101st_MFD_Questions_and_Answers.pdf

101st Multifunctional Devices Question and Answers

Question 1. Do you require a GSA schedule be used for this solicitation?

Answer 1. No, we do not anticipate awarding through the GSA schedule.

Question 2. Could you please advise if you will accept Open Market bids for Solicitation W9124823R0009 posted on SAM.gov?

Answer 2. Yes

Question 3. Regarding W9124823R0009, enterprise print purchases of similar and equal size are typically made through ITES 3-H or GSA Schedule 36. Will you please confirm that this RFQ is set aside for GSA contract holders?

Answer 3. This Solicitation is for a Small Business set aside through SAM.

Question 4. Regarding W9124823R0009, enterprise print purchases of similar and equal size are typically made through ITES 3-H or GSA Schedule 36. Will you please confirm that this RFQ is set aside for GSA contract holders? Thank you very much.

Answer 4. No, this solicitation is not just to GSA Contract holders. However, it is set aside to small businesses.

Question 5. Regarding 2.2.10: Could the government kindly update the CLIN to read “Digital signature and Federal Information Processing Standards (FIPS) 140-2 encryption at the MFD must also be supported in compliance to the Sharing Peripherals Across the Network (SPAN) STIG for scan to email functionality”? FIPS 140-2 is the commonly implemented standard in currently sold MFDs/multifunctional devices throughout the print industry. The deprecated SPAN STIG did not specifically identify a required FIPS 140 level, nor does the current Multifunction Device and Network Printers STIG v2r13 dated 25 Jan 2019. Please note that FIPS 140-3 is not a widely held nor implemented standard yet and thus will be a self-limiting factor in MFD manufacturer’s ability to respond.

Answer 5. Replaced FIPS 140-3 with FIPS 140-2. (Section C, 2.2.10)

Question 6. Regarding 2.2.13: Digital signature, FIPS 140-3 validated encryption, and classification of information at the MFD will be supported in compliance of Army Directive 2013- 22 and Department of Defense Manual (DoDM) 5200.45 dated 02 April 2013 for scan to email functionality. Would the government kindly update the language to state: “Digital signature, FIPS 140-2 validated encryption, and classification of information at the MFD will be supported in compliance of Army Directive 2013-22 (inactive) and Department of Defense Manual (DoDM)

5200.45 dated 02 April 2013 for scan to email functionality.” The Directive 2013-22 (inactive) and Department of Defense Manual (DoDM) 5200.45 dated 02 April 2013 for scan to email functionality do not require a specific FIPS 140 level. FIPS 140-2 is the commonly implemented standard in currently sold MFDs/multifunctional devices throughout the print industry. Please note that FIPS 140-3 is not a widely held nor implemented standard yet and thus will be a self-limiting factor in MFD manufacturer’s ability to respond.

Answer 6. Although FIPS 140-3 is the new standard NIST-CSRC website indicates that purchase of new systems under an older standard is ok as long certificates under that standard are not marked historical. FIPS 140-2 certificates will not be marked historical until 2026. Note that historical is not the same as revoked. Anything marked as revoked cannot be used. Please reference the following link Cryptographic Module Validation Program | CSRC (nist.gov).

Note: Section C – Descriptions and Specifications, 2.2.13 through 2.2.15 were revised to reflect the correct sequential numbering as follows:

Previous New

2.2.13 2.2.11

2.2.14 2.2.12

2.2.15 2.2.13

Question 7. Regarding 3.2. Maintenance Services: Given the large fleet and critical nature of uptime requirements to support the mission, does the Government require a dedicated onsite resource(s) to answer the call of the following requirements:

- Break/Fix of all the 640 devices within the fleet within the required timeline

- Provide sponsorship/escorts to and for all locations within the fleet

- Manage the fleet and the consumables associated within it, including the shipment of parts and consumable items.

- Provide a parts locker located at Ft. Campbell

- Prioritize and manage certain locations and devices that would be within a leadership suite and/or deemed as critical.

Answer 7. The Government does not have a requirement for on-site technicians. That decision is left to the vendor / contractor when evaluating their capabilities to perform the services required.

Question 8. Regarding 3.2.6: Will the Government require a ‘live’ online portal for real time visibility to the device fleet, open service calls, and open supplies requests?

Answer 8. Yes, the Government will require a ‘live’ online portal for real time visibility to the device fleet, open service calls, and open supplies requests as this supports the Government’s “self-service printing device” management requirements IAW AR 25-1 Chap 4-13 .

Question 9. Regarding 3.3.2. Automated Data Collection: – Will the government require cybersecurity approval at the time of proposal submission, to include an existing eMASS ID for the data collection agent software?

Answer 9. Yes, the Government will require cybersecurity approval at the me of proposal submission, to include an exis ng eMASS ID for the data collec on agent so ware.

Question 10. Regarding 2.1.12 Scan to One Drive:– please confirm that each device should be licensed for a Scan to OneDrive solution. Also:

- Does the 101st Airborne want all MFDs to provide the integration with OneDrive that allows a CAC/PIV authenticated user to access their OneDrive?

- Does the 101st Airborne want a “follow-me” OneDrive solution that allows the user access to their OneDrive at any MFD after successful registration at a single device or through administrative / application-based permissions?

- Does the 101st Airborne want a OneDrive solution that allows the user to navigate

OneDrive directories and support printing from OneDrive?

Answer 10. Yes, the Government requires that each device be licensed for a Scan to OneDrive solution and include the features of CAC Authentication, “follow me”, and navigation of a user’s OneDrive directory.

Question 11. Regarding 2.2.4. Should the single universal driver also be compatible with existing Government owned devices, some of which may remain in service for a period of time? If so, what are the applicable device models?

Answer 11. The Government prefers (but does not require) a single universal driver that functions with existing devices as it would simplify installation and management of these devices across our footprint.”

Question 12. Will the Government comply with the Defense Acquisition Regulations System Case DFARS Case 2018-D010, dated 26 September 2019, requiring the use of best value and that LPTA be avoided, to the maximum extent practicable, for procuring: Information technology services, Cybersecurity services, etc.

As the LPTA guidelines require, best value criteria shall be used for opportunities with:

- Services and items that are highly technical in nature (such as interoperability with the US Army network, CAC/PIV integration requirements, and ensure MFDs remain “responsive” to future upgrade requirements as detailed in paragraphs 2.1.12, 2.1.13 and all of 2.2.

- Components and service solutions that differ by manufacturer causing a significant variance in non-priced technical value

- Significant install and close out project management activities (as required in all of paragraphs 3.1, 3.2 3.3 and 3.4.)

- Long term device management, maintenance and monitoring (as required in paragraphs 3.2.6 and all of 3.4)

The nature of the items and services being procured are not expendable in nature and could have shelf lives that range from three (3) to five (5) years and in some instances, in excess of seven (7) years

Answer 12. The contracting office intends to make an award based on the instructions and criteria in sections L & M of this solicitation.