SW_Code_Assessment_RFP_Questions_Amemdment_3.pdf

W56JSR-17-R-0004 Amendment 3 Software Code Assessment Questions

Questions Answer / Remarks

1. In regards to the SEC’s SW Code Assessment solicitation and

Past Performance, can an Offeror submit three (3) or less Past Performances and be deemed Acceptable?

Section L.17.1 states offerors shall submit three (3) recent and relevant past performance references. However, Section M.4.3.3 states in the case of an offeror without a record of recent, relevant past performance or for whom information on past performance is not available or so sparse that no meaningful past performance rating can be reasonably assigned, the offeror will not be evaluated favorably or unfavorably on past performance.

Therefore, the offeror shall be determined to have unknown past performance. In the context of acceptability or unacceptability, an unknown rating shall be considered acceptable.

2. Due to the following factors, we are requesting serious consideration for a one week extension (12/19/16):

a. Unusual LPTA pricing exercise that was not provided or discussed in the Draft release.

b. Short delay caused by Solicitation number change in FBO.

c. RFP released prior to a major Federal holiday.

No extensions will be granted.

3. Per (ISC)2 (provider of the CISSP certification -https://www.isc2.org/cissp/default.aspx) the vast majority of IASAE Level II certified personnel possess skills related to security engineering, systems engineering, information assurance, and systems administration. Very few software developers focus their training on IASAE related tracts (i.e., CISSP, CASP, etc.).

Would the Government accept a PM with the IASAE Level II certification, to cover these specific requirements?

See question 6 response below.

4. Section L.15.1 provides the volume document design requesting a table of contents as well as header/footer information. However Volume IV Solicitation Documents are primarily Government formatted documents making it extremely difficult to reformat. Would the Government consider only a cover page for this volume only in order to preserve the integrity of the Government furnished documents required for this volume?

Volume IV Solicitation documents do not require a separate cover page. A signed Standard Form 33 with a completed Offer section (Boxes 12 through 18) acts as the cover page.

5. Would the Government consider changing in Section L.17.2, Recent efforts are defined as services and/or efforts during the past thirty-six (36) complete months, the period to sixty

(60) complete months?

No change to the definition of recent efforts.

6. Where can the government provide data to support that software developers pursue and possess IASAE Level II certifications?

This misalignment of the cyber certifications will cause serious issues upon execution. Our concern is based off experience we have supporting similar requirements under the DoD 8140.01M construct.

DOD 8570.01M identifies many other functions associated with the IASAE II role. Several of these functions are consistent with the support that we need to review systems and identify the level of risk associated with defects in those systems. For this reason, I assert that the IASAE II level requirement is valid and provides relevant value to the government. As examples, here are some of the IASAE II Functions:

- IASAE-II.15. Assess threats to and vulnerabilities of the NE.

- IASAE-II.17. Ensure that the implementation of security designs properly mitigate identified threats.

- IASAE-II.19. Evaluate security architectures and designs and provide input as to the adequacy of security designs and architectures proposed or provided in response to requirements contained in acquisition documents.

- IASAE-II.20. Ensure security deficiencies identified during security/certification testing have been mitigated, corrected, or a risk acceptance has been obtained by the appropriate DAA or authorized representative.

- IASAE-II.23. Provide engineering support to security/certification test and evaluation activities.