B08.03 Answers to Questions - W912HQ25R0004 - CWBI CyberSec_RMF dated 2025.02.18.docx
DOCX document 26 KB Posted
- Attached to
- CIVIL WORKS BUSINESS INTELLIGENCE RISK MANAGEMENT FRAMEWORK CERTIFICATION AND CONTINUOUS MONTIORING
- Solicitation number
- W912HQ25R0004
About this file
This is a Questions and Answers document dated February 18, 2025, for solicitation W912HQ25R0004 regarding CWBI Cybersecurity/RMF/Continuous Monitoring services. The document confirms this is an existing requirement previously awarded under contract W912HQ22P0035. Key details include: the requirement for at least one representative to have a security clearance for accessing classified vulnerability information; work can be performed remotely within the United States; CMMC Level 2 certification is required; and the contract will utilize Platform One for documentation management. The contractor must provide their own SIEM solution and take over existing System Security Plan and POA&M documentation.
The anticipated award date is March 13, 2025. The contract will support approximately 140 components including applications and databases. Travel requirements include one trip per year with maximum three personnel, requiring COR approval. Key personnel are expected to include a Project Manager, ISSO, ISSM and Security Architect. The contract will be overseen by USACE CIO/G-6 and follows CVSS severity coding with specific incident response timelines: Critical (0-7 days), High (14-30 days), Medium (30 days), and Low (45-60 days). This is an 8(a) set-aside procurement with no subcontracting plan required. The total contract value is not disclosed to maintain price competition.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
18 FEB 2025
CWBI CYBERSECURITY/RMF/CONTINUOUS MONITORING W912HQ25R0004 - SOLICITATION QUESTIONS
Regarding an Incumbent &/or Previous Requirement
1. Is this a new or existing requirement?
a. If it is the latter, can you provide the contract number?
This is an existing requirement that was awarded under contract number W912HQ22P0035.
2. Is there an Incumbent?
a. If so, who is it?
The incumbent information and contract amount can be found by searching W912HQ22P0035 in the Federal Procurement Data System.
3. How many Contractor employees currently support the project?
This is proprietary business information regarding the incumbent’s technical approach and cannot be provided.
4. Are the existing Contract employees located Remote in Virginia, or outside the state of Virginia?
Both
5. Will the Govt provide access to existing eMASS records and RMF documentation from the incumbent?
Yes
a. If not, will the awardee be required to revalidate all RMF controls from scratch?
6. Will the Govt provide access to previous ATO packages, Plan of Action & Milestones (POA&Ms), security technical implementation guides (STIG) checklists, and SCAP results?
Yes
a. If not, will the awardee be required to generate all RMF documentation from scratch?
Employee Specifications
7. Does the Army Corps of Engineers require any Security Clearances for any or all of the Contract employees?
Yes. At least one representative may need to check vulnerability information at the classified level.
8. Is there a preference for the physical location of Contract employees?
No preference, but they must reside within the United States.
9. PWS Section 4.2 – Place of Performance
a. Does “All work will be performed at the contractor’s site” include remote work?
Yes
10. Are offerors required to submit a labor category mapping document to align personnel with DFARS 252.239-7001 cybersecurity workforce requirements?
No
a. Will the Govt provide minimum required labor qualifications for each labor category to ensure consistency across proposals?
No
11. Will the Govt confirm whether two trips per year with four personnel is the maximum authorized travel for this effort?
Current travel requirements are one trip per year with a maximum of three personnel.
a. Will any travel require prior written approval from the COR?
Yes
12. How many key personnel are anticipated or required to fulfill the activities detailed under Section 5.1 through 5.6 in the PWS?
This is up to the offeror to decide. However, the government does anticipate that key personnel will include a Project Manager, ISSO, ISSM and Security Architect.
a. If specific roles or skillsets are required for the key personnel, could a breakdown of those requirements be provided?
No Performance Related Clarifications
13. PWS Section 11: Applicable Documents – Paragraph 1
a. Would the Govt require CMMC Level 2 certification based on the stated requirement to comply with DFARS clause 252.204-7012 and implement NIST SP 800-171?
Yes
b. Alternatively, would the Govt allow a firm to self-attest to meeting all NIST SP 800-171 requirements without formal CMMC Level 2 certification?
No
14. When was the Cybersecurity Service Provider (CSSP) last accredited?
26 JAN 2025
a. Has a date been scheduled for the next assessment?
No
15. Will the Govt require the awardee to maintain a FedRAMP Moderate or High authorization prior to contract execution?
No
a. If not, will the Govt allow alternative cloud security compliance approaches?
Yes
16. Will the Govt provide specific incident response timeline requirements for CSSP-related activities?
Yes. Government follows CVSS qualitative severity coding identified in DoDI 8531.01. Response timelines for LOW are normally 45-60 days, MEDIUM are 30 days, HIGH 14-30 days, and CRITICAL 0-7 days.
Will the awardee be required to propose an escalation framework based on DoD 8530.01 and DISA STIG?
Yes
17. Will the awardee be required to develop and accredit a new DevSecOps pipeline in compliance with DoD DevSecOps Reference Design (Version 2.0)?
No
a. If not, will there be an option to leverage an existing pre-approved pipeline?
Yes
18. Will the cybersecurity services under the CWBI RMF contract be required to align with the DoD Zero Trust Strategy?
Yes
a. If so, will a Zero Trust Maturity Model implementation plan be required as part of the contract?
No
19. Will compliance with NIST SP 800-171 be assessed post-award, or will the awardee be required to implement a System Security Plan (SSP) and POA&M for Controlled Unclassified Information (CUI) protection under DFARS 252.204-7012?
The awardee will take over the existing SSP and POA&M.
20. The PWS references Platform One (P1) or its replacement for documentation management. Will the awardee be required to utilize an existing P1 instance, or will the Government allow for alternative tools?
Required to use P1. Government will provide awardee with access.
21. Who will have direct oversight of RMF and CSSP compliance efforts – the USACE CIO/G-6 Cybersecurity Office or the CWBI PMO via delegated authority?
USACE CIO/G-6
22. Will the Govt provide an existing Security Information and Event Management (SIEM) tool, or will the awardee be required to implement their own SIEM solution?
Own solution Teaming, Subcontracting, and Small Business
23. Can the Govt share a list of 8(a) firms that responded to the SSN? This would facilitate more opportunities for potential teaming arrangements.
No. Not everyone is willing to share interest.
24. Will the Govt require the awardee to recertify their 8(a) eligibility at the time of award, in accordance with FAR 19.301-2?
a. If not, what procedures will the Govt. follow to ensure compliance with small business eligibility requirements?
The Govt previously reviewed eligibility for all respondents to the sources sought prior to soliciting. If the awardee is other than a respondent to the sources sought, the Govt will verify eligibility with SBA.
25. Will the Govt require a formal subcontracting plan to ensure compliance with small business participation goals?
A subcontracting plan is not required given that this requirement is under the threshold triggering the requirement.
a. If not, will the awardee have full discretion in subcontractor selection?
Subcontractors must be capable of meeting the performance requirements specified in the Performance Work Statement, including any personnel qualifications as applicable.
Funding, Proposal Evaluation, and Award Logistics
26. What is the estimated total contract value for this opportunity, including all option years?
The estimated total contract value will not be provided as this will impact price competition adversely.
27. Has the price ceiling been structured to align with the full scope of RMF and CSSP requirements under DoDI 8510.01 and DFARS 252.204-7012, or will additional funding be required?
The government cost estimate was mapped to the anticipated level of effort required to complete all tasks in the PWS.
28. Will the Govt give preference to offerors with direct past performance supporting USACE and its cybersecurity/RMF initiatives?
a. Will past performance from other non-DoD agencies be weighted equally?
Past performance will be evaluated per the RFP based on recency, relevancy and quality to determine the level of confidence.
29. If a new contractor is awarded this effort, what is the expected timeline for ATO transition?
a. Will the Govt provide a transition-in period for the new contractor to assume full responsibility for RMF and Continuous Monitoring No
30. What is the expected timeline for evaluation, contract award, and start of performance?
a. If delays occur, how will the Govt handle the transition period from the incumbent?
Contract award is anticipated no later than 13 March 2025.
31. Will the Govt provide specific proposal templates or formats for required deliverables (e.g., pricing spreadsheets, staffing matrices, or compliance checklists)?
a. If so, when will these be made available?
The solicitation states offerors are required to provide fully burdened labor rates per each labor category. Further, offerors shall provide a breakdown of level of effort per labor category per task in the PWS. No specific format is required for this so long as the information is provided. No staff matrices will be provided because the Government is not specifying the level of effort. This is a business decision for the technical approach of the offeror.
b. Which pricing tool and/or methodology is expected or mandated for use in preparing the cost proposal for this work?
See the answer to number 31 above.
W912HQ25R0004
File details come from the government source that posted it. Updated .