Consolidated Industry Questions 1-200 4-30-2020 Posted.pdf

Question # Subject &/or SOW Reference Questions Gov't Answer

PCTE L and M v11 - Technical Management, Pg 1, Section 1.1.1.A, Agile Development Operations (DevOps) Please describe the current process.

Platform Development Kit details current process. Provide specific questions on any of the current process documentation.

Furthermore, the PCTE Industry Day on 11 Jun 2019, the program office covered on slides 6-11 & 14-15 our agile development processes, construct, and tooling as well.

PCTE L and M v11 - Technical Management, Pg 1, Section 1.1.1.A.1, Agile Development Operations (DevOps)

Please describe current velocity and quantity of incomplete tasks (user story under-delivery).

Providing our metrics will not help you recommend a process or technique to improve our velocity. The offeror is recommended to provide innovation in which the integration factory, CI/CD pipeline, and agile DevOps processes can scale and be more robust than primary Gov't led integration activities currently - as opposed to strictly measuring on velocity.

PCTE L and M v11 - Technical Management, Pg 1, Section 1.2.A.4, Infrastructure / Platform Operations

The scope associated with this criteria includes the deployment of platform training applications. Is the actual tooling and processes associated with deploying exercise-specific emulated networks to the platform part of the TRIDENT scope, or is it capability provided by 3rd party applications.

This sub-element was removed from Section L and M to minimize complexity associated with criteria. As part of execution of DO1- 2-3, it is expected prospective bidders are to integrate capabilities within a multi-vendor environment. To verify the agile integration in an incremental and iterative fashion, the ability to test across the plan-prepare-execute-assess training lifecycle of components delivered by multiple vendors is critical. This is further reinforced with DO2 providing an 3rd party orchestration role. Any software integration challenges would need to be mediated amongst the Government, TRIDENT, and 3rd party applications - but would require overall lead effort by TRIDENT in the collaboration via the integration factory and CI/CD processes.

CYBER TRIDENT DO 1 SOW v8 -11-25- 19, Pg 6, Section 3.2, Operations

How is system availability (Ao, e.g., 95%) for a "high quality, persistent user experience" determined?

Will the Government provide this metric? Is the requirement " The contractor shall manage PCTE platform operations to ensure a system availability (Ao) of 95% for a high quality, persistent user experience".

95% system availability in discussion internally for calculation.

Final number will come with Draft RFP. With PCTE capabilities being provided by multiple vendor, it is expected that TRIDENT bidders would have full cognizance over platform infrastructure layers across hardware, software virtualization/middleware, and core enterprise services. The system is expected to maintain this availability number even through basic troubleshooting steps provided and maintained by the vendor (to include those provided by 3rd parties).

Attachment 19 - Q&A Form - Cyber TRIDENT Solicitation - Consolidated List of Questions

CYBER TRIDENT DO 1 SOW v8 -11-25- 20, Pg 6, 3.2.1, PCTE Maintenance and Support library) be updated to contain complete RCS Infrastructure (Hardware and Software)to include model numbers, actual quantities, spares, etc. in order to provide the offeror with enough information Yes, planning to provide HW/SW List

21, Pg 7, Section 3.2.2, PCTE Maintenance and Support the RCS deployments or will the offeror just assume all RCS are active on Day 1 of the contract.

For the purpose of DO 1, the assumption should be made all RCS are active on day one.

CYBER TRIDENT DO 1 SOW v8 -11-25- 21, Pg 7, Section 3.2.2, PCTE Maintenance and Support discrepancy between the Base SOW (Vicksburg) and DO 1 which has six and does not include Vicksburg. How many nodes will there be at each location?

Will provide updated RCS information for clarity at Draft RFP. At present there is anticipated to be 7 RCS (1 DevRCS and 6 production nodes - of which are at multiple, separate classification levels).

CYBER TRIDENT DO 1 SOW v8 -11-25- 19, Pg 6, Section 3.2, PCTE Maintenance and Support

Are MOAs currently in place? Will the Government initially establish these agreements?

Yes, MOAs in place and/or Government will do initial establishment. Government has lead on MOAs, and contractor in assist role.

CYBER TRIDENT DO 1 SOW v8 -11-25- 19, Pg 6, Section 3.2.1, PCTE Maintenance and Support

Can the Government define the performance requirements for the RCS so the offeror can define the required performance tests?

The Government is assembling a number of RCS related documents to be provided as part of the bidders library.

CYBER TRIDENT DO 1 SOW v8 -11-25- 19, Pg 7, Section 3.2.2, Infrastructure Tier 3 Technical Support

Is the trouble ticket application that is accessible from the PCTE platform GOTS or is it to be provided by the TRIDENT contractor?

As part of the Cyber Innovation Challenge (CIC) 3, a Technical Operations Dashboard was awarded that provided JIRA Service Desk for ticketing from users, and the DI2E instance of JIRA provides ticketing for the development team. Both applications are intended to stay in place after TRIDENT, but the offeror may propose alternatives that may be beneficial to the Government.

CYBER TRIDENT DO 1 SOW v8 -11-25- 19, Pg 7, Section 3.2.2, Infrastructure Tier 3 Technical Support

Does the Tier 3 Contractor Technical Support route Tier 3 tickets to the CIC Vendors?

Tier 2 internal PM help desk routes to Tier 3 and CIC vendors as per slide 19 of the Industry Day slides from I/ITSEC 2019.

CYBER TRIDENT DO 1 SOW v8 -11-25- 19, PG 14, Section, 3.4.1, Maintenance Support party vendors performing under the CICs or other contracts, or are CIC COTS providers included in this requirement?

Vendors are any third party company or Govt organization that is needed to be interfaced with to ensure full operations of the platform.

CYBER TRIDENT DO 2 SOW v9 -11-25- 19, Pg (N/A), Section 3, Multiple

Since these documents do not typically apply to Agile/DevOps programs will these CDRLs be deleted or allowed to be tailored/replaced by the offerors based on their proposed solution?

The program office is relooking each of the CDRLs. However, we intend to tailor traditional CDRLs to be updated to fit the Agile nature of PCTE. The program office is not looking to develop a SSS, SRS, CRS centric requirement trace but to align them within a agile approach that could include decomposition and alignment of program office requirements to agile backlog, epics, user stories and themes evolved over time. Further review by the Government will better elaborate this.

CYBER TRIDENT DO 2 SOW v9 -11-25- 19, Pg 6, Section 3.2.1, Capability Development, Integration, Delivery and Sustainment

Since these events do not typically apply to Agile/DevOps programs will these events be deleted or allowed to be tailored/replaced by the offerors based on their proposed solution?

The offeror may recommend tailoring or removal of these events in their proposed solution. No traditional SETR reviews are not anticipated but agile reviews corresponding to them are requested to be offered for substitution.

CYBER TRIDENT DO 2 SOW v9 -11-25- 19, Pg 7, Section 3.2.2, Integration Factory

Does the offeror make its recommendations against the information solely contained in the PDK, or are recommendations to consider current prototype activities and capabilities?

The current integration factory development environment is documented in the PDK. We have asked for innovations in Section L&M for the current status documented in the PDK.

Additional information has also been furnished within the PCTE Jun 2019 Industry Day and I/ITSEC Presentations published.

CYBER TRIDENT DO 2 SOW v9 -11-25- 19, Pg 25, Section 3.6.2, Developmental Testing

Do these exist today? Do we have to create from scratch? Does a current RTM/RVTM exist today?

Will the bidder's library contain the current prototype RVTM, test reports, test artifacts, test logs, etc.?

Regarding T&E, an RTM is available linking requirements to capabilities to test cases. The RTM will need to be modified and managed by the TRIDENT vendor upon contract award. The RTM, Test reports and artifacts will be made available in the bidders library.

CYBER TRIDENT DO 2 SOW v9 -11-25- 19, Pg 26, Section 3.6.4, Defect Management and Resolution

Any effective failure analysis effort seems to have dependency on 3rd Party Software, and 3rd Party processes, in order to identify potential root causes and resolutions. Do CIC vendors have the requirements to support this activity, or will their software, development processes, architecture artifacts, etc. be provided in the bidder's library?

CIC vendors have the requirement to support bugs and defects, and currently this activity is supported in the Government managed JIRA ticketing system. As part of leading DO2 efforts, it is expected TRIDENT bidder would be leading the orchestration and collaboration of this multi-vendor integration factory and managing the allocation, tracking, and satisfactory resolution of defects provided by 3rd party vendors.

CYBER TRIDENT DO 2 SOW v9 -11-25- 19, Pg 8, Section 3.2.3, Integration

Reword or remove the contractor's responsibility to ensure these updates, to read that the contractor can report status on the updates to documentation.

Yes, we will reword in the SOW with the below:

The contractor shall integrate 3rd party vendor contributions into an overall PCTE integration package to include documentation.

CYBER TRIDENT DO 2 SOW v9 -11-25- 19, Pg 13, Section 3.2.3.8, Configuration Management (CM)

Does this requirement apply to new platform capability developed under the TRIDENT contract or apply to existing potential Configuration Items?

Does this requirement apply to 3rd Party provided applications and products?

Yes, applies to 3rd party provided applications and products.

The core crux of DO2 is an integration factory that needs to track, orchestrate, integrate, and deliver capabilities via a mature CI/CD process - a cornerstone of that is robust CM processes and tools that reflect the total capabilities that amount to the final PCTE platform, development tooling, lab configuration and other items necessary to routinely and rapidly produce "shippable products" out of the integration factory.

19, Pg 16, Section 3.4.1, Security Engineering teams and let the offeror propose how cybersecurity activates are performed. Acknowledged, and will take under consideration.

CYBER TRIDENT DO 2 SOW v9 -11-25- 19, Pg 23, Section 3.5, Training

Does this requirement apply to 3rd party training applications, and if so, will 3rd party vendors provide that training content, or will the offeror provide a solution to obtain this critical input?

Yes, applies to 3rd party provided applications and products.

Vendors will provide training data and information, and offeror will package into a releasable training product.

CYBER TRIDENT DO 3 SOW v10 -11-25- 19, Pg 6, Section 3.2.6, Requirements terminology of a traditional DoD 5000 waterfall program. Will these requirements be removed based on the Agile/DevOps requirements elsewhere in the SOWs, or can the offeror tailor this approach

Offeror can tailor in their approach/proposal. See line item 13 for similar response.

19, Pg 7, Section 3.2.7, Architecture they funded by the Cyber TRIDENT contract? Can the definition of "External" be clarified - is this outside of the contractor's program staff, within its parent company and partners, or is completely external to those entities? Can "each iteration of

Currently that would include core program office, TCM, and USCC identified representatives. Currently the program office holds architecture working groups with representatives from PM and vendors with gov't holding final approval.

19, Pg 9, Section 3.2.13, Metrics provided by the Government or left to the offerors to develop their own definitions which may vary significantly. Are these items to be provided by a Will be left to offerors.

CYBER TRIDENT DO 1 SOW v8 -11-25- 19, Pg 6, Section 3.2.1, PCTE Maintenance and Support

Given that software patches and updates from vendors can be released at random times (with some possibly being critical), how do we bound this and provide a firm bid for uncertain future tasking?

Software patching and updating is a routine task across all DoD programs with periodic and recurring patch cycles developed and executed by the contractor with Government oversight. The possibility of a critical, out of cycle patch will happen and should be planned for based on the offeror's experience with critical COTS patching (i.e.: Microsoft updates, etc)

CYBER TRIDENT DO 2 SOW v9 -11-25- 19, Pg 6, 3.3.1, Event and Exercise Support

Will the Government provide how many events will take place, their duration, how many users will attend, or how taxing they will be on the system in order for the offeror to bid this effort?

The contractor should estimate attending one event per quarter.

The number of users, and taxing on the system are not relevant as the event will be executed by another organization.

CYBER TRIDENT DO 2 SOW v9 -11-25- 19, Pg 9, Section 3.2.3.1, Third Party Onboarding and Orchestration

Given that we don't know (right now) how many future CICs there will be or the number of future CIC vendors, how can we bid onboarding and orchestrating an arbitrary amount of third party vendors?

The current vendor pool as denoted on slide 13 of the PCTE Tech State of the Union slides held on 11 JUN 2019 show the current vendors that will be analogous in size and scale to the number moving forward while factoring in vendor turnover.

CYBER TRIDENT Base SOW v20 -11-25- 19, Pg 11, Section 3.1.9.1, Transition In (Initial Operations)

Please clarify all components that are expected to be tested as part of transition-in.

Base SOW will be updated as part of Draft RFP to show all elements that will need to included in the Contractor's Transition In Test plan.

CYBER TRIDENT Base SOW v20 -11-25- 19, Pg 29, Section 3.6.1, Maintenance Support

Please clarify this support is limited to platform infrastructure and does not include Training Applications developed by 3rd Party providers.

Base SOW is not priced effort, and therefore is only in place for future scope. Support services is broad in nature and not bound to only platform infrastructure.

CYBER TRIDENT DO 1 SOW v8 -11-25- 19, Pg 14, Section, 3.4.1, Maintenance Support

Please clarify this support is limited to platform infrastructure and does not include Training Applications developed by 3rd Party providers.

CIC vendor product maintenance is not included however maintenance on enterprise COTS products is included (i.e.:

Windows updates, Red Hat updates, etc)

CYBER TRIDENT DO 1 SOW v8 -11-25- 19, Pg 15, Section 3.4.2, Property Accountability and Management requirement for the Contractor to ensure 100% accountability for Government property to be transferred to the Contractor(e.g. GFP maintenance

Contractor will be responsible for 100% accountability of all equipment, not just GFP. Complete list will be available shortly.

CYBER TRIDENT DO 1 SOW v8 -11-25- 19, Pg 15, Section 3.4.3, Supply Management is confusing. Is the requirement "The contractor shall establish and maintain an automated supply system that accounts for Government property to be transferred to the Contractor(e.g. GFP

Will clarify. The intention is the contractor will have responsibility for PCTE property accountability of all PCTE equipment, not just

GFP.

CYBER TRIDENT DO 3 SOW v10 -11-25- 19, Pg 2, Section 3.1.3, Schedule

We are not familiar with the current Government agile scrum process. Is the requirement? The contractor shall plan, execute and deliver contributions within their implementation of an agile scrum processes implemented within Delivery Order 2.

See Platform Development Kit (PDK) for all necessary information on Government agile scrum process. This process will be the starting point for the offeror, however, the Government will be open to proposed improvements and changes based on the offeror's feedback to innovate the process.

CYBER TRIDENT DO 3 SOW v10 -11-25- 19, Pg 16, Section 3.4.1, Licensing and Warranty Management

Please clarify - Is this requirement restricted to vender platform licenses managed by the Contractor and excludes CIC application licenses acquired by the Government?

The vendor shall be the single point contact regarding education and training of licensed COTS and GOTS hardware / software.

The vendor shall be the coordinator for new equipment training and new software training to include all initial purchases, fielding and sustainment of education / training with regards to major revisions / versions changes. This includes COTS, GOTS and proprietary hardware or software.

Cyber TRIDENT DO 2 Section 3.6.1 CI/CD Testing

"The contractor shall maintain and enhance the current implementation of the CI/CD pipelines documented in the PCTE PDK as directed by the Government team." - In the interest of improving the efficiency and collaboration of the entire SDLC, would the government be open to migrating their CI/CD pipelines to a new platform? Also, we only saw that CI/CD was called out, does the government expect to maintain other tools/processes for source code management or issue tracking for example?

As stated in Section L Technical/Management Approach factor, the Government is looking for innovative, mature and robust means to establish an integration factory of which CI/CD is core.

The Government intends to evaluate offeror solutions on these fronts and would be open to understanding alternative tooling as long as it aligns to commercial best practices, industry trends, and modern tooling to rapidly deliver platform capabilities on-demand. The PCTE strategy is to maximize utilization of COTS components and with that model we do not expect to do much customer software development or coding. See PDK for current tools used by PCTE.

36 Cyber TRIDENT DO 2

We saw that SAST was called out in Security Requirements in draft of SOW for DO 2, but didn't see any mention of DAST, dependency scanning, container scanning or license compliance checks.

Are those also required?

The program office is looking for a CI/CD process that implements variety of automated checks, tests, and compliance gates of which cybersecurity is one such lane (others include regression, scalability, loading, new feature, API contract testing, etc). It is expected SAST will be of limited value to the program office due to the nature of heavy COTS components for which we don’t own the source code for. There will be instances of open source capabilities integrated into the platform to enable integration such as RabbitMQ, OpenShift, API Gateway, NGINX, and Infrastructure as Code scripts for which source is available but which is integrated into the platform.

How many users does PCTE expect to be involved in the total development process: developers, program management, security/IA, infrastructure

The program office expects at least 100-120 personnel responsible for development activities across Government lanes, vendors, COTS providers, and end users (as part of the DevOps integration).

Would the government be open to using a single platform that supported the entire DevSecOps lifecycle as opposed to using multiple point solutions that only address pieces of the Software Development lifecycle?

IAW Section L, the Government would be willing to consider the merits of any offeror’s DevSecOps process and the innovation that it bring forth. The Government is highly seeking robust, mature and commercial best practices to establish this integration factory utilizing DevOps, CI/CD and agile processes as the core tenets for its integration factory.

39 30% Small business target postings, potential offerors were told that the small business target would be 30%, but not including CLINs for licensing (estimate 40% of the PCTE mission funding that will be applied to TRIDENT).

This seems to have changed in the DRFP, as there is no specific language except for the 30% on a yearly basis. Please clarify whether the small business target will be based on all CLINS, or if the licensing ones will be excluded.

The Government is adding the language to Section G3 removing CLIN 0004, Software Licensing from the calculation of the small business participation percentage and amount. Update: The Government is lowering the Small Business Participation Plan minimum from 30% to 20% and will include all delivery/task orders in the calculation of the small business participation percentage. Section L and M have been updated to reflect this change.

Classification of major subs (RFP L.2.0 -page 88) any company expected to have a 30% or greater work share. CESI requests that this be reduced to 10% for the following reasons:

1. 10% of the ID/IQ constitutes nearly $100M of scope across the ordering period. A subcontractor working at that level will certainly be providing a significant amount of effort and sufficient risk that the Government should be made aware at proposal time.

2. Setting the classification at 30% means that the prime would have to be executing at most 40% of the overall effort (30% small business, 30% major sub, 40% prime). The likelihood is that no major subs will be included on any team if it is retained at this level.

To clarify, the major subcontractor definition is only for defining the proposal information required for the past performance and cost/price factor. The solicitation only requires cost information and past performance on major subcontractors that comprise 30% or more of the effort. However, there is not a goal or requirement for major subcontractors to be 30% of more of the contract as long as they are still meeting the SB participation goal requirements. The SB participation requirement can be met in various ways, such as multiple SB subcontractors equating to a total of 30 20%. In this example there could be no major subcontractors. The Government is providing this clarification and will not be changing the definition to the major subcontractor to 20% of the total price/cost (excluding the Offeror's profit/fee) for the contract.

41 RCS Availability (RFP L2.0 Factor 2)

On both the RFP and SOW (TO1) the requirement for 95% availability for the RCS is included. Please clarify whether this is "Per RCS," "Overall," or "Per RCS classification level."

The 95% availability requirement is per RCS. DO 1 SOW, Section 3.1.2 has been updated to reflect this clarification.

Correction: DO 1 SOW Section 3.2.1 has been updated to reflect this clarification.

42 RCS Availability (RFP L2.0 Factor 2)

How will the government measure the level of availability? For example, if the system is functional but externally provided DoDIN network services are down, does that count against the availability?

No, there are a number of factors that would not count against the availability time. Please review SOW Section 3.2.1 on TO 0001 which provide what is not included in the availability times.

Transition in and SCIF Pricing (Cost volume and RFP L.2.0 Factor 2 v. and vi.

g g paragraphs:

v. Transition of Incoming Contractor (FFP CLIN 0012 of Basic): The offeror shall propose a price for requirements IAW base SOW, Para

3.1.9.1 and 3.1.9.2 in the cost/price volume for completing all the transition-in activities of the contractor’s proposed transition plan and a price for providing a Sensitive

vi. Sensitive Compartmented Information Facility (SCIF) (FFP CLIN 0013 of Basic): The offeror shall propose a FFP price for providing a SCIF IAW base SOW, Para 3.1.9.2 in the cost/price volume.

Sensitive Compartmented Information Facility, 1 each, $____________.

a. Both of these say to include prices for the

a) Item v and vi have been corrected with item v. being only for the transition in activities and vi being only for the set up of the SCIF. B). Pricing for CLIN 0013 is for completion of activities required to provide the use of a SCIF IAW Base SOW 3.1.9.2.

Section 3.1.9.2 states the specification of the SCIF and facilities to be provided by the contractor.

44 RFP L.1.5 (Transition Plan) be referenced here? Concur with change. Will update as needed.

RFP L.1.4 (Third Party Integration and Coordination)

References TO 0002, SOW-2020-011, Section 3.1.3.2, But this paragraph doesn't exist

Correct. References are being corrected to read: References TO 0002, SOW-2020-011, Section 3.1. and 3.2

46 TO1 LNOs

LNOs at the RCS locations listed in the SOW, or does the contractor need to provide an office location at each site?

The LNO requirements were removed from TO 0001. This may be a future requirement as it is in the scope of the Base SOW.

47 Base SOW 3.4.5 (SOC) tools, or cybersecurity personnel to work within the SOC? If so, please provide information on each of those items, including product names, versions, how many Government personnel will be provided and

This may be a future requirement because it is scope within the Base SOW, however not a current requirement as part of DO 1- 3.

48 Base SOW 3.4.5 (SOC) What are the anticipated operating hours of the

SOC? (24/7, 8/7, 8/5)

This may be a future requirement because it is scope within the Base SOW, however not a current requirement as part of DO 1- 3.

49 Base SOW 3.4.5 (SOC) Will individual SOC capabilities be required for each classification level of the PCTE RCS systems?

This may be a future requirement because it is scope within the Base SOW, however not a current requirement as part of DO 1- 3.

50 Base SOW 3.4.5 (SOC)

Will the TRIDENT Contractor be responsible for obtaining an the initial RMF Accreditation for the SOC, or will this be inherited?

This may be a future requirement because it is scope within the Base SOW, however not a current requirement as part of DO 1- 3.

51 Base SOW 3.4.5 (SOC)

Does the government have plans to accredit the SOC as a Cybersecurity Service Provider (CSP) under DoDi 8530.01?

This may be a future requirement because it is scope within the Base SOW, however not a current requirement as part of DO 1- 3.

Compliance it indicates that “offeror shall provide documentation from DCMA with status of their accounting system, to include approval of the offeror’s Cost Accounting System. If status of accounting system letter is more than a year old and the offeror has a more current DCAA audit report completed commenting on the status of their accounting system, a copy of the report shall be submitted with the proposal. ”

Is it a correction assumption that an offeror will be deemed compliant and meet this requirement by providing their approval letter even though the letter is dated in 2012 as long as no new additional communication indicating the system is not approved has been received? If not, please clarify what is required when the approval is more than a year old.

Sec L5.5 has been modified to require offeror's with an approved accounting system from DCAA over one year must complete the Pre-Award Survey of Perspective Contractor Accounting System Checklist (attachment 15) and certify that there has been no changes to their accounting system since the approval. If there has been changes than a the offeror's accounting system must be reviewed and approved.

53 Past Performance Questionnaire piloting; please confirm that the Cyber Innovation Challenges (CIC) activity listed in the Past Performance Questionnaire is for informational purposes only. We request that this activity not be considered in any rating of relevancy in order to provide the full advantage to the entire field of

The Government will consider past performance references in accordance with the definition and criteria stated in Section L and M of the RFP, to include past performance on CICs if the performance meets the definition of relevancy and is within the recency criteria.

54 Proposal Instructions L.2.0

For purposes of the RFP, the Government is defining "major subcontractors" as subcontractor who provides at least 30% of the proposed total price/cost (excluding the Offeror’s profit/fee), for the contract. DFARS (Defense Federal Acquisition Regulation Supplement 209.571-1) defines a major subcontractor as 10% and/or $55M. Please consider revising the RFP language to match 10% and/or $55M, as this will benefit the Government as Prime Contractors can build the necessary best to market teams without unnecessary restrictions. The 30% requirement becomes unattainable with the small business percentage also at 30%. Together that precludes a prime from having more than one large business on the team thus greatly limiting the capabilities that could be provided.

See Question/Answer #40 (corrected). To clarify, the major subcontractor definition is only for defining the proposal information required for the past performance and cost/price factor. The solicitation only requires cost information and past performance on major subcontractors that comprise 30% or more of the effort. However, there is not a goal or requirement for major subcontractors to be 30% or more of the contract other than for meeting the SB participation goal requirements. The SB participation requirement can be met in various ways, such as multiple SB subcontractors equating to a total of 30 20%. In this example there could be no major subcontractors. In response to your request, the Government is reducing the definition for major subcontractor in Section L.2.0 Proposal Instruction from 30% to 20% of the proposed total cost/price (excluding the Offeror's profit/fee).

55 L.2.2.2 Video Presentation process referenced on Page 89 "existing Government led Agile process" and again on Page 93 so that all vendors can have access to the

See Platform Development Kit (PDK) for all necessary information on Government agile scrum process.

56 RFP; page 11 CLIN 1006

Should CLIN 1006 be designated as CPFF to maintain consistency with the other periods of performance?

CLINs 0006 and 0007 have been changed to match their corresponding CLINs (1006, 1007, 2006 and 2007)

57 RFP; page 12 CLIN 1007

Should CLIN 1007 be designated as FFP to maintain consistency with the other periods of performance?

CLINs 0006 and 0007 have been changed to match their corresponding CLINs (1006, 1007, 2006 and 2007)

58 RFP; page 17 CLIN 2007 CLIN 2007 has CPFF and FFP designations. Please confirm that this should be FFP. CLIN 2007 has been corrected to CPFF.

59 RFP; page 18 CLIN 2009

Year 8. CLIN 2009 has been corrected to Contract Year 8.

60 RFP; page 21; Section B1.1

Please clarify what is envisioned in the sentence "The Government may place unilateral delivery orders at the stated FFPs during the ordering period."

This terms allows the Government to place orders within the ordering period at the contract price for the CLINs 0001, 0002, 0003, 0012, 0013 and Attachments 003 and 004. Given the prices are already established at the award of the basic contract, no negotiations are required, thus unilateral orders will be issued IAW the price and delivery schedule on the basic contract for those CLINs and the parts list attachments.

61 RFP; page 21; Section B1.2 Please confirm if there is any material difference between a "delivery order" and a "task order".

Delivery Order means an order for supplies placed against an established contract and a task order means an order for services placed against an established contract.

62 RFP; page 29; CLIN 0012 Please confirm that CLIN 0012 should end on 31- May-2021 or if it will extend 14 months?

The ordering period for CLIN 0012 has been extended from 31 May 2021 to 30 Sep 2021. Please note the SCIF requirement description has been removed from this CLIN as the SCIF requirement is in CLIN 0013.

63 RFP; page 30; CLIN 2007 Please confirm that CLIN 2007 should end on 24- Mar-2029 or if it should end on 31-Mar-2029? CLIN 2007 has been corrected to end on 31 Mar 2029

64 RFP; page 87; L2.0

Will the Government please share the price reasonableness range with Industry? If not, will the Government share how they will determine if a vendor is within the range of price reasonableness?

Please describe the competitive range within the Price Evaluation process starting on Page 116.

1) The Government does not have price reasonable range information. 2) The Government's determination of price reasonableness will be IAW FAR 15.404-1 and will perform various techniques as described in Section M such as price analysis and cost analysis. Section M, Part B, M.2.0, Items 5-7 will be changed from price reasonableness to price analysis. 3) If discussions are necessary, then the KO must make a competitive range determination considering the initial evaluations for all factors from all the offerors to identify the most highly rated proposals which have a reasonable chance of being selected for award. The competitive range determination is a qualitive judgment based on the factual content of the proposals, and it must carefully consider both technical merit/performance and price. Therefore, the KO will not make a determination considering the cost/price evaluation factor only to identify the most highly rated proposals.

RFP; page 96, a (also pages 104, 105, 108, 119) subcontractor is the same as a "major" subcontractor discussed on page 88.

Corrected principal subcontractor to major subcontractor throughout Sections L and M.

66 RFP; page 99; i.

priced. The text in the first sentence says submit price for five years but in the last sentence it includes hours for all 8 years. TO 0002 should be priced for 8 years.

67 RFP; page 100; ii.

priced. The text in the first sentence says submit price for five years but in the last sentence it says "shall be priced for the base year and all option

DO 0003 should be priced for 8 years. This error was also corrected in Section L.2.0.c.ii.B

68 RFP page 116; section 2.1

Please clarify whether Task Order 1 will be subject to the most Probable Cost adjustments since it is FFP and the sentence refers to CPFF DO/TOs.

TO 0001 will not be subject to a most probable cost adjustment.

Correction is made to Section M, Part B, Item M.2.1 for TO 0001.

69 RFP Page 99

RFP Page 99 states that a FPRA takes precedence over a FPRR. Please confirm that this is to be interpreted that the Government is requesting Offerors to provide a FPRA if they have one, otherwise the FPRR should be provided. And that this does not imply an advantage to Offerors with a FPRA over those without and FPRA. Offerors are not in full control of the issuance of the FPRA.

For the purpose of substantiating rates and cost, an FPRA takes precedence over a FPRR only if available. If an FPRA is not available, the offeror shall submit their highest available level of substantiating information in the order of preference stated in Section L. The information preference does not imply an advantage to offerors without a FPRA.

RFP page 113; Relative Order of Importance when combined are approximately equal to the cost factor. FAR 15.101-1 provides the Government broad discretion to determine if the non-cost factors should be significantly more important, equal or less than the cost factors. We recommend the best value trade-off be revised such that the non-cost factors are significantly more important than the cost factors. This would maximize the Government's discretion to award to the Offeror whose proposal offers the greatest overall value to include cost. If the cost and non-cost factors are equal then an Offeror with a significantly lower price and a lower

Your suggestion has been considered and at this time, there are no changes to the relative order of importance to the solicitation.

71 Section H end-to-end service is the cost of purchasing third-party hardware / software. Additional cost savings would be achieved for the Government if the Government agrees that "the Prime Contractor is purchasing the third-party hardware / software as an agent of the Government only and is a pass-through/ resale directly to the Government. Thus, the Prime Contractor would not be responsible for the physical asset other than to procure it on behalf of the government." To clarify, the Prime Contractor is still responsible for the configuration and O&M

The Government does not have a requirement for a third-party hardware/software agent for the Cyber TRIDENT requirements, therefore we will not be inserting the suggested language into the

RFP.

72 DO2 CLIN Structure

Can the Government please clarify the intent associated with a flat level of effort over eight years for DO2? DO2 is designed to handle requirements, services, and deliverables that would typically follow more of a bell curve rather than a straight line. Is the Government simply contracting for a specific capacity or is there an alignment with our proposed solution? We recommend the Government remove the Fixed LOE clause and ask Contractors propose their anticipated level of effort.

1) The Gov't's intent associated with the consistent estimated (78K+) hours for each year is to provide offerors an expected level of effort for completing the various tasking for this term type order. 2) The Gov't is contracting for a specified level of effort for a stated time period employing the contractor's proposed solutions to the various requirements. The Gov't considered your recommendation, and will continue with use of the LOE clause stated in Section H1.

73 DO2 CLIN Structure

Where a fixed level of effort is required we recommend use of a FFP-LOE contract type rather than CPFF, thus shifting the risk associated with the cost of labor to the contractor rather than Government.

The level of effort is only a general estimate of hours for factory integration support. Due to the unknown aspect of this requirement, the Government incorporated the level of effort clause stated in H1, allowing the Government a proportional reduction to the fee amount based on the actual hours incurred from the hours estimated on the order. This reduction will protect the Government in situations where the actual hours incurred are significantly less than originally estimated. This CLIN's quantity of work, complexity of the task, as well as, the contractor's solution have a direct effect of the number of hours needed to support this effort. Given the quantity of work and exact tasking going to be assigned is unknown and can only be generally estimated, the Level of Effort Clause incorporated under H1 is necessary to protect the Government's interest.

74 DO2 CLIN Structure

Support Services (CPFF) and CLIN 0011 (FFP) provide the flexibility to procure either under CPFF or FFP cost structures. Such flexibility is in the best interest of the Government given the uncertainty precisely forecasting the user load for support services in Contract Years 3 – 8. We recommend the Government adopt a mix of CPFF and FFP on a year-by-year basis for DO2. Specifically, use CPFF in the first two years when the learning curve is steep and FFP in the later years, reducing the risk to the Government. This blended CPFF/FFP bid would be based on the responder’s estimated user and system loads in the out-years. The user and system

The ability to switch from CPFF to FFP in the outyears is available as currently structure as the outyears are options and do not have to be exercised. If at the time of option, the Government feels there is sufficient information available and the requirement is well defined, then the options will not be exercised and a new order will be issued based on the information available.

Cost Price Workbook; Attachment 03 Tab;

Requirement- "Attachment 03 Parts Listing" are not included in the parts list provided in the "03- Hardware-Software PCTE Spare Parts Price List" file. Would the customer update either one of the documents to make them consistent?

The workbook is being updated to match Attachment 3 - Hardware/Software Spares List.

Cost Price Workbook; Attachment 03 Tab;

Requirement- "Delivery Schedule"

Are the offerors expected to include formulas in Column F or should this column be left blank?

Offeror do not need to include formulas within Column F; this column may be left blank.

Cost Price Workbook; Tab A DO 0001;

Requirement- "CLIN 0003"

Did the customer intend to note CLIN xx03 instead of CLIN 0003? Tab A DO 0001 has been amended to read x03 vice 0003.

Cost Price Workbook; Tab A DO 0001;

Requirement- "Proposed DO 0001 Total Value"

1-8 (total of 90 months); however, Cell G4 is also in line with Quantity 57 Months, which appears to only include Contract Years 1-5. Would the customer confirm if the "total" formula is correct in that it should pull all contract years (1-8)? If so, will the The quantity has been updated to include all contract years.

Cost Price Workbook; Tab C DO 0003;

Requirement- "Proposed DO 0003 Total"

"Proposed DO 0003 Total" vs. "Proposed DO 0002 Total" (or allow offerors to make the update)? The referenced cell has been amended.

Cost Price Workbook; Tab D Labor Rates;

Requirement- "Note"

Fee."

Tab D Labor Rates is supposed to match the Attachment 2 Labor Categories and Rates Table, which includes both FFP and CPFF labor rates.

Would the customer update the note to state:

"Fully Burdened FFP rates are inclusive of profit and The note has been amended to describe both FFP and CPFF fully burdened rates.

Attach 1; Section 3.2.1; Development Operations Process; pg 14 Requirement- "The contractor shall provide a Systems Engineering Management Plan that is expanded to include a holistic DevOps process for developing, integrating, testing, fielding, and sustaining products."

Other requirements require updating of the PDK including this information. Does the SEMP replace the PDK, or is the SEMP requirement fulfilled by updates to the PDK?

As part of the base contract award, the program office requests a SEMP which we are evaluating changing to Platform Integration Plan that outlines how the integration factory is to be stood up, processes, personnel, techologies and agile integration methodologies to execute the DOs. This document serves to capstone and communicate a transparent CI/CD based integration factory that serves as the crux of Cyber TRIDENT.

Upon delivery of this CDRL and its approval, it is expected to be converged and maintained through the PDK.

RFP; Section B; CLIN 0003: Infrastructure and Maintenance; pg 3 Requirement- "The contractor shall provide Infrastructure and Maintenance support services on a monthly basis IAW Basic Contract # SOW-2020-011, Section 3.5.1 and TO 0001, SOW # SOW-2020-011-01."

The Base SOW 3.5.1 titled "Training Packages and Delivery" reference does not appear to relate to CLIN 0003, as there are no training requirements in DO1. Please confirm the Base SOW 3.5.1 requirement is to be removed. .

Base Contract CLIN 0003 is corrected to reference Basic Contract # SOW-2020-011, Section 3.6.1 and TO 0001, SOW #

SOW-2020-011-01.

Deliveries of Performance; pg 11 of Basic SOW, pgs 8 & 29 of RFP Requirement- "Section B: "The contractor shall complete all transition in plan in checklist (Attachment 13) within 90 days…"

Basic SOW 3.1.9.1: "All transition-in activities listed in the plan checklist shall be completed within ninety (90) calendar days…"

Section F: "0012 POP 01-APR-2021 TO 31-

MAY-2021"

Section F noted a 60-day transition period; however, both Section B and the Basic SOW 3.1.9.1 reflects a 90-day transition period. Please confirm the period of performance for the transition period is 90 days.

The transition period is 90 days. CLIN 0012 has been corrected from start date of 1 Apr 2021 to 31 May 2021 TO 1 Apr 2021 to 30 Jun 2021. Also, CLIN 0003 start date has been corrected from 1 Apr 2021 to Jul 2021 (9 mos for year one. All other years are 12 mos)

Cyber Event Operations Services; pg 18 Requirement- "The contractor shall provide cyber event operations support services IAW Basic Contract # SOW-2020-011, Section 3.3.3 for contract years 1 - 5"

Recommend correcting "…for contract years 1-5."

to "...for contract year 8" Corrected for contract year 8. Done

RFP; Section B; Supplies or Services and Prices; pgs 11, 12, 17, 21, 22 Requirement- "Section B states that CLINs 1006 & 2006 (pages 11 & 17) states are FFP while Section B2.1 (page 22) states CLINs 1006 & 2006 are CPFF.

and Section B states that CLINs 1007 & 2007 (pages 12 & 17) states are CPFF while Section B1.2 (page 21) states CLINs 1007 & 2007 are FFP. "

It appears that the titles and CLIN type for 1006 & 1007 in Section B (pages 11 & 12) are transverse.

Likewise, it appears that the titles and CLIN type for 2006 & 2007 in Section B (page 17) are transverse.

Please clarify the titles and contract types for the aforementioned CLINs

In Section B (CLINs):

- CLIN 0006 has been corrected from CPFF to FFP

- CLIN 0007 has been corrected from FFP to CPFF

- CLIN 2007 has been corrected from FFP to CPFF

In Section B1.2 the following references are changed:

- CLIN 0007, 1007 and 2007 are changed to 0006, 1006 and 2006 in title and in paragraph 1 respectively.

In Section B.2.1 references to 0006, 1006 and 2006 are change to references 0007, 1007 and 2007 in title and in paragraph 1 respectively.

RFP; Section I; Contract Clauses; pg 37 Requirement- New Requirement

Identification of Uncompensated Overtime to Section I? FAR Clause 52.237-10 will be added to the basic contract.

pg 88 Requirement- "Throughout these instructions, a “major subcontractor” is defined as a subcontractor who provides at least 30% of the proposed total price/cost (excluding the Offeror’s profit/fee), for the

Does "(excluding the Offeror's profit/fee)" refer to the total offeror's proposed profit/fee or only the profit/fee applied to subcontractor prices? It refers to the total offeror's proposed profit/fee.

RFP; PART A, L.2.2.1; Written Proposal; pg Requirement- "Written proposals must be formatted as follows:

-Using a Times New Roman 12 pt normal font (no reduction permitted)"

Will the Government consider a font size smaller than 12pt for tables and graphics in the written proposal? Recommendation: Using a Times New Roman 12pt normal font for written proposal text and a minimum 10pt font for proposal tables and minimum 8pt point font for proposal graphics.

Recommendation accepted and referenced section updated allowing for smaller font for tables and graphs as stated in request.

Change: Referenced section is modified graphs to be presented in no smaller than 8 pt font (See Q# 169)

Requirement- "Written proposals must be formatted as follows:

-Using a Times New Roman 12 pt normal font (no reduction permitted)"

Will the Government allow a font other than Times New Roman to be used for proposal graphs and graphics? Ex. Arial Narrow.

Yes, Government will allow for other than Times New Roman to be used for proposal graphs and graphics.

RFP; PART A, L.2.2.1; Written Proposal; pg Requirement- "All pages should be numbered with section and page numbers and any applicable data use restrictions as specified in FAR Subpart 52.215-1(e);"

Request the Government exclude back-up documentation (e.g. letters of commitment, DCAA and/or DCMA rate agreements and vendor quotes) conformance to the formatting of the written proposal (e.g. page numbering standards, data use restrictions disclaimer, font restrictions, etc.).

The Government will remove back-up documentation for the cost/price volume (e.g. letters of commitment, DCAA/DCMA documentation, vendor quotes, payroll records) to conformance to the formatting of the written proposal such as page numbering standards and font restrictions

RFP; PART A, L.2.3; Proposal Content and Volumes; pg 91 Requirement- "Volume 2 Factor2: Cost/Price & Administrative"

Please confirm all "Administrative" is in error and all administrative data should be included in Volume 5:

Administrative Information, per Part B L.5.

The words "& Administrative" has been removed from title for Factor 2, Cost/Price & Administrative

RFP; PART B, L.1.1.A.i; Agile Development Operations (DevOps); pg 93 Requirement- "Agile DevOps process which takes into consideration the existing Government led Agile process as well as the multi-vendor PCTE environment (e.g. Cyber Innovation Challenge contractors, Government Off the Shelf (GOTS) development teams, University Affiliated Research Centers (UARCS)) and Government functional teams (e.g.

Development, Platform Operations, Event Operations)."

Who all attends the daily online standups documented in the PDK? Each dev team separately? Or all dev teams together? Does the gov't attend?

The PCTE program office, as stated during the 2019 Industry Day, is executing a scrum process that features release planning, sprint execution, and daily stand-ups across vendors. As part of Government led execution, the program office is moving towards an scrum of scrum approach across infrastructure, vendor applications, testing and cybersecurity. Each line of effort represents various efforts that has an overall Gov't representative as a lead reporting to the overarching PCTE Product Owner to ensure gov't is managing backlog/priorities and maintaining transparency of capabilities being executed and delivered within its Integration Factory. This is currently how the program office is executing although potential Cyber TRIDENT bidders are expected to nominate their own processes and constructs to better scale and optimize PCTE platform integration efforts.

RFP; PART B, L.1.1.A.i; Agile Development Operations (DevOps); pg 93 Requirement- "Agile DevOps process which takes into consideration the existing Government led Agile process as well as the multi-vendor PCTE environment (e.g. Cyber Innovation Challenge contractors, Government Off the Shelf (GOTS) development teams, University Affiliated Research Centers (UARCS)) and Government functional teams (e.g.

Development, Platform Operations, Event Operations)."

Who all attends the Monday/Wednesday status conference call documented in the PDK? Each dev team separately? Or all dev teams together? Does the gov't attend?

The PCTE program office, as stated during the 2019 Industry Day, is executing a scrum…