SW_Code_Assessment_RFP_Questions_with_Technical_Responses.pdf

W56JSR-17-R-0004

Software Code Assessment Questions

Questions Answer / Remarks

1. Ref PWS SCA, Para 1.1 Background, 5th paragraph “run code through automated programs”, may manual programmed tests be used in conjunction with automated tools to correlate and validate test results?

Yes, in accordance with PWS paragraph 3.2-Performance

2. Ref PWS SCA, Para 1.5.2 Offsite: Can other staff support such as contract management, deliverables packing and submission, and routine reports, in addition to financial management, budget analysis and material processing be done offsite? Can offsite for these activities be outside the 50 mile local radius if accomplished in a timely, responsive manner?

Yes, in accordance with PWS paragraph 1.5.2-Offsite (Contractor Facility)

3. Ref PWS SCA, Para 3.1.2 Security: The first sentence states the highest facility level clearance is Secret, however all work is noted at either government or another contractor’s facilities; if we do the work at Secret cleared facilities both government and other contractor, does that mean the offeror would require a government Secret Facility Clearance as well, or does it simply mean we will do the work at a Secret Level Cleared Facility?

In accordance with box 1a. of the DD254 the Facility Security Clearance level required is Secret.

4. The security testing tools listed support over 30 different programming languages. Should the solution that we develop support every programming language that these tools support, or should we target a smaller subgrouping of programming languages? If so, what are the list of programming languages our centralized testing program should support?

Examples of the programming languages associated with this solicitation will be included in the final PWS Appendix A - Level of Effort. To be considered technically acceptable, at least a subset of the languages listed are necessary. If key resources are identified in the proposal with skills in uncommon languages, such as ADA, ABAP, or Assembler language, it will be taken into consideration during the technical evaluation.

5. Traditional dynamic security testing does not seem to be included in this request. Are you interested in ideas around adding dynamic security testing to this solution, where deployed applications would be dynamically tested?

Dynamic analysis is reference in PWS 1.1. While past experience in dynamic assessment would be relevant, there is not a requirement for a dynamic assessment technical approach in submitted technical proposals.

6. Please confirm that you want a centralized, outside of the build environment, scanning solution that aggregates all of the static analysis tools, then aggregates all results, the contractor would provide auditing of those results, and then reporting including mapping all findings to the DISA STIGs for all tools.

The technology for the Software Assurance solution is not part of this solicitation. We have a centralized solution that aggregates the raw findings from static source code analysis tools.

This solicitation requires analysis of those results, common vulnerabilities, mapping to DISA STIGs, knowledge of issues that might cause these anomalies, best practices in secure coding, and recommendations for potential remediation measures. This is followed by peer reviews, and the development of executive summary and a developer’s level report with actionable findings mapped to source code.

7. Why are the number of applications going up from the 1st year to the 2nd year? Is the increase in applications going to keep the easy, medium, complex ratio the same?

The number of applications is expected to increase as the maturity of our environment and processes evolves, and as the plans for implementing policy around software assurance is refined. The ratio of 1:2:1, meaning Simple, Medium, and Complex reflects actual historical data for the systems we have assessed so far. We anticipate special cases where the requirements are unique, or don’t neatly fit into those categories. For those cases, individual task orders will be issued.

8. What is the budget ceiling for this contract for the complete life of the contract?

Unknown at this time. The ceiling is dependent upon contract award value.

9. Will the official RFP be posted in FY 16 or FY17? If posted in FY 16 will it be awarded in FY 16 or FY 17?

The solicitation will be released in FY16 and expected award is FY17.

10. Appendix K will not open. Will you provide that information prior to posting the official RFP?

Appendix K issue is resolved and provided as a PWS attachment.

11. Will you allow an onsite visit to review the current environment?

No

12. Appendix A - Quality Assurance Technician-Journeyman

– there is no Labor Category description

Resolved and updated file posted to FBO.

13. Will there be a Sample Task that will accompany the final RFP? If so, will it be a potential awarded Task Order with the initial IDIQ?

A Sample Task will not be included in the final solicitation.

The first task order is expected to be issued shortly after contract award.

14. Who is the incumbent contractor? Under what contract is the work being performed and what value does/did it have? What level of effort was being provided?

No Incumbent as this is a new acquisition.

15. What is the anticipated start date of this IDIQ contract? October - November FY17

16. Will telecommuting be permitted in the support of any anticipated Task Orders?

For task order management only, in accordance with PWS paragraph 1.5.2-Offsite (Contractor Facility)

17. Will the winning contractor be able to add additional labor categories for Task Orders that may require different skills and experience?

The only required labor categories are those listed in the LOE. All other personnel management issues will be managed by the prime.

18. What pricing will be required in the final RFP? Will the IDIQ have ceiling labor rates for each of the stated labor categories?

Yes, pricing will be required for all separately priced CLINs within the offeror’s proposal. All proposed labor rates are compared to the Bureau of Labor Statistics labor categories.

19. A transition period is scheduled for a sixty (60) day period immediately prior to contract start date (phase in). Is this transition period billable? Or we will need to incorporate the costs of transition in period into the proposal?

The transition period starts on the contract award date and is therefore billable time. There is no incumbent. This is a new acquisition, but there may be transition in follow-on years if option years are not exercised.

20. This is an Indefinite Delivery, Indefinite Quantity (IDIQ) type contract, and is a combination of Firm Fixed Price (FFP) and Cost Plus Fixed Fee (CPFF) for all line items other than travel and materials. ODCs and materials will be on a Cost basis in accordance with FAR 16.302. If

Please see the CLIN structure in section B of the solicitation for the specific pricing information for ODC, Travel and Training etc. See and CLIN Structure spreadsheet listed in Section J Attachments/Exhibits for specific contract types.

ODCs and materials are on Cost Basis, what is the other combination of FFP and CPFF?

21. PWS 3.2.1, Customer and Engineering Support for Software Analytics Capability: Is there a company or agency currently performing this function under another contract vehicle?

No. There is no incumbent for Software Code Assessments or the CECOM SEC Software Assurance (SwA) Program.

22. PWS 3.2.4 Attend Meetings with Customers: Is there a current listing of customers and locations? Will the contractor have a requirement to travel off of APG, MD to meet and attend meetings with customers?

It is not anticipated that contractor will have to travel to attend meetings. Where travel is required by the Government, it is included in ODCs, and will be reimbursable, with prior authorization, as noted in PWS 3.1.6.

23. Appendix B, proposed Software Assurance Tool Suite: Will the Government provide all of these tool suites to the contractor?

Access to the tools and equipment needed for the contractor to perform the requirements of this solicitation are all available in Government facilities, and will be available for use in our labs. The government will not provide any software to contractors outside our facilities.

24. Appendix C, CDRL: Block 16 references NEXGEN PWS. Is this an administrative error?

Yes, see updated PWS Appendix C, CDRL

25. Appendix H, Government Process for Performing Code Assessments: Will the Government provide a copy or link to the two references listed, Sample SwA Executive summary, and Draft DA PAM 25-2-x-x? The attachment is only the title page of each reference and there are no active links.

Full sample documents referenced in Appendix H are viewable by double clicking the cover pages

26. No draft guidance is given for how submissions will be evaluated: Is there an intention to evaluate based on best value/trade-off? What precedence will be given to the different evaluation criteria?

See Source Selection Plan Section II, Paragraph A. “The award will be made to the lowest priced technically acceptable (LPTA) proposal. Proposals will be evaluated for technical acceptability (including past performance), but will not be ranked using the non-price Factors (and Sub-factors). In order for an Offeror to be considered for award, the proposal must receive an “Acceptable” rating in every non-price Factor. A proposal receiving a rating of “Unacceptable” in any non-price Factor will not be eligible for award.”

27. Not many candidates have the specific Army/DoD certifications desired: It also states that commercial equivalents will be accepted. Will requirements be using common industry standard certs such at CISSP and CEH (as seen in DoD Approved 8140 Baseline Certifications), combined with experience using the tools referenced in the solicitation?

Yes.

28. Appendix A, Specified Level of Effort: Software Developer, Senior/Lead and Program Manager, Medium are listed as ‘Critical Positions’. Will this translate into having to provide a Team Lead and Program Manager as ‘Key Personnel’? Are there any other anticipated key personnel if this is the case?

“Key Personnel” labor categories are identified in PWS Appendix A, and shall be staffed IAW PWS 3.1.7.

29. What will be the evaluation criteria for responses for the final RFP?

Posting in Final Solicitation See response to Question 26, above.