101st MFD Questions and Answers 1-17.pdf

101st Multifunctional Devices Question and Answers

Question 1. Do you require a GSA schedule be used for this solicitation?

Answer 1. No, we do not anticipate awarding through the GSA schedule.

Question 2. Could you please advise if you will accept Open Market bids for Solicitation W9124823R0009 posted on SAM.gov?

Answer 2. Yes

Question 3. Regarding W9124823R0009, enterprise print purchases of similar and equal size are typically made through ITES 3-H or GSA Schedule 36. Will you please confirm that this RFQ is set aside for GSA contract holders?

Answer 3. This Solicitation is for a Small Business set aside through SAM.

Question 4. Regarding W9124823R0009, enterprise print purchases of similar and equal size are typically made through ITES 3-H or GSA Schedule 36. Will you please confirm that this RFQ is set aside for GSA contract holders? Thank you very much.

Answer 4. No, this solicitation is not just to GSA Contract holders. However, it is set aside to small businesses.

Question 5. Regarding 2.2.10: Could the government kindly update the CLIN to read “Digital signature and Federal Information Processing Standards (FIPS) 140-2 encryption at the MFD must also be supported in compliance to the Sharing Peripherals Across the Network (SPAN) STIG for scan to email functionality”? FIPS 140-2 is the commonly implemented standard in currently sold MFDs/multifunctional devices throughout the print industry. The deprecated SPAN STIG did not specifically identify a required FIPS 140 level, nor does the current Multifunction Device and Network Printers STIG v2r13 dated 25 Jan 2019. Please note that FIPS 140-3 is not a widely held nor implemented standard yet and thus will be a self-limiting factor in MFD manufacturer’s ability to respond.

Answer 5. Replaced FIPS 140-3 with FIPS 140-2. (Section C, 2.2.10)

Question 6. Regarding 2.2.13: Digital signature, FIPS 140-3 validated encryption, and classification of information at the MFD will be supported in compliance of Army Directive 2013-22 and Department of Defense Manual (DoDM) 5200.45 dated 02 April 2013 for scan to email functionality. Would the government kindly update the language to state: “Digital signature, FIPS 140-2 validated encryption, and classification of information at the MFD will be supported in compliance of Army Directive 2013-22 (inactive) and Department of Defense Manual (DoDM) 5200.45 dated 02 April 2013 for scan to email functionality.” The Directive 2013-22 (inactive) and Department of Defense Manual (DoDM) 5200.45 dated 02 April 2013 for scan to email functionality do not require a specific FIPS 140 level. FIPS 140-2 is the commonly implemented standard in currently sold MFDs/multifunctional devices throughout the print industry. Please note that FIPS 140-3 is not a widely held nor implemented standard yet and thus will be a self-limiting factor in MFD manufacturer’s ability to respond.

Answer 6. Although FIPS 140-3 is the new standard NIST-CSRC website indicates that purchase of new systems under an older standard is ok as long certificates under that standard are not marked historical. FIPS 140-2 certificates will not be marked historical until 2026. Note that historical is not the same as revoked. Anything marked as revoked cannot be used. Please reference the following link Cryptographic Module Validation Program | CSRC (nist.gov).

Note: Section C – Descriptions and Specifications, 2.2.13 through 2.2.15 were revised to reflect the correct sequential numbering as follows:

Previous New

2.2.13 2.2.11

2.2.14 2.2.12

2.2.15 2.2.13

Question 7. Regarding 3.2. Maintenance Services: Given the large fleet and critical nature of uptime requirements to support the mission, does the Government require a dedicated onsite resource(s) to answer the call of the following requirements:

- Break/Fix of all the 640 devices within the fleet within the required timeline

- Provide sponsorship/escorts to and for all locations within the fleet

- Manage the fleet and the consumables associated within it, including the shipment of parts and consumable items.

- Provide a parts locker located at Ft. Campbell

- Prioritize and manage certain locations and devices that would be within a leadership suite and/or deemed as critical.

Answer 7. The Government does not have a requirement for on-site technicians. That decision is left to the vendor / contractor when evaluating their capabilities to perform the services required.

Question 8. Regarding 3.2.6: Will the Government require a ‘live’ online portal for real time visibility to the device fleet, open service calls, and open supplies requests?

Answer 8. Yes, the Government will require a ‘live’ online portal for real time visibility to the device fleet, open service calls, and open supplies requests as this supports the Government’s “self-service printing device” management requirements IAW AR 25-1 Chap 4-13 .

Question 9. Regarding 3.3.2. Automated Data Collection: – Will the government require cybersecurity approval at the time of proposal submission, to include an existing eMASS ID for the data collection agent software?

Answer 9. Yes, the Government will require cybersecurity approval at the time of proposal submission, to include an existing eMASS ID for the data collection agent software.

Question 10. Regarding 2.1.12 Scan to One Drive:– please confirm that each device should be licensed for a Scan to OneDrive solution. Also:

- Does the 101st Airborne want all MFDs to provide the integration with OneDrive that allows a CAC/PIV authenticated user to access their OneDrive?

- Does the 101st Airborne want a “follow-me” OneDrive solution that allows the user access to their OneDrive at any MFD after successful registration at a single device or through administrative / application-based permissions?

- Does the 101st Airborne want a OneDrive solution that allows the user to navigate OneDrive directories and support printing from OneDrive?

Answer 10. Yes, the Government requires that each device be licensed for a Scan to OneDrive solution and include the features of CAC Authentication, “follow me”, and navigation of a user’s OneDrive directory.

Question 11. Regarding 2.2.4. Should the single universal driver also be compatible with existing Government owned devices, some of which may remain in service for a period of time? If so, what are the applicable device models?

Answer 11. The Government prefers (but does not require) a single universal driver that functions with existing devices as it would simplify installation and management of these devices across our footprint.”

Question 12. Will the Government comply with the Defense Acquisition Regulations System Case DFARS Case 2018-D010, dated 26 September 2019, requiring the use of best value and that LPTA be avoided, to the maximum extent practicable, for procuring: Information technology services, Cybersecurity services, etc.

As the LPTA guidelines require, best value criteria shall be used for opportunities with:

- Services and items that are highly technical in nature (such as interoperability with the US Army network, CAC/PIV integration requirements, and ensure MFDs remain “responsive” to future upgrade requirements as detailed in paragraphs 2.1.12, 2.1.13 and all of 2.2.

- Components and service solutions that differ by manufacturer causing a significant variance in non-priced technical value

- Significant install and close out project management activities (as required in all of paragraphs 3.1, 3.2 3.3 and 3.4.)

- Long term device management, maintenance and monitoring (as required in paragraphs 3.2.6 and all of 3.4)

The nature of the items and services being procured are not expendable in nature and could have shelf lives that range from three (3) to five (5) years and in some instances, in excess of seven (7) years

Answer 12. The contracting office intends to make an award based on the instructions and criteria in sections L & M of this solicitation.

Question 13: Regarding OneDrive: Can the government please comment on where their OneDrive installation is located? Is it a local installation or is the government connecting to a GCC/government community cloud?

Answer 13: OneDrive resides in a Cloud Environment (Army 365)

Question 14: The solicitation states, “2.1.5. Duty Cycle - Maximum monthly usage 350,000 pages per month”. The duty cycle does not reflect the actual volume capable of the MFDs per month. Would the government update the language to reflect the following: “2.1.5. Recommended Monthly Page Volume - up to 30,000 pages per month.” Requesting this verbiage is adapted for clarity and accuracy to reflect the recommended monthly usage volume versus using the monthly duty cycle terminology.

Answer 14: The Government will amend verbiage of 2.1.5 as follows: “2.1.5. Duty Cycle / Recommended Monthly Volume - Maximum monthly duty cycle of up to 350,000 pages per month. Recommended Monthly Page Volume of up to 50,000 pages per month.”

Question 15: Please confirm that TAA compliant equipment is required?

Answer 15: No, IAW FAR 25.401(a)(1)

Question 16: To ensure the US Army has the most secure technology to mitigate risk, would the government consider amending the RFI/RFQ to include the following security features? This is in response to the Army’s own Executive Order 13873 that was issued to protect the United States Army from foreign adversaries creating vulnerabilities in information and communication.

MFD Security Features:

The device must perform a BIOS validation at startup and automatically reboot if an anomaly is present.

The device must offer self-healing BIOS without an on-site technician visit.

The device must offer firmware whitelisting to guarantee only vendor created secure digitally signed firmware can be used for upgrades.

The device must continuously monitor memory for malware injection attacks during run-time and automatically reboot if a memory anomaly is detected. The memory protection must run at the hardware level and monitor the operating system, network, print, scan and fax applications.

The device must monitor outbound network connections/DNS requests, providing intrusion detection, to thwart malware from communicating with external servers; and automatically reboot if an anomaly occurs.

This network intrusion detection technology must be previously tested and certified by a 3rd party certification body for IT security.

Documented proof of this intrusion detection 3rd party testing must accompany responses.

This network intrusion detection technology must be Common Criteria Certified, and documentation of the Common Criteria certification must accompany responses.

The device must have the ability to connect to a SYSLOG server to report security events that occur.

Answer 16: The Government will not amend the RFI/RFQ. Executive Order 13873 prohibits the “use and procurement” of ICT products manufactured or supplied by individuals controlled by or subject to the jurisdiction of a foreign adversary.

Question 17: Would the government kindly remove the Scan to OneDrive requirement? Scan to OneDrive is a newly emerging requirement within the Department of Defense and there are no specified technical integration requirements or standards posted by the DoD nor by NIST for vendors to utilize to build out this solutions support in printer/MFD firmware. The Scan to OneDrive RFQ requirement limits fair competition and it also severely limits the government’s choice of print vendors. We kindly request that this requirement be removed from the RFQ.

Answers17: The Government will not remove the OneDrive requirement.