Industry Questions and Government Responses.pdf

Reference: Statement of Work 5. Cabinets f. Controlled medical supply operations. i. Current inventory validation via blind count method, multi user validation, access restrictions and locked drawers/doors.

1. Question: Will the government accept current inventory validation via user authentication, access restrictions by area, device and product location, and physically locked drawers/doors?

Government Response (Solicitation page 32): Yes.

Business to Business (B2B) Partners

Reference 2.2.1. Follow the Army guidelines for submittal of Automated Data Processor/Information Technology

(ADP/IT) background investigations and ensure all contractor personnel are designated as ADP/IT-I, ADP/IT-II, or

ADP/IT-III where their duties meet the criteria of the position sensitivity designations outlined in AR25-2.

2. Question: As Contractor’s Name Removed NBIS Position Designation identifies Sensitivity Level as Non-Critical, Risk Level as Moderate Risk and Investigation as Tier3, can Contractor’s Name Removed be allowed to identify as being required to adhere to IAT-I for professional baseline Certification requirements?

Government Response (Solicitation page 60): Required to adhere to IAT-II level access for professional baseline certification requirements.

Business to Business (B2B) Partners

Reference 2.2.4. Ensure that all contractor personnel receive information assurance (IA) training before being granted access to DoD AISs/networks and information.

3. Question: Will Contractor’s Name Removed be allowed to utilize the DOD interim access which will allow for

CAC processing and JKO Training to be completed?

Government Response (Solicitation page 60): Contractor’s Name Removed will be given a JKO Training login and password to complete training. No CAC will be issued or required.

EXHIBIT A – DHA Cybersecurity RMF Requirements

Reference: 4.2.5. Two-Factor Authentication. Contractors will authenticate using two-factor authentication. The only method for authenticating is the Common Access Card (CAC).

4. Question: Could the Government provide the CAC authentication specifications/requirements, including but not limited to card readers, authentication processes, and providing temp cards to onsite personnel?

Government Response (Solicitation page 47): Temp cards no longer exists. When the vendor need to access the network or server, vender will be given time to access. Vendor will not be required to have a CAC to access server or network while on site.