SW_Code_Assessment_RFP_Questions_Amemdment_2.pdf

W56JSR-17-R-0004 Amendment 2 Software Code Assessment Questions

Questions Answer / Remarks

1. Per the DoD’s definition, “IASAE Level II personnel are responsible for the design, development, implementation, and/or integration of a DoD IA architecture, system, or system component for use within the Network Environment (NE).” The vast majority of IASAE Level II certified personnel possess skills related to security engineering, systems engineering, information assurance, and systems administration. Very few software developers focus their training on IASAE related tracts (i.e., CISSP, CASP, etc.).

Is the Government aware that the suggested LOE may be in conflict with market reality? Would the Government be willing to consider and accept alternative distribution of labor categories and LOE levels in response to the final

RFP?

Please take note of the updated files included in Amendment 1 of the RFP to include the solicitation file. The PWS and updated Appendix A are now included in the solicitation file. The Senior Software Developer position no longer has the reference to AR- 252-2.

Traditionally the baseline certifications were more focused on platform security and not development, but the certifications listed in the RFP are very relevant to the analysis that we're requiring. To operate without such certifications would be an increased risk to the Government.

No, the Government will not allow LOE or labor category deviations.

2. Section L.17.1, in addition to an Offeror/Prime Contractor submitting its own Past Performance reference(s), can an Offeror/Prime Contractor submit (as part of the Prime’s proposal submission to the Government) a Past Performance reference from its Subcontractor?

If yes, can this subcontractor reference be distinct from the

Prime’s reference? (e.g., Prime Contractor’s past performance reference is from Contract X, and Subcontractor’s past performance reference is from Contract Y)?

No. The Past Performance must reflect the work of the Prime. In accordance with L.17.4e the examples submitted may be performed either as a Prime or as a Subcontractor.

3. In the case of an offeror without a record of relevant past performance or for whom information on past performance is not available or so sparse that no meaningful past performance rating can be reasonably assigned, the offeror may not be evaluated favorably or unfavorably on past performance (see FAR 15.305 (a) (2) (iv)). Therefore, the offeror shall be determined to have unknown past performance.

a. In the context of acceptability/unacceptability, "unknown" shall be considered "acceptable." Can the Government please clarify?

b. If no past performance is considered "acceptable", and submitted past performance can be judged either acceptable or unacceptable, it follows that a successful offeror could reasonable submit no past performance.

Please confirm our understanding of the requirement related to past performance.

Past performance information is one indicator of an offeror’s ability to perform the contract successfully. The currency and relevance of the information, source of the information, context of the data, and general trends in contractor’s performance shall be considered.

4. Could the government consider the small business prime to provide one relevant past performance instead of all three past performances and allow the small business prime’s partner(s) to provide the rest?

No. The Past Performance must reflect the work of the Prime. In accordance with L.17.4e the information submitted may be either as a Prime or as a Subcontractor.

5. In section C.3.1.7 Personnel Qualifications of this solicitation, it states, “Contract staff shall have a U.S.

Army recognized computing environment certification in accordance with DoD 8570.01-M Paragraph C.3.2.4.8.3.”

In Paragraph C3.2.4.8.3 of DoD 8570.01-M it states, “In addition to the IA baseline certification requirement for their level, IATs with privileged access must obtain appropriate Computing Environment (CE) certifications for the operating system(s) and/or security related tools/devices they support as required by their employing organization. If supporting multiple tools and devices, an IAT should obtain CE certifications for all the tools and devices they are supporting.” From a resource planning perspective, this requirement seems restrictive.

a. Will the Government consider relaxing this requirement as it would be difficult for resources to have CE certifications for all of the tools mentioned in Appendix B of this solicitation at start of this period of performance?

b. Can the Government please clarify if they are requiring certifications for contract staff for each of the tools listed in Appendix B?

c. Will the Government please clarify if CE certifications must be obtained by Day 1 of the period of performance?

If no, when will the Government want these certifications to be obtained by?

For the purposes of Software Assurance assessments, it is not expected that all analysts have certifications specific to each individual Software Assurance Tool. All analysts should have computing environment certifications which address the overall concepts of code analysis, and should have certification for the platform on which the code they are analyzing will run. For example, analysts assessing code built to run in a Windows environment should have a Windows relevant CE certification, and a certification that demonstrates knowledge of code assessment or development security practices. DoD 8570.01-M Paragraph C2.3.9 specifies the required timelines for contractors to obtain baseline and CE certifications. The requirement is as follows: “Contractor personnel supporting IA functions in Chapters 3, 4, 10, and 11 shall be appropriately certified obtain the appropriate DoD-approved IA baseline certification prior to being engaged.

Contractors have up to 6 months to obtain the rest of the qualifications for their position outlined in AP3.T1.”

6. In Appendix A: Personnel Qualifications, item number 7 for the labor category of Program Manager states that the minimum qualifications include “shall possess Army Acquisition Corps Level 2 certification in logistics, program management OR information technology OR recognized industry equivalent professional certification.”

To avoid any confusion, we request the Government to provide a list of recognized industry professional certification is equivalent to the Army Acquisition Corps Level 2 certification for logistics, program management, or information technology?

In addition to DoD Acquisition Certifications, recognized industry equivalent professional certifications include Project management professional (PMP), Certified associate in project management (CAPM), CompTIA Project+, Master Project Manager (MPM), Certified Project Manager (CPM), Project Management in IT Security (PMITS), Associate in Project Management (APM), Professional in Project Management (PPM), Certified Project Director (GAQM), or project management certificates through industry recognized and accredited college or university business, management or professional education programs.

7. Appendix F of this solicitation is the Contractor Employee, Personal Financial Interest / Protection of Sensitive Information Agreement.

a. Can the Government please clarify if Appendix F of the solicitation is required to be submitted for all Key Personnel as part of this proposal submission?

b. If no, can the Government please clarify when should

Appendix F be submitted for all contract staff?

c. If no, will the contractor have interim access to the Army network and the classified information required to perform their duties as mentioned in the solicitation while they are undergoing the SECRET clearance process?

Before the contractor can begin work on the contract the non-disclosure, protection of sensitive information agreement, and security clearance must be in place. No access can be provided to un-cleared personnel.

8. Section C.3.1.2 states “The highest level of facility clearance required for performance on this contract is SECRET, with personnel clearances at the SECRET level.

a. Can the Government please clarify whether the facility clearance requirement and the personnel clearance requirement at the SECRET level are required by Day 1?

b. If no, by what time during the period of performance will contract staff need to have obtained SECRET clearances with consideration given to the time it takes to complete the SECRET clearance process?

c. If no, will the contractor have interim access to the Army network and the classified information required to perform their duties as mentioned in the solicitation while they are undergoing the SECRET clearance process?

The successful bidder must have a facility clearance to perform on the contract. The facility clearance is required to be SECRET and personnel need to have clearances before they perform work on the contract since un-cleared personnel cannot perform the work and un-cleared personnel will create an undue burden on the government in terms of requiring escorts for each contractor.

9. In section L.17.1 it states that “Offerors shall submit three

(3) recent and relevant past performance references.”

However, in M.4.3.3 Past Performance it states, “In the case of an offeror without a record of recent, relevant past performance or for whom information on past performance is not available or so sparse that no meaningful past performance rating can be reasonably assigned, the offeror will not be evaluated favorably or unfavorably on past performance. Therefore, the offeror shall be determined to have unknown past performance. In the context of acceptability/unacceptability, an unknown rating shall be considered acceptable.

To have fair competition for small businesses who have recent and relevant past performance qualifications, can the Government consider changing the statement “an unknown rating shall be considered acceptable.” to “an unknown rating shall be considered unacceptable.”?

No, the acceptable rating is in accordance with FAR 15.305(a)(2)(iv) In the case of an offeror without a record of relevant past performance or for whom information on past performance is not available, the offeror may not be evaluated favorably or unfavorably on past performance.

10. Section L.19.4 states the “The offeror shall date, sign and return the completed Standard Form 33 and any amendments along with Exhibit B and C listed above prior to the proposal due date as posted on FedBizOpps.”

Can the Government please clarify which document constitutes Exhibit C as it was either not part of the documents provided or labeled Exhibit C.

Section K is within the solicitation document (SF33) itself.

Reference to “C” in L.19.4 is a typo. It should read Attachment 002 (DD254) as listed in L.19.3 and has been updated in the Amendment 1 files posted to FBO.

11. Section C3.1.7 Personnel Qualifications states, “For purposes of surveillance, resumes of contractor personnel performing support services as described within this PWS are subject to verification by the COR to ensure that the support personnel meet or exceed the proposed category descriptions, qualifications, and possess the minimum technical skills and experience specified at Appendix A of this PWS.

a. Can the Government please clarify if resumes of the critical personnel listed in Appendix A will need to be submitted as part of this proposal?

b. If so, what are the page limitations and format requirements for the resumes that will need be submitted?

No, resumes are not part of the proposal submission package.

12. Can the Government please provide any Organizational Conflict of Interest clauses that would restrict any incumbent development vendors that are currently supporting the 84 to the eventual 98 systems that are covered by this solicitation?

Organizational conflict of interest is covered in FAR Subpart 9.5 with specific provisions and clauses listed at FAR 9.507.

13. Does the Government expect to issue an amended SF 33 as is often done when a solicitation is amended, or should we complete and submit the SF 33 issued with the original solicitation?

An amended solicitation (SF33) was posted to FBO along with all other solicitation documents when Amendment 1 was posted to

FBO

14. Since Paragraph L.1 of the solicitation references FAR 52.204-7, does that mean, in accordance with RFP K-6(e), that an offeror whose annual certifications and representations (certs and reps) listed in K-6(d) are up to date in SAM, that the offeror need not submit any certs and reps in Volume IV?

Also, if the offeror's K-6(d) certs and reps are up to date with the exception of a few changes, is our response to paragraph K-6(e) with the changes annotated the only cert and rep that must be submitted in Volume IV?

Yes

Yes

15. Is the government only looking for government past performances?

Are there any restrictions from using past performance from commercial entities as long as the proposed past performances meet: recent, relevant, size, scope, complexity and can show a relationship to C4ISR systems?

Recent and relevant past performance is defined in Sections L.17.2 and L.17.3 with examples listed in L.17.4.

There are no restrictions from using past performance from commercial entities if the can show a relationship to C4ISR systems.

16. Could the Army please provide Offerors with a web address of the 8140.01M manual that defines the certification requirements? We are familiar with the DOD 8140.01M policy document, but do not know of a corresponding manual. Or are Offerors to satisfy this requirement by providing a person certified in IASAE Level II according to the 8570.01-M manual dated 11/10/2015?

DoDD 8140.01 states that it “reissues and renumbers DoD Directive (DoDD) 8570.01 … to update and expand established policies and assigned responsibilities for managing the DoD cyberspace workforce.”

There are no specific training requirements for DoDD 8140.01 and DoD 8570.01-M, the Information Assurance (IA) Workforce Improvement Program manual is still in effect. Until the 8140 manual is written and signed, there isn’t much direction, only to abide by the DoD 8570 manual until further notice.