ADDENDUM 02.pdf

W912NW-26-Q-A-0053 ADDENDUM 02

The answers in this addendum are incorporated into the solicitation

1. Governing Contract Documents, Acceptance, and Payment

The solicitation’s Inspection and Acceptance schedule directs contractors to:

“Refer to Performance Work Statement (PWS) for Inspect/Acceptance locations and criteria.”

So far, the referenced PWS has not been furnished with the solicitation package available to prospective quoters.

Addendum 01 separately states that the Government possesses the existing RSLogix 500 and PanelView application files but will provide the available files only to the successful contractor after award.

Please clarify whether the referenced PWS is likewise intended to be furnished only to the successful contractor after award.

ANSWER: SEE ATTACHEMENT “STATEMENT OF WORK”.

“REFER TO PERFORMANCE WORK STATEMENT (PWS) FOR INSPECT/ACCEPTANCE LOCATIONS

AND CRITERIA” WILL BE REMOVED AND REPLACED WITH “REFER TO 252.232-7006, WIDE AREA

WORKFLOW PAYMENT INSTRUCTIONS”

If the PWS is not intended to be reserved for post-award release, please publish it by amendment before quotations are due. If the PWS is intended to be furnished only after award, please state that expressly to all prospective offerors so they understand that the Government intends them to commit to a firm-fixed price before receiving the document identified by the solicitation as establishing inspection and acceptance criteria. The solicitation should also identify the assumptions prospective contractors are to use in pricing that undisclosed post-award obligation.

ANSWER: REFER TO CLIN SCHEDULE FOR PRICING ARRANGEMENT.

Addendum 01 also identifies the Site-Specific Accident Prevention Plan as Deliverable #8 and the

Activity Hazard Analysis as Deliverable #9, although the corresponding complete deliverables schedule cannot be identified.

Please therefore also provide the complete deliverables schedule or identify by amendment the complete set of documents establishing the contract’s technical, inspection, deliverable, and acceptance requirements.

ANSWER: SEE ATTACHEMENT “STATEMENT OF WORK” FOR DELIVERABLE SCHEDULE.

DELIVERABLE #8 AND DELIVERABLE #9 DO NOT APPLY AND WILL NOT BE INCLUDED INTO THE

AWARD.

Question 18 requested the Government’s SAT procedure, functional-test scripts, and objective acceptance criteria. The Government responded:

“Yes, the contractor must develop the documents.”

CueBid requests clarification because contractor development of the test method is materially different from contractor development of the functional requirement or acceptance standard.

A contractor can reasonably develop the detailed SAT procedure used to demonstrate compliance with an already-defined requirement. The functional result against which the system will be accepted, however, should be sufficiently defined before quotation.

Please therefore identify the objective acceptance criteria applicable to the PLC/HMI migrations, MicroLogix servicing, cybersecurity implementation, documentation, training, and return to service. The contractor can then develop the detailed test and verification procedures against those defined requirements.

Post-award development of a test procedure should establish how compliance with an existing contractual requirement will be demonstrated; it should not become the mechanism through which the underlying functional or acceptance requirement is first defined.

ANSWER: Prior to upgrade and removal of the 3 PLC’s, status verification testing of the current application of all used I/O points, along with the tags the current PanelView is monitoring. The SAT will be developed based on this testing to ensure proper and complete operation of the upgraded product.

The hardware CLINs are separately priced, while their Inspection and Acceptance schedules also direct contractors to the referenced PWS.

Please identify the acceptance event applicable to each separately priced hardware CLIN:

• conforming physical delivery;

• installation;

• commissioning;

• SAT; or

• final integrated-system acceptance.

Please also confirm the event at which each hardware CLIN becomes eligible for invoicing.

This clarification is particularly important because Addendum 01 states that payment is authorized only for CLINs that have been delivered or performed and accepted, while no separate payment milestones are established beyond the existing CLIN structure.

Accordingly, if the PWS containing the referenced inspection and acceptance criteria will not be furnished until after award, please identify before quotation the criteria and event that will establish Government acceptance and invoice eligibility for each separately priced hardware CLIN.

ANSWER: REFER TO 252.232-7006, WIDE AREA WORKFLOW PAYMENT INSTRUCTIONS

2. Existing Technical and Functional Baseline

The Government has confirmed that no site visit or individual pre-quotation inspection access will be provided.

The Government has also stated that it possesses existing RSLogix 500 and PanelView application files but will provide available files only to the successful contractor after award, and that required passwords are unavailable.

At the same time, the contractor must perform field discovery because existing control prints are outdated or nonexistent, and must create a Master I/O Chart linking legacy addresses, wiring, field devices, new

Logix tags, and conversion pinouts.

Accordingly, the contractor must price portions of the migration before receiving technical information it will later be required to discover, reconstruct, and document.

CueBid has no objection to performing that engineering. The clarification requested is how materially different conditions discovered after award will be treated where those conditions could not reasonably have been identified from the information provided before quotation, including conditions ascertainable from technical information already possessed by the Government but not released before award.

Please therefore either:

provide before quotation the available application files and technical baseline for the affected systems, including any MicroLogix application and configuration information presently possessed by the

Government; or establish common quotation assumptions and the contractual treatment of materially different conditions discovered after award.

The same concern applies to the functional baseline.

For the three PLC/HMI migrations, the solicitation does not presently identify the actual processes controlled, material operating sequences, interlocks, external dependencies, operator functions, or operating objectives against which required functional equivalence will ultimately be judged.

For the twenty-nine MicroLogix controllers, the solicitation likewise does not identify what equipment or process each controller operates, its operational criticality, material system dependencies, permissible outage, or required return-to-service condition.

Please therefore provide sufficient functional information for the affected systems to establish the required operational end state or, where that information cannot be supplied before quotation, identify the common assumptions prospective contractors are to use.

ANSWER: PLC 1 and PLC 2 both operate an industrial DI system and PLC 3 supports an industrial water processing system. The S6 document sets permissible outages of each of this equipment.

The 29 MicroLogix support scrubber systems and remote water treatment systems, all these units’ interface with HMI’s. The S6 document sets permissible outages of each of this equipment.

Required operational end state is when all are fully functional, within the permissible outages, after the upgrade or firmware update. Please refer to the answer to the question about the development of the SAT.

3. Scope of Engineering and Twenty-Nine MicroLogix Controllers

The S6 states:

“The following engineering, physical installation, and integration tasks are procured as incidental to the purchase of the supplies…”

Those activities include field discovery, reconstruction of the I/O baseline, PLC and HMI migration, tag refactoring, operational cutover, rollback, firmware modification, cybersecurity implementation, testing, commissioning, documentation, and technical instruction.

The S6 similarly describes servicing of twenty-nine operational MicroLogix 1400 PLCs as “incidental on-site servicing,” although that work includes application extraction, firmware modification, communications/security changes, and cybersecurity hardening.

The concern is one of acquisition precision.

Labeling an activity “incidental” does not establish its scope. Page 4 of 6

Please identify the engineering included within the original firm-fixed-price obligation and the treatment of material engineering work arising from conditions not disclosed and not otherwise reasonably identifiable before quotation.

The MicroLogix requirement also states a “maximum 4 hours per unit.”

Please confirm which interpretation governs:

Four hours is the maximum contractor effort included within the firm-fixed price per controller; effort beyond that amount is outside the included four-hour scope and requires separate contractual authorization.

Four hours is a common quotation assumption, but the contractor remains responsible for achieving the required technical end state regardless of actual effort.

Four hours is a mandatory performance limit within which all required servicing and successful return to service must be completed.

These are materially different pricing and performance obligations.

The distinction is especially important because these are twenty-nine operational Government control systems, not spare controllers being updated on a bench. The solicitation does not presently identify what they control or the operational consequence of an unsuccessful update.

For each controller, or by anonymized system category, please provide sufficient information to identify:

• the equipment or process controlled;

• installed expansion modules, local/remote I/O, and associated hardware;

• material communications and system dependencies;

• whether the controller performs mission-, safety-, or process-critical functions;

• permissible outage;

• available recovery or replacement capability; and

• the condition constituting successful return to service.

Firmware modification also presents a distinct restoration issue. Rockwell documentation provides recovery procedures for circumstances in which an interrupted MicroLogix 1400 firmware update can place the controller in a ‘Missing or Corrupt OS’ state, rendering the controller nonoperational until successful firmware recovery.

Please clarify responsibility where a properly initiated firmware update requires controller recovery, application restoration, additional troubleshooting, replacement hardware, additional onsite effort, or an extended process outage.

ANSWER: Four hours is a mandatory performance limit within which all required servicing and successful return to service must be completed.

Contractor will be responsible for any PLC equipment failure due to the update. If this occurs, an adjustment to the four-hour mandatory time limit will be determined and shall not exceed one business week.

4. Site and Safety Conditions

Addendum 01 requires the contractor to prepare a Site-Specific Safety and Occupational Health Accident

Prevention Plan and an Activity Hazard Analysis identifying actual activities, anticipated hazards, equipment, materials, controls, and qualified personnel.

Prospective contractors are not permitted to inspect the work locations before quotation, while the solicitation does not presently identify the building/work area, process environment, or material site conditions associated with the three migration systems and twenty-nine MicroLogix controllers.

A site-specific safety obligation can vary materially depending upon chemical, atmospheric, electrical, fire, stored-energy, respiratory, access, PPE, process, and LOTO conditions.

Please therefore either: Page 5 of 6

5. NO EXTENSION WILL BE PROVIDED AT THIS TIME.

provide, for each affected location, the general work area, equipment/process controlled, known material hazards, special PPE/monitoring/respiratory/escort requirements, and applicable LOTO or operational restrictions; or provide an anonymized asset/location/hazard matrix sufficient to establish common quotation assumptions.

ANSWER: Standard PPE that is required in an industrial environment. These include hearing and eye protection. Including steel toe boots/shoes. Any additional required PPE will be provided by the Government.

5. Cybersecurity Scope and Governing Standards

The S6 requires:

“Conformance with NIST SP 800-82 (Rev 4) and UFC 4-010-06.”

It also requires the contractor to disable specified services, cap and disable unused Ethernet ports, enable

CIP Security where applicable, and provide a cybersecurity hardening report with port-scan verification.

The essential clarification is:

What assets are within the contractor’s cybersecurity scope, and what exact controls constitute the required contractor end state?

Please identify for quotation purposes:

• the assets and network segments within scope;

• contractor-implemented controls;

• required licenses or infrastructure;

• required verification and evidence;

• objective cybersecurity acceptance criteria; and

• the governing NIST/UFC revision or dated document.

In particular, please clarify whether the requirement applies only to the three new

CompactLogix/PanelView/Stratix systems, also to the twenty-nine MicroLogix controllers, or additionally to existing switches, HMIs, workstations, supervisory systems, or other OT equipment.

Addendum 01 states:

“For quotation purposes, the contractor shall disable HTTP, BOOTP/DHCP, unauthenticated programming services, Telnet, and SNMPv1/v2…”

Please confirm whether those enumerated measures constitute the contractor’s complete cybersecurity implementation obligation for quotation, performance, acceptance, and applicable post-acceptance responsibility, or whether broader standards-based requirements will apply after award.

If broader requirements apply, please identify them before quotation or establish the assumptions prospective contractors should use.

The response to Question 14 also states that certain services “must remain enabled” but does not provide the corresponding list before Question 15 begins. Please provide the omitted information.

Finally, the solicitation references NIST SP 800-82 Rev. 4. NIST presently identifies Rev. 4 as an Initial Preliminary Draft associated with a Pre-Draft Call for Comments, while Rev. 3 remains the current final publication. Please identify the exact revision or dated document intended to govern quotation, performance, and acceptance.

ANSWER: Cyber security scope only applies to the equipment listed in the S6. Conformance with NIST SP 800-92 Rev. 3 and UFC 4-010-06 are the requirements.