Attachment_0011_Amendment_0004_Questions_and_Answers_09_Nov_16.xlsx

Q&A

Clarification: Thank you for answering industry's questions. After thorough examination of Amendment 002 additional questions and clarifications have arisen that materially impact our solution approach and security compliance proposal activities. Industry requires sufficient time to digest the new security requirements and evaluate alternative solutions that can best meet the Army requirements.

Would the Government Consider?

1) Extending the due date to Friday December 9th. in order to allow sufficient time for Industry to review the new critical elements in the RFP and develop a compliant, competitive offer, with acceptable risks for bidders, and a reasonable probability of success for the Government?

2) Establishing new milestone target for IL-5/NIPRNet. We recommend C+270 days to allow for maximum competition for all solutions in this procurement. This will reduce the financial risk of pre-award investment for all Bidders.

Base Year OY1 - OY4 There is only a CLIN for SIPRNet tactical system interoperability integration.

Base Year OY1 - OY4 CLIN 0009 - TASK ONE - SIPRNet Tactical Interoperability Integration Price (ONE TIME FOR ENTIRE USER BASE)

CLIN 0009 - TASK TWO - SIPRNet Tactical Interoperability Sustainment Price Base and Option Years One thru Four Total The Base Year worksheet and all four option year worksheets (OY1 - OY4) have an entry labeled "TASK ONE - SIPRNet Tactical Interoperability Sustainment Price". This appears to be an error, as task 1 relates to the one-time integration price.

Question 1: Would the Government please correct the task 1 entries to reflect the stated purpose of task 1?

From the formulas on the Summary worksheet, it appears the Government's intent was to have the entries labeled "TASK ONE - SIPRNet Tactical Interoperability Sustainment Price" to select the TASK ONE - SIPRNet Tactical Interoperability Integration Price". The total presented on the summary sheet is the sum of each worksheets TASK ONE value. This does not match the indication that it is a one-time charge for the entire user base and conflicts with how some (but not all) one-time charges are calculated.

Question 2: Would the Government please clarify its intent regarding the one-time charge for task 1 and how the Offeror is to represent this one-time charge on the Base Year worksheets and the worksheets labeled OY1 through OY4?

Base Year OY1 - OY4 CLIN 0009 - TASK ONE - SIPRNet Tactical Interoperability Integration Price (ONE TIME FOR ENTIRE USER BASE)

CLIN 0009 - TASK TWO - SIPRNet Tactical Interoperability Sustainment Price Base and Option Years One thru Four Total Also, there are statements in the SoO that indicate "Tactical Enclave migration to the Contractor XMPP Gateway will be executed as Individual XMPP Interface CLINs due to the specific configurations and testing needed for each of the different tactical configurations"; however, only a single CLIN is used for the tactical interoperability integration activities.

Government's response: 1) Direct connections to existing Army ticketing/SMS will not be required. The Government's response seems to address a direct system-to-system connection between a contractor's ticketing system and a Government ticketing system. This response does not address the question posed, which relates to the Offeror's SCSS operations staff having user-level access to the ticketing system used by AESD as a means of passing information between the two organizations.

Question 2: Will the Government please confirm the requirement to maintain a DoD Cloud PA applies only to UC SCSS cloud-based solutions or cloud-based solution components?

Question 3: Will the government please confirm Level 5 and Level 6 PA requirements refers to DoD Cloud PAs granted for demonstrated compliance to Impact Level 5 and Impact Level 6 criteria as defined in the DoD Cloud Computing Security Requirements Guide (SRG), Version 1, Release 2?

Question 4: Will the Government please confirm UC SCSS non-cloud based solutions or solution components must meet the requirements described in DoDI 8500.01 and DoDI 8510.01, including complying with the control and control extension (C/CE) set defined by CNSSI 1253 for a system categorization of (M, M, H):RMF IATO at (C)+90, followed by RMF ATO at (C)+180.

Question- For Gate 1, we are presuming that if a solution is built with separate UCCO APL compliant component products the gate 1 requirements will be met. Is this presumption correct? If no, must the entire solution be submitted as an all-inclusive UC Collaboration Product (UCCP)? The UCR does not preclude cloud-based solutions. Unified Capabilities Certification Office (UCCO) test interoperability and security to these requirements based on system regardless of hosting/connection. Proposals are limited to the products in the APL. However, the offeror may propose delivery and implementation architectures for those products that differ from what was tested for the APL, so long as functionality and security are not degraded.

Section 3.12 speaks to Non-Cloud Based Solutions obtaining "RMF authorizations/accreditations within 90 days of contract award for NIPR and by IOC for SIPR."

#78: The question recommends commercial cloud solutions be excluded from gate 1 requirements.

#87: The question requests a similar exclusion from gate 1 requirements based on an assertion that the commercial cloud services are not “in” the DoD network, being hosted in non-DoD premises and connecting via a CAP.

#88: The question requests a similar exclusion from gate 1 requirements based on being granted an exception to DoDI 8100.04 based on connections to the DISN through the CAPs.

#89: The question requests a similar exclusion from gate 1 requirements based on being granted an exception to DoDI 8100.04 based off-site hosting of the commercial cloud service.

#90: The question requests similar exclusion from gate 1 requirements based on three justifying reasons: 1) no cloud services on the APL; 2) No JITC process for cloud services; and 3) no JITC APL requirement was applied to similar cloud services, such as Collaboration Pathfinder.

For all the listed questions, the Government has declined to grant the exceptions requested and to provide any changes to the gate 1 criteria.

Question 1: Will the Government please confirm that commercial UC as a Service (UCaaS) cloud services, such as those provided by Microsoft and Cisco will be subject to gate 1 criteria when included as part of a UC SCSS cloud-based solution or a hybrid solution?

Question 2: Given cloud services are not tested by JITC as a unified product, thus have no listing on the UC APL, what documentation will the Government accept for demonstrating compliance with gate 1 requirements?

The Contractor shall maintain administrative, technical, and physical safeguards and controls required for the security level and services being provided in accordance with(IAW) the Cloud Computing Security Requirements Guide (SRG) Version 1 Release 2 found at http://iase.disa.mil/cloud_security/Pages/index.aspx. For non-cloud on DOD premise solutions, the solution must meet security standards and controls specified in DoDI 8500.01 and 8510.01 (RMF). For hybrid on premise solutions, any part of the solution which is cloud based, will have to be provided IAW SRG v1r2; any portion that is non-cloud will have to meet DoDI 8500.01 and 8510.01 RMF.

- The proposed solution shall possess an approved DoD Provisional Authorization (PA) for Impact level(IL) 5 (NIPRNet) 90 days after contract award and IL 6 (SIPRNet) no later than IOC.

- The contractor will be responsible for generating and providing RMF required accreditation related documentation and artifacts to the Army UC Soft Client Service Information System Security Manager (ISSM). RMF artifacts must be submitted for IL 5 systems Authority to Operate (ATO) NLT 180 days after contract award. IL 6 RMF artifact submission, inclusive of IL 5 controls and classified overlay shall be done in a timeframe to allow the Offeror to achieve IL 6 by IOC. For non-cloud or hybrid solutions, all security artifacts shall be submitted in the same timeline outlined above for cloud based solution. The Government seems to be blending cybersecurity requirements for cloud-based solutions with those for non-cloud-based solutions, not only in the referenced section, but also within other portions of the RFP attachments. This is introducing ambiguity as to the applicable authorization processes and schedules for each type of solution or solution component. Our understanding of the applicable authorization processes and schedules for cloud-based and non-cloud-based solutions is as follows:

Cloud-based solutions or solution components:

- IL-5: DoD Cloud Provisional Authorization (PA) at (C)+90, followed by RMF ATO at (C)+180

- IL-6 + Classified Overlay: DoD Cloud Provisional Authorization (PA) at (C)+350, followed by RMF ATO at (C)+410

Non-cloud solutions or solution components:

- NIPRNet CNSSI 1253 (M, M, H): RMF IATO at (C)+90, followed by RMF ATO at (C)+180

- SIPRNet CNSSI 1253 (M, M, H) + Classified Overlay: RMF IATO at (C)+350, followed by RMF ATO at (C)+410

Question 1: Is it the Government's intent to follow this structure for UC SCSS? If not, will the Government please clarify how and where assessors will be engaged for UC SCSS?

Question 2: Given eMASS registration may only occur after contract award, will the Government provide an alternate means of engaging RMF assessors to ensure they are available in time to meet the (C)+90 IATO date? Question 1: Please refer to section 2.3 Cybersecurity Requirements of the SOO. The Government intends to follow the DoD PA process for cloud based solutions and RMF for non-cloud based solutions. Both PA and RMF will be followed for hybrid solutions.

Question 2: Please refer to section 2.3 Cybersecurity Requirements of the SOO. The Governments intent is to receive RMF related artifacts and documentation from the contractor NLT (C)+180 for cloud, non-cloud, or hybrid solutions.

13 UC Soft Client Pricing Model VI 0005 Summary Tab CLIN 0002

CLIN 0003

etc...

Camp Humphreys, Korea Camp Walker, Korea Kaiserslautern, Germany Grafenwoehr, Germany Camp Zama, Japan

USG), events in order to meet the required dates (within 90 days of contract award for NIPR and 410 days for SIPR), and shall provide a workflow of how it will be obtained."

Q1: Can the government clarify the task reference implied that is due within 90 days of contract award for NIPR and 410 days for SIPR?

Q2: Is the government's intent to have the offeror obtain an ATO within 90 days if a Non-Cloud based solution is proposed?

Q1: PA IL 5 has changed from 90 days after award to 180 days after award. The offeror shall provide a schedule which demonstrates the appropriate tasks and events that is required to meet this PA in this timeframe for cloud and hybrid solutions. For non-cloud solutions, the schedule shall provide how it will meet RMF process to accomplish the 6 steps in a timeframe to meet the requirements. Q2: ATO has been addressed in questions above.

The word "cloud-based" will be removed from the SOO Section 1. Overview.

27 Attachment 003 - Evaluation, Attachment 1 - SOO Volume 1 0005 Page 7 of Attachment 3; Page 5 - 1. Overview 3.1.1 Gate 1 Per the Statement of Objectives, if the Army intends to procure “Unified Capabilities (UC) Subscription services” on premise or off premise, cloud-based (Software-as-a-Service (SaaS)) service solution”, please modify Gate 1 to apply only to on premise components of the UC solution. If the Army intends to include cloud service offerings, please modify Gate 1 to remove the requirement for "cloud based service solutions". Gate 1 does not currently specify "cloud based service solutions" therefore the Gate does not need to be modified.

28 Attachment 003 - Evaluation, Attachment 1 - SOO Volume 2 0006 Page 7 of Attachment 3; Page 5 - 1. Overview 3.1.1 Gate 2 The DoD UC APL appears to be product centric list and not a cloud-based service offerings. The Unified Capabilities Requirements 2013 Change 1 dated June 2015 does not accommodate testing of cloud service offerings at this time. Also, the nature of a cloud-based service offerings is the service provider evolves the technology and provides new features making it an "evergreen service". Will the government modify the gate 1 to reflect for cloud services solution that it is acceptable for the cloud services to be based on products originally derived from the DoD UC APL that may have evolved as part of a "cloud service"? Gate 1 does not currently specify "cloud based service solutions" therefore the Gate does not need to be modified. The UCR does not preclude cloud-based solutions. Unified Capabilities Certification Office (UCCO) test interoperability and security to these requirements based on system regardless of hosting/connection. Proposals are limited to the products in the APL. However, the offeror may propose delivery and implementation architectures for those products that differ from what was tested for the APL, so long as functionality and security are not degraded.

29 Evaluation Factor for Award Attachment 3 7 3.1.1

3.1.1 states that the offerors proposal and documentation submitted will be evaluated to determine that the proposed solution is listed on the DoD UC APL as an approved UC Collaboration Product (UCCP). However, for the scope of this procurement UCCP does not appear to be the proper UCR category. Additionally, UCCP is only mentioned in the Evaluation section, and not in the SOO. The Army’s objectives and requirements to provide worldwide accessible Unified Capabilities (UC) Subscription services, which includes voice, video, instant messaging/chat, presence and desktop sharing capabilities delivered from a Contractor Owned and Contractor Operated (COCO), on premise or off premise, cloud-based (Software-as-a-Service (SaaS)) service solution is an Enterprise solution. Additionally, under the current DISA UCR UCCP requirements, 911/E911 are listed as "optional" capabilities which is a direct violation of the VVoIP STIG published this past June 2016. The STIGs apply to this solicitation. The Voice/Video over Internet Protocol (VVoIP) STIG includes the computing requirements for Voice/Video systems operating to support the DoD. The Voice/Video Services Policy STG must also be applied for each site using voice/video services. 911/E911 requirements in the Army are mandatory and are also captured in both Federal and DoD policy. XMPP is also listed as an optional capability under the UCR UCCP category and not a mandatory requirement of UCCP. UCCP should require XMPP to support IM, Chat, and Presence. UCCP was never intended as an Enterprise Solution. As a result, the proper DoD APL category to support the Army Enterprise voice requirement should be ESC. ESC covers everything being requested and much more. We respectfully request a change from UCCP to ESC.

UCCP is not a requirement in the SOO only mentioned in Attachment 0002 & 0003. Under UCCP 911 is optional, therefore is 911 required at FOC when voice is turned on, (because according to DoD/FED STIG 911/E911 is required every 30-50 feet) and the SOO currently has no clear statement that E911 is required. If the goal is to move towards an IP based network, how will the USG deploy E911 if it is not included in this requirement, given the goal is to deploy 900,000 voice users? Is it the army's intention to replace existing hard phones with a soft client as part of an offerors solution? Why is IM/Presence not UCCP compliant and voice ESC?

It is not the Army's intention to provide E911 as part of this service. E911 will be provided as it currently is. This is a non-assured service. It is the Army's intention to use this service as a compliment to VOIP. The Army intends this to be a bridge to assured services, in the future that moves most users off of hard phones and provides assured and C2 users services via hard phone. If PSTN is exercised as an option the Army will use this service to get rid of some hard phones. This is a non-assured service.

33 Guidance in Amendment 2 10 attachment 10, Questions/Comments and Answers, Q&A response makes it difficult for commercial cloud services to meet gate 1 requirements. This is because it applies UCR testing requirements to products that have not traditionally undergone JITC testing for UCR compliance (i.e., cloud service offers tested as a single unified product). Further:

a)The Government has no cloud service offer testing program, nor has any published intention of addressing this.

b) The ambiguous requirements within the RFP have led to confusion as to what would be needed to satisfy the gate 1 criteria.

c) If the Government provides additional guidance, most or all of the existing UCaaS cloud services offers would still not be able to pass gate 1. This is due in part to the products used to implement the services not being on the APL or deployed in a manner conforming to the tested configuration. It is also due in part to the Government’s proposal submission and accreditation schedules, which do not support rectification of the APL listing issue or the deployed configuration issue.

d) The criteria in the amended gate 1 requirements will cause bidders to either drop existing cloud service offers from their solution design or to bid cloud solutions that risk not passing Gate 1 and being deemed unacceptable. Those bidders that do not want to take on the risk or cannot develop alternate solutions in time to meet the proposal submission deadline will choose not to participate. This will limit competition and increase risk to the Government. a) Unified Capabilities Certification Office (UCCO) test interoperability and security to these requirements based on system regardless of hosting/connection.

b) Gate 1 does not currently specify "cloud based service solutions". see above question for detailed answer.

c) Proposals are limited to the products on the APL. However, the offeror may propose delivery and implementation architectures for those products that differ from what was tested for the APL, so long as functionality and security are not degraded.

d) Gate 1 does not currently specify "cloud based service solutions" therefore the Gate does not need to be modified.

34 Guidance in Amendment 2 Vol I Gate 2 Phase One and Phase Two Requirements (amendment 2) changed the requirements in such a way that has helped rectify some problems within portions of the RFP; however, has not addressed overall issues of risk and limited competition. For example, the amended gate 2 requirements make it easier to propose non-cloud solutions. It also eliminated IL-6 requirements from gate 2 and the relaxed IL-6/SIPRNet authorization schedule all of which have helped reduce risk, however, a number of critical issues remains.

a) The Government’s categorization structure, splitting solutions into cloud-based and non-cloud-based groups have no clear definition, and their unique requirements have made it difficult for bidders to assess the impact to their solutions, much less address them in the time allotted before submitting their binding proposals.

b) In addition, the categorization structure has made it much easier for non-cloud-based solutions to generate the documentation required for gate 2, as only a milestone schedule is needed to minimally comply with the documentation requirements. The Government is entirely dependent on the information the bidder presents in that milestone schedule to assess the schedule risk associated with the authorization requirement. Cloud-based solutions still must have a DoD PA or undergo a readiness assessment and provide a 3PAO-generated RAR.

c) The retention of the (C)+90 timeline for the IL-5 PA/NIPRNet IATO leads bidders to look towards cloud solutions to minimize the financial and schedule risks, with commercial UCaaS services that already have a DoD PA being particularly desirable. The effects of the gate 1 requirement changes have increased the likelihood that solutions based on these UCaaS services would need to change due to the reasons described above. This forces bidders to look for other UCaaS services that do not have issues with the gate 1 criteria or to switch to solutions based cloud infrastructure services, all in an effort to address the authorization timeline. This now forces bidders to follow the readiness assessment path, with the same challenges present in the original gate 2 requirements, but now with an entirely new solution imposed on them shortly before their proposal is due.

Microsoft_Word_Docume…