Amendment_2_RFP_Attachment_1_Questions_and_Answers.docx

Attachment 1 RTOP W911SF-18-G6 IT Support Clarification Questions/Answers

Q1: What is the past performance requirement for this RFP?

A1: They should have 3 years past performance and experience for all the areas in the PWS.

Program Management Supply Management

VTC

Customer Support SharePoint Website Administrator System Administration (Servers)

Q2: Can you please advise on any page count requirements?

A2: 20 pages exclusive of table of contents Q3: We have reviewed the Draft PWS content, notably, the C.2.3 security requirements, and believe that, because of the ongoing policy to comply with the DoD Risk Management Framework (RMF), the final solicitation might benefit from a directly stated security provision such as: “An offeror shall identify in its proposal, quote, bid or any resulting contract, their strategy for ensuring policy compliance with the May 11, 2017 Executive Order 13800, Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure. The compliance strategy shall conform to cybersecurity risk management best practices set forth in the National Institute of Standards and Technology (NIST) Framework for Improving Critical Infrastructure Cybersecurity and the Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs). The methods and processes shall be documented in the System Security Plan and updated as necessary to ensure continuing compliance throughout the period of performance.”

While the DFARS 252.204-7012 clause is comprehensive, albeit lengthy, inserting this provision with specific language addressing compliance (vice referencing the NIST SP 800-171 guidance, as the clause does) will have a more direct impact in assuring a clear, concise response to the compliance standard.

A3: It is approved software and its process. That it is still called CON (Certificate of Networthiness). The Army will be moving towards RMF (Risk Management Framework) in the future. But at this time we still have to provide a CON for software, future software will use what RMF... but for the purposes of this solicitation the CON is the relevant term for whatever software they plan to use..

We do not believe the current language would cause any confusion with anyone with the right experience and expertise.

Q4 thru Q7: See attached Excel worksheet