose any combination of team members provided that its solution complies with the Limitations on Sub-Contracting Clause (AMS Clause 3.6.1-7, incorporated by reference into Section I)

6 Section B 5 How many FAA locations is the contractor expected to travel to per year?

There is no fixed number of locations per year for Contractor travel. In accordance with SIR Section C.3.1.2, the Government will provide a yearly risk assessment and vulnerability assessment schedule to the Contractor.

7 Section C 11

In terms of assuring a smooth transition, the Contractor should have several opportunities to submit questions to and perform interviews with the incumbent contractor. The answers and interviews can sometimes be less than cooperative, on the part of the incumbent. Will the Contractor have sufficient time to interview the incumbent contractor with a government representative present during those interviews?

The Government will be facilitating all transition activities and will provide the information necessary for transition.

8 Section C 11

PHASE-OUT TRANSITION PLAN,

REPORT AND PERIOD. Upon contract award, will the Government provide the new contract with the incumbent's Transition Out Plan and the Phase Out Inventory Plan?

The Government will provide the information necessary to facilitate the transition.

9 Section C 13

With respect to Regression Independent Risk Assessment, does the government have a centralized repository of its software and hardware assets (i.e., a Configuration Management Database

(CMDB))?

The FAA currently uses a variety of tools and databases to perform Regression Independent Risk Assessment. The Government will not provide specific information regarding the tools and processes currently in place.

10 Section C 13

If the government has a CMDB, is it integrated with a Governance, Risk, and Compliance (GRC) tool and is the Contractor expected or required to update the Risk Translation Plan of Action Milestones in the GRC tool? Can you describe the tools used to track and report of risk management?

The Government will not provide specific information regarding the tools and processes currently in place.

11 Section C 13 Which version of the Center for Internet Security (CIS) Benchmark guideline is to be used?

The CIS Benchmark is software/hardware dependent. The current version applicable to the software/hardware being assessed is used.

12 Section C 13

In addition to the CIS Benchmark, are there any other guidelines that are expected, anticipated, or required to be used? Is the proposed Contractor expected to provide guidance or standards mapping?

The Contractor will be expected to provide guidance and suggestions on improving the overall process. This will include suggestions on implementing CIS Benchmarks and improving FAA guidelines and policies.

13 Section C 16

CYBER TESTING EXERCISES (RED AND

BLUE TEAMING). How many incumbant staff participated in the Red Team testing exercise?

This acquisition is a new requirement for the FAA. In their proposals, Offerors should demonstrate their understanding of the services and level of effort required for cyber testing exercises.

14 Section C 16

CYBER TESTING EXERCISES (RED AND

BLUE TEAMING). How many incumbant staff participated in the Blue Team testing exercise?

This acquisition is a new requirement for the FAA. In their proposals, Offerors should demonstrate their understanding of the services and level of effort required for cyber testing exercises.

15 Section C 16

Can the government tell us what technologies are involved in the network? The Infrastructure Environments, for instance (CISCO, Juniper?)?

The FAA operates a large, complex multi-vendor environment that includes major industry vendors and proprietary vendor software.

16 Section C 16 Can the government tell us more about the FAA's Cloud Environment?

The FAA has a multi-vendor, hybrid cloud environment comprised of both private, government, and public domains.

17 Section C 16

They discuss Red & Blue Teams "conducted in a simulated environment". Can the government tell more about this environment?

A simulated environment is used to isolate and conduct testing without impact to the operational environment.

The simulated environment is determined based on the system undergoing penetration testing.

18 Section C 16

Relative to the positions, will the government release additional technical detail to ensure the right person for each

FTE?

Attachment J002 sets forth the requirement for each labor category.

Contractor resources must satisfy the labor category requirements for the labor category under which they are proposed.

19 Section C 17

At the bottom of page 17, the following text appears: "The Contractor must provide SME analysis and operations support in all major areas of IA…" Can you please define what specifically is meant by "IA" in this context?

IA refers to “Information Assurance” in this context.

20 Section C 17 Is there currently an existing red and blue team supporting ACG?

This acquisition is a new requirement for the FAA.

21 Section C 18 Is past performance with radio antennas, microwave transmission, etc.

required?

Section M states the requirements for Past Performance and Relevant Experience.

22 Section C 19

On page 19, regarding Specialized Testing, the draft states: "As directed by the COR, the Contractor must provide a sandboxing and/or simulations test environment to isolate and test untested or untrusted code, applications, or software without impact to the operational environment. This simulations test environment must also be used for Red Teaming and Blue Teaming Exercises." Is the Contractor expected to bear the costs associated with these environments or will the Government pay for or reimburse the Contractor for these environments?

The referenced requirement in Section C has been amended. The Government will pay or reimburse the Contractor for costs related to the environments, if required.

23 Section C 19 Is travel required to the WJHTC data center and/or the MMAC required? Yes

24 Section C 19

Section C.3.8 International Assessments

- Does the government anticipate OCONUS travel to perform these assessments?

Yes

25 Section C 7 Is the scope of this project award only for NAS system or Non-NAS systems as well?

NAS Systems only

26 Section C 14 -

On pages 14 and 15, regarding Penetration Testing Support, the draft reads: "The assessment and reporting will be based on the NIST 800-53 low moderate, and high security controls, Federal Information Processing Standard, (FIPS-199), FAA Order 1370.121, and other applicable government standard and policies."

Please specify if there are any explicit "government standards and policies" that are applicable.

A list of referenced standards and policies are listed in SIR Section C.2. In accordance with SIR Section C.2, the Contractor is responsible for ensuring new applicable documents are adopted.

27 Section C 17-

What kind of technical support will the contractor be providing regarding hardware/software assembly?

The Contractor will be providing its technical expertise.

28 Section C 15

In section C3.4 (bottom page 15) the government states the contractor must not circumvent access controls and privilege escalation? Can the government clarify this statement? Circumvention of access controls and privilege escalation is one of the main components of true penetration testing and exploitation.

The Rules of Engagement will outline what is/not allowed during an assessment. For example, the Rules of Engagement may state that the Contractor ,"while during an engagement exploits a vulnerability that allows privilege escalation, the contractor will stop at this point and inform the government of its findings before moving forward with the engagement.”

29 Section C 17

Could the FAA please further specify the term "aircraft"? Does this refer to manned aircraft, Unmanned Aircraft Systems (UAS), commonly referred to as drones, or potentially both?

The Contractor will be expected to provide Risk Assessment support for Manned and Unmanned aircraft that operate within the NAS.

30 Section C 19

Could the FAA please further clarify the proposed international site assessments? How many sites does the FAA anticipate and over what period of time?

The FAA currently has international partners that rely on FAA NAS resources. The number of international site assessments/year is not fixed.

31 Section C 13

Can the government provide either a list of the vulnerability assessment tools used by the incumbent or is it the sole responsibility of the Contractor?

The FAA will not release a list of tools currently in place. Offerors should submit their best practices and recommendations.

32 Section F 24

PLACE OF PERFORMANCE. Since the primary place of performance is at the contractor's site, what is the estimated timeframe to add the contractor site to the System Security Plan?

The FAA will coordinate/schedule all such activities after contract award.

33 Section F 24 Does the FAA have provisions in place for a remote work-force given COVID- 19?

See SIR Section H.4.6

33 Section F 24

In order to maximize the best value offered to the FAA, would the FAA consider contractor site resources in another state for Place of Performance?

No.

34 Section G 25

During the market survey questionnaire, the set aside was for SDVOSB; the current draft shows that it is a small business size 541512. Is there a reason why the draft SIR is not set aside for

SDVOSB?

The market survey responses demonstrated that there was not enough competition to set-aside this procurement to SDVOSB.

35 Section H 30

Section H. 4 Personnel Requirements and Work Hours - Is there a minimum clearance level contractors are required to hold?

All contractor personnel must meet the suitability requirements as described in Section I, AMS Clause 3.14-2 Contractor Personnel Suitability Requirements (January 2019)

36 Section I 50

SECURITY REQUIREMENTS. What is the security clearance requirement for contract personnel, Secret or Top Secret?

All contractor personnel must meet the suitability requirements as described in Section I, AMS Clause 3.14-2 Contractor Personnel Suitability Requirements (January 2019).

37 Section I 36

I.2.3. Regarding Allowable Cost and Payment indirect cost rates, please confirm that it is allowable for subcontractors/consultants to incur allowable Other Direct Costs (ODCs) and invoice the prime Contractor just the cost with no indirect cost load.

Therefore the allowable cost and payment clause would not apply to the subcontractor/consultant.

AMS clauses apply to the prime contractor only unless specified in the clause itself or elsewhere in the SIR or resultant contract.

38 Section I 50 SECURITY REQUIREMENTS. What is the estimated timeframe for contractor to acquire an Interim security clearance?

Security clearances are not a requirement at contract award.

39 Section I 50 SECURITY REQUIREMENTS. Which Federal Agencies does FAA accept clearance reciprocity from?

The FAA accepts DoD’s clearance eligibility determinations.

40 Section I 52

Will the Government provide all required software and licensing for vulnerability assessment, penetration testing, and simulated environment activities?

Yes

41 Section L 71

Section L.6 Number of Awards states "…the FAA reserves the right to make multiple awards, or no awards at all, if it is determined to be in the government's best interests to do so." Can the government elaborate on what factors would change the government's decision to make a single versus multiple award?

There are significant differnces in the abilities needed to perform the tasks listed in the draft SIR. Awarding to multiple vendors would allow the governemnt to evaluate the merrits of each vendor at the task level and allow the governemnt to select the best vendor for the task.

The Government intends to award a single contract under this solicitation.

Any factor that would change this intention is as yet unidentified.

42 Section L 76

RELEVANT EXPERIENCE. Can subcontractor past performance be included as one of the up to 3 references?

SIR Section L has been amended to provide updated instructions for this proposal volume.

43 Section L 77

Please clarify the requirement for Certified Financial Statements. Please confirm that either internally-prepared financial statements or a compilation report by a CPA firm will satisfy the requirement.

The noted requirement in SIR Section L.12.2 has been modified.

44 Section L 77

Per section L.12.2, "certified financial statements for the Offeror for the last three (3) completed fiscal years are required." We currently have certified financial statements for fiscal years 2018 and 2019, but due to transitioning from an LLC to a Corporation in 2017, we would be providing un-certified financial statements for that fiscal year. In doing so, will we remain compliant?

The noted requirement in SIR Section L.12.2 has been modified.

45 Section L 78

On page 78, the draft reads: "PPQs from teammates or subcontractors of the Offeror are not acceptable. PPQs from the members of a Joint Venture formed specifically for the purposes of this competition are acceptable." Are PPQs from parent companies or majority owners of potential subcontractors with specific expertise relevant to this Contract allowable?

Section L has been amended to provide updated instructions for this proposal volume.

46 Section L 78

Section L.13 Volume III - Past Performance states that the Offeror must submit three past performances from the Offeror, not teammates. This seems unfairly restrictive as the team will be completing the work, not just the offeror. Would the government consider changing the requirement to include questionnaires from teammates as well?

Section L has been amended to provide updated instructions for this proposal volume.

47 Section L 78

Section L.13 Volume III - Past Performance. This section states that at least one of the past performance questionnaires must be as a prime. Many small businesses build their past performance and quals as a sub and this could eliminate otherwise qualified companies. Would the government consider removing this requirement?

Section L has been amended to provide updated instructions for this proposal volume.

48 Section L Will commercial past performance be accepted? Yes

49 Section L 78

Could the FAA please clarify the suggested approach that no subcontractor past performances will be accepted, even in the event that a subcontractor will perform a significant portion of the team's work?

Section L has been amended to provide updated instructions for this proposal volume.

50 Section L 78

Could the FAA please clarify the discrepancy between the third bullet in section L.13 and the fourth bullet? The two statements seem to be in conflict with each other.

Section L has been amended to provide updated instructions for this proposal volume.

51 Section L 72

L.10.1 Volumes and Page Limites - Please clarify if only each Section needs to be a separate document or if each Sub-Section also needs be a separate document. The instructions appear to be separate by Section, but the nomenclaure example for the file is by Sub-Section. For example, does Volume 1 need to be 4 separate documents or 9 separate documents?

By Section (Volume 1 should be 4 documents, not 9). FAA has updated the nomenclature example. However the price worksheet must be submitted as a standalone document in .xls or .xlsx format.

52 Section M 85

In Section L.13 it mentions PPQ’s are relevant to this contract in terms of ceiling, scope, or complexity. In Section M.6.1 it mentions that work is relevant if a PPQ is for a contract whose total value exceeds $20M. For an SDVOSB set-aside, can the $20M contract value be waived or clarified, with more of an emphasis on the scope and complexity?

M.6.1 reads (emphasis added), "For the purposes of this criterion, work is relevant if: * The PPQ pertains to one of the relevant experiences cited in Volume I or the work described in the PPQ is similar to one or more of the technical Work Areas (C.3.2 – C.3.8); or

* The PPQ is for a contract whose total value (inclusive of options) exceeds $20M" Since it's an OR statement, a smaller contract (<$20M) will satisfy the requirement if it satisfies the first bullet's elements

53 SIR

Is this a follow-on to any work performed currently or in the past? Can the FAA provide the incumbent’s name and contract number?

This acquisition is a new requirement for the FAA.

54 SIR Is this a new requirement? Yes

55 SIR

Can my references be for my own performance as a contractor employee since this will be our first contract?

No

56 SIR What will be the contract value for this opportunity?

The FAA does not release the estimated value of a potential acquisition.

57 SIR What is the approximate timeline of the SIR release?

SIR release is anticipated for late September 2020, early October 2020 timeframe

58 SIR

Is there an expected industry day planned for this opportunity for potential contractors to engage possible team members?

No

59 SIR Does ACG utilize SMART for POAM management?

The Government will not provide specific information regarding the tools and processes currently in place.

60 SIR

Is AGC performing vulnerability scans for all ATO systems or is ATO ISS responsible for performing vulnerability scanning outside of pen testing?

ACG performs the vulnerability scans for all ATO systems, including penetration testing.

61 SIR

Has the government determined a contract vehicle on which the solicitation will be released?

The contract will be awarded as an open-market contract. It will not be an order against an existing contract vehicle.

62 SIR Will this be a single award?

The Government intends to award a single contract under this solicitation.

See section L.6