Attachment_0019_Answers_and_Clarifications.xlsx
XLSX spreadsheet 28 KB Posted
- Solicitation number
- W52P1J-16-R-0172
About this file
Attachment 0019 Answers and Clarifications
View the file
Other files
Show 40 more
Latest 50 of 57 listed here. See the rest on GovTribe.
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| ADDITIONAL QUESTIONS/COMMENTS AND ANSWERS - REQUEST FOR PROPOSAL (RFP) UC SOFT CLIENT (W52P1J-16-R-0172) | ||||||||
| RFP Section | VOLUME | ATTACHMENT | PAGE | PARAGRAPH | QUESTION/COMMENT | RESPONSE | Assigned POCs and responses | |
| 1 | SOO 2.2 | 2.2 | 1 | 8 | Bullet 1 | In SOO, page 8, Section 2.2, bullet 1, for On-Premise solutions, the SOO now requires the "entire solution" must be have gone through JTIC certification process referencing both hardware and software. Please provide the link where bidders can find the JTIC certified list for all hardware and software products that are outside the UCAPL including the list of servers, storage devices, and management software tools that are JTIC certified. | ||
| The Department of Defense Information Network Approved Products List (DODIN APL) is established in accordance with the UC Requirements (UCR 2013) document and mandated by the DOD Instruction (DODI) 8100.04. Its purpose is to maintain a single consolidated list of products that have completed Interoperability (IO) and Cybersecurity certification. Use of the DODIN APL allows DOD Components to purchase and operate systems over all DOD network infrastructures. |
| The DODIN APL is the only listing of equipment by DOD to be fielded in DOD networks. DOD components are required to fulfill their system needs by only purchasing DODIN APL listed products, providing one of the listed products meets their needs. This means the DODIN APL must be consulted prior to purchasing a system or product. If no listed product meets the organization's needs, they may sponsor a product for testing that does meet their needs. http://www.disa.mil/network-services/ucco https://aplits.disa.mil/processAPList.action | Patrick Ward - The APL is publicly accessible at https://aplits.disa.mil/processAPList.do. The DoDIN APL is the single consolidated list of products that have completed Interoperability (IO) and Cybersecurity (CS) certification. For specifications regarding the use of the DoDIN APL please refer to the UCR 2013. For questions regarding the use of this page, please contact the APCO at disa.meade.ie.list.approved-products-certification-office@mail.mil | ||||||
| 2 | Evaluation Factor for Award 1.1 | 1.1 | 3 | 1 | Item b. | In Attachment 3, page 1, letter b, it requires that the solution proposed and evaluated in Phase I to be the same solution proposed in Phase II. |
Is it correct to assume you mean specifically the solution in Gate 1 of Phase 1 must be the same as the Phase II solution?
| Yes the solution proposed in Gate 1 Phase 1 must be the same solution as proposed in Phase II. | Yes the solution presented in Gate 1 Phase 1 must be the same solution as proposed in Phase II. | ||||||
| 3 | SOO | 5 | 1.2 | "U.S. Army Business users will access the UC Services from a standardized application on the user’s end-user devices, such as desktop computer, laptop, or mobile device". Does the Army intend to also utilize any telephone instruments that support VoIP, VoSIP desktop phone devices/terminals as well? If Yes, then how many will be VoIP/VOSIP EUD’s? | The Army does not expect the Offeror to support non IP based instruments. The Offeror should be prepared to support an IP based instrument per user and per domain, i.e., 900K users on NIPR and 100K user on SIPR. | Patrick Ward - Telephone instruments are not expected to run UC soft client software. | |
| 4 | SOO | 5 | 1.2 | Please explain or provide more clarity on "coalition networks" that are not within scope of this effort? | Additional information on coalition networks will not be provided at this time. Offerors should be prepared to service users on both NIPR and SIPR. Coalition networks such as CENTRIX is out of scope. | ||
| Cheryl Hynes - Additional information on coalition networks will not be provided at this time. | |||||||
| 5 | SOO | 6 | 1.3 | From an evaluation perspective, will a solution that is intended or planned to be installed and supported as U.S. Army "On-Premise based Software as a Service (SaaS) whereby a CSP controls the "underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities"" fit within the evaluation criteria as defined in section 3.1.1 of the DoD Provisional Authorization (PA)? In doing so, if the CSP/CSO is setup within the confines of a U.S. Government approved Data Center facility/location as define in DoD CC-SRG v1r2, section 5.2.1.1, then does the requirement for FEDRAMP and FEDRAMP+ no longer apply within the scope of the evaluation criteria? |
1. "On-Premise" includes DoD data centers or other facilities located on a DoD Base/Camp/Post/Station (B/C/P/S) under the direct control of DoD personnel and DoD security policies. If an on-premise solution is proposed, the infrastructure must meet security standards and controls within DoDI 8500.01 and 8510.01 Risk Management Framework (RMF). A "Hybrid" includes a combination of cloud-based and on-premise. In the "hybrid" any part of the solution which is cloud based must obtain and meet the requirements for a DoD Provisional Authorization (PA) at IL5 (NIPR) and IL6 (SIPR) in which a FedRAMP or FedRAMP+ PA are applicable.
2. FedRAMP and FedRAMP + apply.
| Sally Dixon - Good as written | |||||
| 6 | SOO | 5 | 1.2 | It is stated that NIPRNet and SIPRNet users/clients would have separate instances of "the UC Soft Client Subscription Services". Please define what the Government means by this and what the expectation of "Separate Instances" as per the request? For example, would it be deemed acceptable to have established a separate domain for NIPRNet users and another separate domain for SIPRNet users on the same CSP? | REF (DoD Cloud Computing SRG, V1R2, 18 March 2016) 5.2.2.3 Impact Level 5 Location and Separation Requirements. Information that must be processed and stored at Impact Level 5 can only be processed in a DoD private/community or federal government community cloud, on-premises or off-premises in any cloud deployment model that restricts the physical location of the information as described in Section 5.2.1, Jurisdiction/Location Requirements. |
5.2.2.4 Impact Level 6 Location and Separation Requirements
Impact Level 6 is reserved for the storage and processing of information classified up to SECRET. Information that must be processed and stored at Impact Level 6 can only be processed in a DoD private/community or Federal Government community cloud..
• Impact Level 6 information up to the SECRET level must be stored and processed in a dedicated cloud infrastructure located in facilities approved for the processing of classified information, rated at or above the highest level of classification of the information being stored and/or processed.
• Impact Level 6 CSO infrastructure is considered to be a SIPRNet enclave and as such will be a closed self-contained environment for the CSO processing, storage, and management planes only connected to SIPRNet. Sally Dixon - REF (DoD Cloud Computing SRG, V1R2, 18 March 2016) 5.2.2.3 Impact Level 5 Location and Separation Requirements. Information that must be processed and stored at Impact Level 5 can only be processed in a DoD private/community or federal government community cloud, on-premises or off-premises in any cloud deployment model that restricts the physical location of the information as described in Section 5.2.1, Jurisdiction/Location Requirements.
5.2.2.4 Impact Level 6 Location and Separation Requirements
Impact Level 6 is reserved for the storage and processing of information classified up to SECRET. Information that must be processed and stored at Impact Level 6 can only be processed in a DoD private/community or Federal Government community cloud..
• Impact Level 6 information up to the SECRET level must be stored and processed in a dedicated cloud infrastructure located in facilities approved for the processing of classified information, rated at or above the highest level of classification of the information being stored and/or processed.
• Impact Level 6 CSO infrastructure is considered to be a SIPRNet enclave and as such will be a closed self-contained environment for the CSO processing, storage, and management planes only connected to SIPRNet.
| 7 | SOO | 1.2 | If there is no defined deployment of Command and Control (C2) users with E911/911 services, precedence and pre-emption, etc., as mentioned in Paragraph 7 of Admendment_0018, what is the intent to have a separate environment for NIPRNet and SIPRNet? | See response for Question 6. | Cheryl Hynes | ||
| 8 | SOO | 6 | 2.1 | Can more clarification be provided that defines the On-Premise Hosting, indicating that a CSP solution would/could be located in a DoD approved (B/C/P/S) and if so, is FEDRAMP IL5 or IL6 or RMF still required? There are solutions available that are able to provide "Cloud" like services within the confines of the U.S. Army data centers. These would/could be defined as stated in reference document DoD CC SRG v1r2, section 5.2.1.2 Paragraph 2. | 1. On-premise hosting is a DoD data center or other facility located on a DoD B/C/P/S it is not a "cloud-based" solution or considered a CSP solution. Only the Hybrid solution would be considered a CSP with the combined use of a an on-premise DoD data center as a part of the infrastructure support. | ||
| 2. Yes the requirement does not change. | Sally Dixon - 1. On-premise hosting is a DoD data center or other facility located on a DoD B/C/P/S it is not a "cloud-based" solution or considered a CSP solution. Only the Hybrid solution would be considered a CSP with the combined use of a an on-premise DoD data center as a part of the infrastructure support. |
2. Yes the requirement does not change.
9 SOO 7 2.1.1 As stated that offer will be afforded the opportunity to conduct a site survey 30 days after award. As the Offerors provided a price based on selecting one or more of the location in section 2.1.1, what is the recourse plan, if upon the site survey inspection, the location will not or does not meet the Data Center requirements to support the Private On-Premise CSP solution? If none of the locations meet the data center requirements to support the private on premise CSP solution, then the government will peform necessary upgrades or propose alternate locations.
| The government will reduce the risk of contract delays by selecting sites that will require minimum upgrades. | Cheryl Hynes | ||||||
| 10 | SOO | 16 | 2.6 | It should be noted, that Tier 3 level support should/will be provided by the OEM vendor of record in collaboration with the CSP as Tier 3 support is only available from the OEM. It does not just refer to technical competency. It refers to access to Intellectual Property, software tools, and patches or other system updates. No other company other than the OEM has access to the IP software code. Please update requirements. | Tier 3 level support for software is OEM. Tier 3 level support for a "service" provider may not be OEM and could be supported by a 3rd party. | Cheryl Hynes/Larry Patterson | |
| 11 | SOO | 8 | 2.1.3 | Attachment_003, section3.2.1.1.e and this section of the SOO make reference to “ a standardized enterprise service which includes portability of licenses and technical refresh”. Will the USG provide what expectations the Government has or what specifically the Government is requesting by these statements? | The Army considers the user as an IP address and the license is not tied to a device. | ||
| Cheryl: Does portability also refer to the user is licensed and not the device? By this I mean I have a TDY laptop or go TDY and use another device besides the device I use at my normal work station. Do not want to have to purchase another license just because I use another device . | Cheryl Hynes/Gregg Judge | ||||||
| 12 | SOO | 12 | 2.2.10 | Stipulates that “the Solution shall have no single point of failure that could cause an outage of more than 0.1% of users." Please provide further details and clarification as whether this applies to a specific segment of the solution, whether this should be considered an SLA, and more detail as to how this should pertain to the operation of the solution. Is the requirement specifically geared at the B/C/P/S end points, the different type Enclaves (Type 1, 2, or 3), or something different? | "No single point of failure" implies a weakness in any portion of the network and with regard to those devices which make up the network either within a CSP-CSO environment or supported by a B/C/P/S distributed data center and must be provided for both NIPR and SIPR, i.e., virtual machine, server, application, switch, power, HVAC, etc. any and all of these network devices in support of the solution could fail and be a single point of failure which could cause an outage of more than 0.1% of the users. The intent would be related to three specific facets to be provided by the selected vendor as follows: |
1. Service Level Agreement would need to stipulate the need for High Availability within a CSP-CSO or within a distributed data center.
2. High Availability relates to provisioning of redundant devices to support load-balancing and failure-over, i.e., redundant hot standby virtual machines, redundant servers, redundant applications, power sources, HVAC, a meshed network capability in the planned architecture which provides for switching IP traffic to alternate network segments when congested.
3. Selected vendor is required to provide a DR plan and a COOP both are to be used to ensure adequate service level agreement within a CSP and within a distributed data center/facility to ensure high availability and reliable service.
| ISEC/Keith Moore | ||||||||||
| 13 | SOO | 17 | 2.10 | There is a reference in this section that the contractor/Offerors shall follow Change Control process as referenced in Section 5.3.2 Change Control, in the DoD Cloud Computing SRG v1r2, which directly refers to the process and procedures mirrors that of FEDRAMP. What recourse or actions are defined for Offerors who are mandated to comply with RMF instead? | The software solution must comply with RMF to obtain an ATO within the CSP. This is because the software solution must contain its own security certification to enable it to operate within any environment (a new CSP, a hybrid or an on-premise data center). The CSP must also have its own security certification and must comply with the DoD Cloud Computing SRG v1r2. These are two different security factors. 1. An RMF is applicable to the software solution as a system or capability which resides in the environment where is it is to be hosted, i.e., a CSP. 2. The CSP must be certified to comply with the DoD Cloud Computing SRG v1r2 which is a security certification for a DoD PA IL5 or IL6 and inclusive of FedRAMP PA. | Sally Dixon - Good as written | ||||
| 14 | SOO | 2.11 | Regarding the Test and Evaluation objective, can/will the 45 day milestone be extended due to impacts or issues found during the site survey which is within 30 of contract award? if something is found during the Site Survey, it could and probably will impact the Test and Evaluation objective due to adjustment or changes found during the site survey. | The government considers 45 days to sufficient. | ||||||
| The SOO, stipulates the requirements the offeror must meet in support of system test plan in Appendix B. CDRL Summary, CDRL A017 System Test Plan is a "DRAFT" that is to be submitted within 45 days of contract award for Government review and approval. Document shall be "UPDATED" during contract performance as required. The offeror is being provided a method to make adjustments to the test plan as indicated only a draft is due within 45 days and the document is expected to be updated during the contract performance "as required. | The question of extensions based on impacts or issues found during site surveys is at the discretion of the Government. | Cheryl Hynes | ||||||||
| 15 | Attachment 3 | 1 | 1.1 b | "Contract award will be made to that Offerors whose proposal offers the best overall value to the USG based on an integrated assessment of the non-price and price related factors." Since the revised SOO has not called out specific architectural criteria, desired on-premise installation locations, user count by location, potential conferencing statistics, etc., please explain how the Government will compare and evaluate proposals from the various Offerors. | Evaluation factors for award are listed in Attachment 0003 of the solicitation and each proposal will be evaluated against these factors and critieria. | Architectural criteria is defined in the SOO as cloud services. The Government will evaluate proposals based on the offeror's ability to provide the services described in the SOO. | Cheryl Hynes/Architecture design will be provided. | |||
| 16 | Attachment 3 | 1 | 1.1 b | No additional definition was provided in the amended documents on the requirements for the design of the solution: i.e. number of users by location, frequency of video conferences, number of conferences expected to be conducted concurrently, facility grade of service required, number of SIP trunks by geography, etc. This is synonymous with buying a car: they all have 4 tires, a steering wheel and an engine but no one would argue that a Smart Car requires different consideration than a top-of-line Mercedes Benz or Rolls Royce. Therefore, please provide the engineering information and most important operating criteria on which all Offerors can design their solution. If no additional information will be provided, please specifically detail on what criteria the government will compare responses for evaluation since each Offeror's solution might be completely unique from others. Another example, one Offeror might provide a hosted solution utilizing multiple datacenters, another Offeror might centralize their architecture in 2 datacenters and a third might be offering an on-premise solution that has yet a completely different network mapping? | The SOO specifically identifies the requisite number of users and the specific operational requirements for those users. It is not necessary at this time to provide specific location and frequency of use information as this is sensitive information related to the concept of operations and will not be provided to the Offeror until after contract award. The Offeror is to provide a response based upon the information as indicated in the SOO and what it believes will provide the Government the best value. | No additional definition will be given. Offerors have the requirements based on expected service levels specified in the SOO. These are the criteria for evaluation. | Cheryl Hynes/Kevin Efram | |||
| 17 | VI | Pricing Spreadsheet | All Annual Tabs | Column H | The provided pricing spreadsheet includes a percentage (weightings) in Column H on all annual (Base Year, Opt Yr. 1, etc.) tabs that modifies the Offerors inputted unit and overall extended price. Since it modifies our pricing based on the requirements of the RFP, Offerors could manipulate their entries to reflect an alternative overall solution cost. It also appears to be a misrepresentation of an Offeror's true cost of the solution and could make the Government vulnerable to negotiations post award. Can the Government please explain what these percentages represent and why the Government is modifying the pricing that the Offeror is providing in this manner? | The weights are for evaluation purposes only to calculate a total evaluated price, and doesn’t impact items post award. Prices proposed on the price model are fixed for the life of the contract. | The weights for evaluation purposes only and are based on the likely hood the Government will order in that range during a certain period of time. The weights for evaluation purposes only to come to a total evaluated price, and doesn’t impact items post award. Prices proposed on the price model are fixed for the life of the contract. | |||
| 18 | Amendment 18 | Section A | #8 | Amendment 18 states “In the Government's evaluation of Gate 1, the Government is stating that its use of the RAR and the SAR is not a specific part of the |
certification process for issuing an IL5 PA, but instead, it is being used strictly as a proposal evaluation capability. This will allow the Government to ascertain a CSP's ability to meet the operational requirements in the timeline required.” There is substantial cost to preparing the RAR and SAR. If the Government is correct that obtaining IL5 PA is no big deal within 180 days, why should a CSP be expected to prepare those documents before contract award and incur the expense?
| As a part of this readiness review it is important to determine how well the CSP-CSO is prepared with a draft package of assessment documents and artifacts to obtain DoD PA IL5 within 180 days, i.e., 3PAO SAR and SAR briefing; a DoD Readiness Assessment Report (RAR) prepared by the 3PAO. | RAR and SAR preparation prior to contract award is at the discretion of the offeror. | Sally Dixon - Paragraph 3.1.1 requires cloud based solutions to at a minimum submit the RAR. It does not state the RAR or SAR is not part of the IL5 certification process for obtaining a IL5 PA. | |||
| 19 | Amendment 18 | Amendment 18 states “The U.S. Army Unified Capabilities (UC) Request for Proposal (RFP) is not targeted towards a single source, but instead seeks a creative and conceptual UC (Soft Client) "as a Service" design which is modernized and offers the best value to the U.S. Army. The RFP does not necessarily seek a service which is currently utilized in the commercial world as an all-in-one platform; a hybrid platform proposal is acceptable. Therefore, vendors are encouraged to be innovative in their proposal and demonstrate overall value and how it will deliver immediate impact to U.S. Army users.” This is a great objective however, the Army is limiting competition by mandating a 180 day timeframe requirement for achieving PA IL 5 for any Cloud deployment in a commercial data center. If the Army truly desires to see all technical solutions be evaluated by the CSPs, this needs to be a level playing field. Can the Army remove the unnecessary timeframe mandated? | |||
| As a part of this readiness review it is important to determine how well the CSP-CSO is prepared with a draft package of assessment documents and artifacts to obtain DoD PA IL5 within 180 days, i.e., 3PAO SAR and SAR briefing; a DoD Readiness Assessment Report (RAR) prepared by the 3PAO. | The Army desires to see the SOO awarded to the offerer who can meet the requirements within the Governments timeframe and cost limits. | Cheryl Hynes/The government and appropriate agencies have determined that 180 days is sufficient. | |||
| 20 | Amendment 18 | Amendment 18 states “The current SOO and RFP does not limit an offeror from proposing a non-UCCP solution. All solutions that are UC APL compliant (UCCP, ESC, LSC) are acceptable as clarified in the SOO. The Government will not limit competition by placing a statement in the solicitation that states only UCCP, only ESC, or only LSC solutions will be considered.” We find this statement interesting that the Government is stating they won’t limit competition changing the requirement to the proper LSC or ESC category. Did the Army confirm the appropriate category with DISA and OSD-CIO for a system that has a stated scope in FOC to include Enterprise Voice? UCCP by definition lacks the necessary requirements. | |||
| All three categories listed in the SOO are acceptable. The Army is seeking a collaboration suite (CHAT/IM presence and screen sharing) and not just a voice or video solution. | The Army has confirmed appropriate requirements with other Government entities. Offerors are free to define their solution as needed to meet the requirements defined in the SOO. | Yes. | |||
| 21 | Amendment 18 | Amendment 18 states “The timeline established for obtaining a Provisional Authority (PA), Impact Level 5, at 180 days after contract award is not unreasonable and has been verified with the appropriate agency. The Army has determined this schedule, within reasonable timelines allowed and vetted with the appropriate agency, does allow Offerors who have solutions already in or beginning the FED Ramp process an opportunity to propose. If the 180 timeframe is not unreasonable and has been thoroughly vetted with the appropriate agency, why is it still a MAJOR requirement for Gate 1. The Government has clearly stated that any vendor solution already in or beginning the FEDRAMP process should be able to meet the 180 day timeframe. In order to level the playing field and insure fair, open and full competition as the Army committed, this unnecessary timeframe constraint should be eliminated as the Army has clearly stated the timeframe should not be an issue for any vendor. Leaving this timeframe in place clearly validates the Army’s intent to limit competition otherwise there is no downside to removing it. | |||
| As a part of this readiness review it is important to determine how well the CSP-CSO is prepared with a draft package of assessment documents and artifacts to obtain DoD PA IL5 within 180 days, i.e., 3PAO SAR and SAR briefing; a DoD Readiness Assessment Report (RAR) prepared by the 3PAO. | The Army desires to see the SOO awarded to the offeror who can meet the requirements within the Governments timeframe and cost limits. | Cheryl Hynes/The government and appropriate agencies have determined that 180 days is sufficient. | |||
| 22 | Amendment 18 | #9 | Amendment 18 states “The requirement for PSTN/DSN has been validated and is an important interim step for the Army to synchronize with base/post/camp/stations modernization and decommissioning TDM switches. The Army realizes this will not allow complete decommissioning of TDM at base/post/camp/stations but will allow the Army to begin executing opportunities for divestiture and to optimize its end user instruments." It remains clear from the lack of changes to the SOW that the Army has not synchronized its plans to modernize its voice infrastructure between PD-ES and PD I3MP. The requirements in the SOW show a focus on conferencing and collaboration and not voice. The RFP states several places that somehow this system deployment will allow decommissioning of the aging voice TDM infrastructure and optimize its end user voice instruments. Without a complete voice modernization strategy this will not happen. EVoIP and UC are the same platforms. The only difference is what licenses are turned on. Why does the Army continue to down play the need to modernize a TDM base that needs to be upgraded, especially when the US Army states that one of the primary intents is to decommission legacy TDM switches? and when voice licenses will be included as part of this acquisition? The purpose of Unified Capabilities is to take advantage of the synergies provided by a Unified deployment that includes voice in addition to the other capabilities and functionality. | ||
| The objectives as identified by the Government are provided in the SOO and these are the objectives that have been identified by the Army as being required to meets its needs. | The Army is working in a dynamic environment where capabilities and requirements are not readily linked for existing architectures and emerging solutions. Offerors are free to propose courses of action that they deem are in the best interests of the Army, and will be evaluated in accord with the SOO. | Cheryl Hynes | |||
| 23 | SOO | 6 | 2.1.1 | There are primarily two deployment models. Commercial Data Center and On Premise Government Data Center. Please confirm the following questions with a yes or no. |
In a commercial Data Center deployment, is FEDRAMP is required?
In a Government Data Center (per the list in Section 2.1.1 of the SOO), is only RMF is required?
In a Commercial Data Center and On premise Government Data center FEDRAMP and FEDRAMP+ is applicable
In a Government Data Center FEDRAMP, FEDRAMP+ and RMP is applicable Yes. No. Sally Dixon -
1. Yes if it is a cloud based solution.
2. If the solution is not a cloud based solution, the RMF is required.
| 24 | Amendment 18 | Will the Government be open to and accept a contractor provided software solution that would be hosted on Government servers in a Government data center with an operational model where the contractor would be responsible for all operation, maintenance, and software upgrades? | No. The government is looking for a contractor owned and operated solution | As stated in the SOO, Government hosted solutions will be considered for OCONUS locations. | No. The government is looking for a contractor owned and operated solution |
| 25 | Amendment 18 | Please explain how the Army strategy is aligned with the JIE and DoD CIO direction. Why are the Army requirements not being hosted out of the JIE data centers and protected by the JRSS nodes? | The Army strategy is aligned with the JIE and DoD CIO direction. The SOO requires end users to be protected by the JRSS for cloud services. |
| The Army strategy is aligned with the JIE and DoD CIO direction. The SOO requires Cloud Services with end users protected by the JRSS. | Cheryl Hynes | ||||||
| 26 | Amendment 18 | Given all the changes to the documents, the Offeror is requesting an extension of the due date as teams have to be reassembled, assessment has to be completed, additional information from the Government is required and, ultimately, the solution design has to be rearchitected in line with the changes. A more reasonable timeframe would be forty-five (45) days assuming the Government provides information and answers in a timely fashion. | Please refer to Amendment 0019. | Extensions to the timeline are at the discretion of the PM. | No extension will be granted. | ||
| 27 | Amendment 18 | 6 | 2.1.1 | Please confirm if a different ownership model for the solution implemented in a Government datacenter affects the need for FedRamp or RMF certification. In other words, what certification is required if the solution is Government-owned/Contractor operated (GO/CO) as compared to Contractor-owned/Contractor-operated (CO/CO) in the same Government facility as listed in Section 2.1.1 of the SOO? | The requirement does not change based on GO/CO or CO/CO. The Government is not looking for a GO/CO model. |
| FedRamp is required for all Cloud Services. RMF is required for all Army network solutions. The SOO requires both for this RFP. | Sally Dixon - The requirement does not change based on GO/CO or CO/CO. | ||||||||
| 28 | Amendment 18 | The scope of the Unified Client Subscription Service states that a UC client for non-assured voice calling with be provided to 900,000 Army users. Why is the Government buying expensive UC licenses(all services) for every user when a large percentage of users only require basic capabilities? For example, most users today use single line analog phones vs expensive feature rich multiline phones. The ratio is 90-10 or 80-20. The Government could significantly reduce its deployment costs by including a requirement for a voice only UC soft client. The full UC license could be 6 times the cost of a standard voice license. | The Army is seeking a collaboration suite (CHAT/IM presence and screen sharing) and not just a voice or video solution. | The Government is working toward a standard user service. | The government maintains the requirements as stated in the SOO. | ||||
| 29 | 2.2 UC Soft Client Service Requirements | Unified Capabilities Soft Client Subscription Service Statement of Objectives (SOO) | Attachment 1 | pp. 8-9 | • On premise solutions: hardware (HW) and software (SW) (entire solution) shall have undergone the JTIC certification process for interoperability and information assurance. The solutions providing the required UC capabilities (CHAT/IM, Presence, Voice, Video, and Screen Sharing) must be on the UC APL and UCR compliant. |
• A solution can be listed on the DoD UC APL as an approved UC Collaboration Product, LSC and/or Enterprise Session Controller (ESC). Question: Please confirm that this requirement applies to only the hardware and software components of the UC platform that are part of an on-premises solution and appear on the UC APL under the listed categories: UC collaboration product, local session controller (LSC), or Enterprise Session Controller (ESC).
The intent of this question is to have the Government affirm that only the hardware and software components that fit one of the three listed categories (UCCP, LSC, or ESC) must meet the three compliance tests (JITC certification, UC APL listing, and UCR compliance). The entire UC SCSS solution should not have to exactly match the JITC system under test (SUT) configuration. Presuming this is correct, we recommend the requirement be changed to read as follows:
• A UC SCSS solution component covered by the following requirements can be listed on the DoD UC APL as an approved UC Collaboration Product, Local Session Controller (LSC) and/or Enterprise Session Controller (ESC).
| • On premises solutions: Hardware (HW) and software (SW) components (entire solution) shall have undergone the JTIC JITC certification process for interoperability and information assurance. The solution components solutions providing the required UC capabilities (CHAT/IM, Presence, Voice, Video, and Screen Sharing) must be on the UC APL and UCR compliant. | Reference SOO paragraph 2.2: 1) Off premise products which are owned and operated by the vendor must satisfy minimum JTIC certification for interoperability and IA of the gateway and/or interfaces to the DoD network. The UC products within the commercial data center must meet requirements in the DoD Unified Capabilities Requirements 2013 (UCR 2013) Change 1 dated June 2015. | ||||||
| 2) Off Premise solutions: contractor owned/operated cloud based software subscription services require a minimum JTIC certification of the gateway and/or interfaces. The UC cloud-based software within the commercial data center must meet requirements in the DoD Unified Capabilities Requirements 2013 (UCR 2013) Change 1 dated June 2015. This is the wording required by the DoD CIO to be JIE compliant. | Correct, the entire proposed UC solution does not have to exactly match the JITC SUT. | Cheryl Hynes | |||||
| 30 | 2.3 Cybersecurity Requirements | Unified Capabilities Soft Client Subscription Service Statement of Objectives (SOO) | Attachment 1 | p. 14 | • The contractor will be responsible for generating and providing RMF required accreditation related documentation and artifacts to the Army UC Soft Client Service Information System Security Manager (ISSM). RMF artifacts must be submitted for FedRAMP IL 5 systems Authority to Operate (ATO) NLT 210 days after contract award. FedRAMP IL 6 RMF artifact submission shall be done in a timeframe to allow the Offeror to achieve FedRAMP IL 6 certification no later than 440 days after contract award. | Question 1: Please confirm the authorization schedule for NIPRNet UC SCSS is: RMF document and artifact submission within 210 days of contract award, with system authorization to occur sometime after the submission date and in time to meet the C+440 IOC delivery date. |
| Question 2: Please confirm the authorization schedule for SIPRNet UC SCSS is: RMF document and artifact submission occurs on a Contractor-selected date that provides sufficient time for system authorization within 440 days after contract award. | Referenced in SOO paragraph 2.3: The contractor will be responsible for generating and providing RMF required accreditation related documentation and artifacts to the Army UC Soft Client Service Information System Security Manager (ISSM). RMF artifacts must be submitted for FedRAMP IL 5 systems Authority to Operate (ATO) NLT 210 days after contract award. FedRAMP IL 6 RMF artifact submission shall be done in a timeframe to allow the Offeror to achieve FedRAMP IL 6 certification no later than 440 days after contract award | The schedule is defined in the SOO. | Sally Dixon | |||||
| 31 | 2 | 9 | 3.1.1 | Although the due date for proposals has been extended to March 6, 2017, the Solicitation still instructs offerors to use a “fictional award date” of January 1, 2017 for purposes of demonstrating the ability to obtain Provisional Authorization (PA) within the timeframes called for in the Solicitation. We assume that the use of this fictional award date (which is prior to the revised due date for submission of proposals) is simply an oversight, particularly in light of the Government’s statement in Amendment 18 that it had verified the reasonableness of requiring PA within 180 days after award. Will the fictional due date change from the current 1 January 2017? | This date is fictional and is used for evaluation only to ascertain an offeror's ability to meet this requirement within 190 days. This allows the Government to evaluate all Offerors schedule starting on the same date. If an Offerors is already in the process of PA or RMF as of this date, their proposal/schedule should reflect what steps have already been completed prior to the fictional date and how it will obtain/steps to be taken to achieve PA or RMF within 180 days. | This date is fictional and is used for evaluation only. This allows the Government to evaluate all Offerors schedule starting on the same date. If an offeror is already in the process of PA or RMF as of this date, their schedule should reflect what steps have already been completed prior to the fictional date and how it will obtain PA or RMF within 180 days. | ||
| 32 | 3 | 1 | 1.1 | Are multiple solutions permitted by the Offerors? | The Government assumes this question relates to will the Government accept multiple proposals from the same offeror providing alternative solutions. As provided in the solicitation alternative proposals will not be accepted. | Only a single solution should be proposed. | ||
| 33 | 2 | 13 | 2.2.10 | Is a facility considered a single point of failure (SPOF) by the Army? | The Government requires further clarification of this question. | The government requires further clarification of this question. | ||
| 34 | 1 | 6 | 2.1 | What is the latency on SIPR? | This information is consideration sensitive and will be provided upon contract award. | This information is consideration sensitive. Information can be provided upon contract award. |
File details come from the government source that posted it. Updated .