Final 040ADV-26-R-0041_Solicitation_Questions.Responses.xlsx
XLSX spreadsheet 55 KB Posted
- Attached to
- Hosting Service (FDLP eXchange/FDP. gov)
- Solicitation number
- 040ADV-26-R-0041
- Issued by
-
Government Publishing Office
About this file
This file is a Solicitation Questions and Responses document for federal contract 040ADV-26-R-0041, issued by the Government Publishing Office (GPO) for hosting, maintenance, and technical support services for two Drupal-based Content Management System platforms: FDLP.eXchange and FDLP.gov. The base period runs from October 1, 2026 through September 30, 2027, with four option years. The solicitation addresses 61 numbered questions and corresponding government responses, clarifying critical technical, contractual, and operational requirements.
Key technical requirements include: FedRAMP Moderate certification for the hosting platform (Microsoft Azure preferred but other FedRAMP-authorized commercial cloud platforms acceptable); 99.9% uptime SLA; 24/7 automated monitoring and critical-incident support with routine support during core business hours (Monday–Friday, 8:00 AM–5:00 PM EST); migration of both applications to a co-located PaaS environment; RabbitMQ support; daily/weekly automated backups with 60-day daily retention and 12-month weekly retention; recovery time objective of 4 hours; quarterly restore testing and annual disaster recovery simulation; and geographic separation of primary and disaster recovery facilities at least 500 miles apart. Pricing consists primarily of Firm-Fixed-Price CLINs with Project Management (CLIN 0004) priced at a fixed fully burdened hourly rate up to 80 hours per month (960 hours annually). Staffing estimates range from 5–25 hours per week per task area. All contractor personnel must complete NACI background screening before work begins. The contract requires a 60-day transition support period at contract end. The incumbent contractor is AISN, and the recompete is eligible to all offerors including the incumbent.
View the file
Other files
Show all 12
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Questions Template
SOLICITATION QUESTIONS TEMPLATE
Solicitation Number: 040ADV-26-R-0041 FDLP and Exchange Hosting Maint.
Date:8/19/26
Enter each solicitation question on a separate row. Identify the exact page, section, subsection, and paragraph whenever applicable. The Government Response column is for GPO use.
| Question No | Page Number | Document Section | Sub Section | Paragraph | Question | Government Response | |
| 1 | 12 | C | 4.1 | SSH Access | The SOW requires SSH access with elevated sudo privilege on the web server. Will GPO accept a FedRAMP-authorized managed hosting platform that provides equivalent administrative access (deployment, file management, troubleshooting) through Drush, Git, Composer, and restricted SSH, rather than literal root/sudo access? | GPO will consider a FedRAMP-authorized managed hosting solution that provides equivalent administrative capabilities through Drush, Git, Composer, restricted SSH, or other appropriate access controls in lieu of direct root or unrestricted sudo access, provided the proposed solution meets all operational, security, maintenance, troubleshooting, and support requirements of the SOW. Offerors proposing an alternative access approach shall clearly describe the proposed method and demonstrate how it satisfies the Government's requirements. | |
| 2 | 12 | C | 4.1 | RabbitMQ | The SOW names RabbitMQ specifically for microservice support. Will GPO accept a functionally equivalent integrated queueing/microservice capability, or is RabbitMQ itself a hard requirement? | RabbitMQ is a required component of the existing application environment and must be maintained and supported under the resulting contract. Offerors may propose their technical approach for providing and maintaining RabbitMQ support, provided all applicable SOW requirements are met. | |
| 3 | 12 | C | 4.0 | Security Monitoring | The SOW requires 24-hour system security monitoring and critical-incident support but does not specify a content delivery network (CDN) or web application firewall (WAF) requirement. Does GPO require a dedicated and integrated CDN and/or WAF as part of the hosting platform, or is this left to the offeror's proposed security approach? | The SOW does not specifically require a Content Delivery Network (CDN) or Web Application Firewall (WAF). Offerors may propose CDN and/or WAF capabilities as part of their overall security and hosting approach where appropriate. Any proposed solution must meet all applicable security, performance, availability, and other requirements of the SOW and will be evaluated in accordance with the solicitation's stated evaluation criteria. | |
| 4 | C | 2.0 / 4.1 | Uptime Standard (99.999%) | Please clarify whether the referenced uptime standard of 99.999% is a target/aspirational benchmark or a binding contractual SLA. If binding, will GPO accept a 99.99% uptime commitment, consistent with standard commercial/FedRAMP-authorized PaaS SLA terms? | The binding contractual uptime SLA is 99.9%. The references to 99.999% in the SOW are not mandatory requirements and will be revised through amendment to reflect the 99.9% uptime requirement. | ||
| 5 | C | 4.4 | Item 10.2 - Facility Inspection | Section 4.4, item 10.2 grants GPO the right to inspect the contractor's facilities and systems hosting GPO data, in conjunction with contractor staff, with advance notice. For offerors hosting on a third-party FedRAMP-authorized cloud infrastructure provider (e.g., AWS, Azure), the underlying infrastructure provider's data centers are generally not available for customer- or subcontractor-facilitated physical inspection. Will GPO accept satisfaction of this requirement through the infrastructure provider's FedRAMP authorization package, SOC 2 report, and/or equivalent independent audit documentation in lieu of a physical facility inspection? | GPO acknowledges that this methodology is consistent with established industry practices for third-party FedRAMP-authorized cloud infrastructure providers, whose data centers typically do not permit physical inspection by customers or subcontractors. Following contract award, the vendor must submit their FedRAMP package ID to GPO for review and approval by the Chief Information Security Officer (CISO). GPO will evaluate the provided documentation to ensure adherence to all required security and regulatory standards. | ||
| 6 | 17 | 6 | 1 | Section 6.0 states that the primary performance location is the vendor’s site/location of hosted services, but GPO may shift operations to GPO headquarters or another facility. We are based in Richmond, VA and wanted to clarify any manditory onsite work, frequency and duration. I also want to inquire if this arrangement is acceptable, and whether travel and onsite labor are reimbursable or should be included in the fixed-price quote. | Performance under this contract will be performed at the Contractor's facility/remote location. Routine onsite performance at a GPO facility is not required. GPO may request contractor attendance at occasional in-person meetings when necessary. GPO reserves the right to change the place of performance based on Government operational, security, policy, or other requirements. | ||
| 7 | 16 | Task 3 | 1 | 1 & 2 | Also, must meetings be in person or can they be held via Zoom or another meeting platform? | Zoom and Microsoft Teams are generally regarded as preferable alternatives to in-person meetings. However, there may be occasions when face-to-face meetings are necessary. | |
| 8 | 12, questions: p1 | 1 | 2 | 4 | Can you please clarify the uptime and support standards appearing across the SOW—including 99.9%, 99.999%, 24/7 monitoring, 24/7 critical-incident support, core GPO hours and any weekend/holiday coverage? This will allow us to price and staff consistently. | The Uptime Standard is established at 99.9%. Support and automated monitoring services are available 24/7, ensuring continuous monitoring and around-the-clock critical-incident support to promptly notify the GPO of any urgent issues. Routine support is provided during core GPO business hours, defined as Monday through Friday, from 8:00 AM to 5:00 PM (EST local time). | |
| 9 | 31 | M5 | 1 | 2 | Will application migration be a required contract task? If migration is required, please provide the current and target architecture, inventory, data volumes, integrations, DNS/certificates, testing, rollback, downtime, security authorization, schedule, and acceptance criteria. | This information will be provide in a seprate attachment | |
| 10 | 13-14 | Section C | 4.4 | 11.1 | The SOW requires FedRAMP Moderate (or equivalent) certification "of the contractor." If the vendor proposes hosting on Acquia's FedRAMP-authorized platform, is Acquia's existing P-ATO/Agency ATO sufficient to satisfy this requirement, or does GPO require the contractor to obtain its own system-specific ATO for the FDLP.gov/eXchange applications running on top of that platform? | The GPO requires that the hosting platform, not the application, be FedRAMP certified. The SOW specifies FedRAMP Moderate (or equivalent) certification for the contractor. GPO will provide its own Authority to Operate (ATO) for FDLP.gov/eXchange applications, while the vendor must submit a FedRAMP package for the proposed platform. Such as Acquia’s existing P-ATO or Agency ATO can be included, but GPO will issue a system-specific ATO for the applications. | |
| 11 | 13-14 | Section C | 4.4 | 11.1.1.1 | For a platform like Acquia where FedRAMP authorization covers the underlying infrastructure but not the customer's specific application layer, who is responsible for developing and maintaining the System Security Plan (SSP) for FDLP.gov/eXchange , the contractor, or GPO? | This is a shared responsibility. The contractor (vendor) is responsible for providing information and technical artifacts necessary for the development of the System Security Plan (SSP), especially as it pertains to the application layer and their specific implementation. Meanwhile, GPO takes the lead in developing and maintaining the SSP for internal use, ensuring compliance and oversight for FDLP.gov/eXchange. Both parties must collaborate to ensure the SSP accurately reflects the security posture and operational controls relevant to the platform and application. | |
| 12 | 13-14 | Section C | 4.4 | 11.1.1.1 | Please clarify the control inheritance model GPO expects: which security controls will be inherited from the platform provider's (Acquia's) FedRAMP authorization boundary, and which controls remain the contractor's responsibility to implement and document at the application/tenant level? | At this time, the specific technical solution platform has not been finalized or confirmed. As such, the exact control inheritance model GPO expects—specifically, which security controls will be inherited from the platform provider’s FedRAMP authorization boundary and which controls will remain the contractor’s responsibility to implement and document at the application or tenant level—cannot be definitively outlined. Once the platform solution is identified, GPO will work with the contractor to clarify the division of responsibilities and ensure a clear understanding of inherited versus application-specific controls. | |
| 13 | 13-14 | Section C | 4.4 | 11.1.1.1 | Who is expected to serve as the Authorizing Official and issue the ATO for these two applications , GPO, or does GPO expect to leverage an existing Agency ATO already issued to Acquia by another federal agency? | The GPO Chief Information Officer (CIO) shall serve as the Authorizing Official and will be responsible for issuing the Authority to Operate (ATO) for these two applications. GPO does not intend to leverage an existing Agency ATO already issued to Acquia by another federal agency; instead, the GPO CIO will ensure the applications meet all required security and compliance standards before granting the ATO. | |
| 14 | 13-14 | Section C | 4.4 | 11.1.1.1 | Is the contractor responsible for producing the initial security assessment (like coordinating a 3PAO assessment) for the new hosting environment prior to go-live, or will GPO conduct/commission this assessment? | Yes, the contractor is responsible for producing the initial security assessment for the new hosting environment prior to go-live. This includes coordinating a 3PAO assessment to ensure all necessary security requirements are met and documented before the environment becomes operational. | |
| 15 | 13-14 | Section C | 4.4 | 11.1.1.1 | Annual POA&M and assessment reviews are required per the SOW. For a platform-as-a-service model like Acquia, is the contractor responsible for tracking and remediating POA&M items only at the application layer, or also for platform-layer POA&M items inherited from Acquia's own authorization package? | Both conditions are affirmed: For a platform-as-a-service model such as Acquia, the contractor holds responsibility for tracking and remediating POA&M (Plan of Action and Milestones) items at the application layer and for platform-layer POA&M items inherited from Acquia’s FedRAMP authorization package, insofar as they affect the deployed applications. This dual responsibility ensures comprehensive oversight and remediation in accordance with the SOW’s annual POA&M and assessment review requirements. | |
| 16 | 13-14 | Section C | 3.0 Objective | 1 | Given the planned migration to a new platform (Acquia) away from the current Azure-based FDLP eXchange environment, will the ATO/security assessment need to be completed and approved before cutover, or can migration proceed under an Interim Authority to Test/Operate (IATO/IATT) while the full ATO is finalized? | GPO recognizes that an Interim Authority to Operate (IATO) or Interim Authority to Test (IATT) grants temporary approval for migration activities, maintaining compliance and oversight during the interim period prior to the completion of a comprehensive security assessment and formal Authority to Operate (ATO) approval. Migration to the new host platform may proceed under an IATO or IATT. | |
| 17 | 13-14 | Section D5 | Task ID 1 | 10-day Deadline | Given the ATO dependencies above, does the 10-business-day kickoff timeline and the "Period of Performance" start date assume the hosting environment (and its authorization) is already in place at contract start, or does GPO anticipate a stand-up/ATO period before the system is expected to be fully operational? | At this time, the 10-business-day kickoff timeline and the "Period of Performance" start date do not assume that the hosting environment and its authorization are already in place at contract start. GPO anticipates a stand-up and Authority to Operate (ATO) period will be necessary before the system is expected to be fully operational. Once the platform solution is finalized, GPO will collaborate with the contractor to clarify the timeline, including any required interim authorizations (such as IATO or IATT) to support migration and compliance activities prior to formal ATO approval. | |
| 18 | 15-16 | Section C | Task 4 | Transition documentation | Is there an expected duration or level of effort for end-of-contract transition support (30/60/90 days), or should offerors propose their own transition timeline? | A transition support period of 60 days is expected for end-of-contract activities. Offerors should plan to provide transition assistance for this duration, ensuring a smooth handover and continuity of operations as specified. | |
| 19 | 11 | Section C | 3.0 Objective | 1 | Is the future single-sign-on integration between FDLP.gov and FDLP eXchange in scope for this contract, or is it planned for a separate future procurement? | Yes, the future single-sign-on integration between FDLP.gov and FDLP eXchange is included within the scope of this contract, and will specifically be implemented using Login.gov. This integration aims to provide users with a streamlined, secure authentication experience across both platforms. | |
| 20 | 15 | Section C | Task 3 | 1-6 | Task 3 (UX adjustments, content reorganization, navigation enhancements, search enhancements) does not specify an expected volume, frequency, or level of effort. Is there an anticipated level of effort GPO can share, or will requests beyond a baseline be handled as separate work orders/change requests? | For Task 3 (UX adjustments, content reorganization, navigation enhancements, search enhancements), while GPO does not specify an exact expected volume or frequency, ongoing technical support is anticipated to include weekly meetings and change orders as needs arise. The expected level of effort should not exceed approximately 20 man hours per week. Requests that go beyond this baseline will be addressed through separate work orders or change requests, ensuring that additional tasks are properly scoped and authorized in accordance with standard procedures. | |
| 21 | 5 | Section B | CLIN 0004 | Description | CLIN 0004 (Project Management) is designated Firm-Fixed-Price but capped "Not to exceed 80 Hours per month." Please clarify whether this CLIN is to be priced as a flat monthly fee regardless of hours used, or as fixed-price billed against actual hours up to the 80-hour ceiling. | The resulting contract will consist primarily of Firm-Fixed-Price CLINs. Project Management CLIN 0004 and the corresponding option-year CLINs will be priced using a fixed fully burdened hourly rate and paid based on actual authorized hours performed, not to exceed 80 hours per month. For proposal evaluation purposes, the Government will use an estimated quantity of 80 hours per month (960 hours annually). |
The solicitation will be amended, including Attachment J.1 – Pricing Sheet, to reflect the revised Project Management pricing structure. Offerors shall use the revised Attachment J.1 when submitting their Business/Price Proposal.
| 22 | 4-5 | Section B | CLIN 0001-3 | Quantity/Unit | CLINs 0001,0003 show a quantity of "12 MTH." Please confirm whether offerors should price these as a single annual lump-sum price or as a monthly recurring rate for the pricing matrix in Attachment J.1. | Offerors shall propose a monthly unit price for CLINs 0001–0003 and the corresponding option-year CLINs. The annual extended price shall equal the monthly unit price multiplied by 12 months. The revised Attachment J.1 will reflect this pricing structure. |
| 23 | 5 | Section B | CLIN 0004 | Description | CLIN 0004 (Project Management) is designated Firm-Fixed-Price but capped "Not to exceed 80 Hours per month." Please clarify whether this CLIN is to be priced as a flat monthly fee regardless of hours used, or as fixed-price billed against actual hours up to the 80-hour ceiling. | See #21 |
| 24 | 15 | Section C | Task 4 | NACI | Does the SOW require contractor support personnel to be physically located within the United States, or is a follow-the-sun support model using NACI-screened offshore personnel acceptable? | Yes, a follow-the-sun support model utilizing NACI-screened offshore personnel is acceptable, provided all SOW requirements are met and compliance standards are maintained. |
| 25 | 27 | Section L | - | Staffing Approach | The instructions state "The Government's estimated staffing levels are provided for planning purposes only," but no staffing estimate appears elsewhere in the solicitation. Please provide the Government's estimated staffing levels referenced here. | The Government is not providing estimated staffing levels. Offerors are responsible for proposing the staffing necessary to successfully perform all requirements of the SOW. The solicitation will be amended to remove the reference in Section L.3 indicating that Government-estimated staffing levels are provided. |
| 26 | 27 | Section L | - | Staffing Approach | Can GPO provide historical level-of-effort data, like actual hours expended by task area (hosting/ops, application maintenance, application support, project management), from the incumbent contract or prior period of performance, to inform offerors' staffing and pricing approach? If not hours then in another form that can provide better context for pricing, ticket volume, staff dedication, etc. | At this time, GPO is unable to provide historical level-of-effort data such as actual hours expended by task area from the incumbent contract or prior period of performance. However, based on prior experience and typical requirements for similar projects, GPO anticipates that personnel time commitments will generally range between 5 and 25 hours per week per task area. This estimate should help inform offerors’ staffing and pricing approaches, including considerations for ticket volume, staff dedication, and operational support. If more specific historical data becomes available, GPO will share it to further assist in proposal development. |
| 27 | 28 | Section L | Content of Technical Proposal | Page Limits | Please confirm that the 30 pages for the Technical Proposal is inclusive of the 20 pages for Technical and Management Approach and 10 pages for Key Personnel? | Yes. The 30-page Technical Proposal limitation consists of a maximum of 20 pages for the Technical and Management Approach and 10 pages for Key Personnel. |
| 28 | 31 | Section L | 3. Past Performance | Factor 3 | Is the past performance narrative provided outside of the 30 page limit? | Past Performance Questionnaires and/or CPARS information are excluded from the 30-page Technical Proposal limitation. No separate Offeror-prepared Past Performance narrative is required. |
| 29 | 31 | Section L | 3. Past Performance | Factor 3 | Would the Government accept CPARS submitted with our proposal in place of PPQs? | Yes. Relevant CPARS information may be submitted in lieu of a Past Performance Questionnaire for a referenced contract. The referenced effort must satisfy the solicitation's recency and relevance requirements. |
| 30 | 26-30 | Sections L and M | L.2, L.3, L.4, M.3 | Business Proposal / SF 1449 / Price Matrix / supporting narrative | Section L.3 requires the proposal submission to consist of two distinct volumes, a Technical Proposal and a Business Proposal, and states that the Business Proposal must present the price for the services and sufficient evidence of responsibility. Section L.4 further requires price breakdown information to be submitted in spreadsheet format, and Section M.3 states that the Business Price/Cost Proposal evaluation will be based on Attachment J.1, the supporting narrative, and the Offeror’s “budget narrative.” However, unlike the Technical Proposal, the solicitation does not provide instructions identifying the required contents, organization, format, or page limitations for the Business Proposal or define the required supporting/budget narrative. Additionally, Section L.2 requires Offerors to complete and sign specified blocks of the SF 1449 but does not identify where the executed SF 1449 is to be included within the two-volume submission. Clarify the required structure and contents of the Business Proposal, including: (1) whether Offerors should submit a separate Business/Price Proposal PDF in addition to the completed Attachment J.1 Excel pricing workbook; (2) the information required in the supporting or budget narrative referenced in Section M.3; (3) whether any page limit or formatting requirements apply to the Business Proposal; (4) where the signed Cover Letter and completed SF 1449 should be included within the submission; and (5) whether any additional administrative, responsibility, representations/certifications, or pricing documentation must be included in the Business Proposal | The Business/Price Proposal shall include: (1) the completed and signed SF 1449; (2) completed Attachment J.1 – Pricing Sheet in Microsoft Excel format; and (3) a brief Price Narrative identifying any assumptions necessary to understand the proposed pricing. The Business/Price Proposal is not subject to a page limitation. The solicitation will be amended to clarify the Business/Price Proposal submission requirements and to replace references to “supporting narrative” and “budget narrative” with “Price Narrative.” |
| 31 | 27-29 | Section L | L.3, L.4 | Technical Proposal / Past Performance / page limitations | L3Section L.3 requires the Technical Proposal to include Technical Approach, Staffing Plan, and Past Performance, and requires at least three relevant past-performance references. Section L.4 establishes a 30-page Technical Proposal limit consisting of 20 pages for Technical and Management Approach and 10 pages for Key Personnel, thereby allocating the full 30 pages without identifying a page allowance for Past Performance. Although Past Performance Questionnaires and/or a CPARS List of Contracts are excluded from the page limitation, it is unclear whether Offeror-prepared past-performance descriptions are also excluded or whether no separate past-performance narrative is required. Clarify the required content and page allocation for Past Performance, including whether Offeror-prepared past-performance reference descriptions are required and, if so, whether they are excluded from the 30-page Technical Proposal limitation. | Offerors shall identify at least three relevant past performance references for similar work performed within the timeframe specified in the solicitation. For each referenced effort, the Offeror shall provide either a completed Attachment J.2 Past Performance Questionnaire or relevant CPARS information. Past Performance Questionnaires shall be completed by the Offeror's customer/reference and submitted directly to the Government points of contact identified in the solicitation by the proposal due date. PPQs and CPARS documentation are excluded from the 30-page Technical Proposal limitation. No separate Offeror-prepared Past Performance narrative is required. |
| 32 | 27-30 | Sections L and M | L.3, L.4; M.5 Factor 2 | Staffing Plan / Key Personnel | Section L.3 identifies a Staffing Plan as a required component of the Technical Proposal, while Section L.4 allocates up to 10 pages to “Key Personnel” and specifically requires resumes for the Project Manager and Technical Lead. Section M evaluates staffing adequacy and qualifications, but the solicitation does not state whether the 10-page section must also include a staffing narrative, organization/staffing structure, labor categories, or proposed level of effort, nor whether the required resumes count toward the 10-page limit. (Section L; L.3, L.4; Section M.5 Factor 2; Pages 27-30).Clarify the required contents of the Staffing Plan/Key Personnel section, including whether Offerors must provide a staffing narrative, organization/staffing structure, labor categories and level of effort in addition to the Project Manager and Technical Lead resumes; confirm whether resumes count toward the 10-page limit; and identify any resume-specific page or content requirements. |
Thank you for your inquiry. Yes, Offerors should provide a staffing narrative, organization/staffing structure, labor categories, and proposed level of effort within the Key Personnel section, in addition to the required resumes for the Project Manager and Technical Lead. The resumes are included within the 10-page limit for Key Personnel, unless otherwise specified in the solicitation. Please refer to any solicitation-specific instructions for additional resume page or content requirements.
| 33 | 11, 30-31 | Sections C and M | Introduction; 3.0 Objective; M.5 Factor 1 | Current hosting / application migration strategy | Section C states that both FDLP.gov and FDLP eXchange currently operate on Red Hat Linux within Microsoft Azure. Section 3.0, however, states that LSCM is currently utilizing Microsoft Azure for FDLP eXchange and describes co-locating the two applications as an objective, which suggests FDLP.gov may not currently reside in the same environment. Section M also evaluates an application migration strategy, but the SOW does not clearly identify which application, if either, must be migrated or define the migration scope, schedule, responsibilities, or acceptance criteria. (Section C; Introduction; 3.0 Objective; Section M.5 Factor 1, Page 11 | Both FDLP.gov and FDLP eXchange will be migrated to a hosted PaaS environment within Microsoft Azure or equivalent, ensuring that the applications are co-located and fully supported in this platform moving forward. This approach will streamline operations, enhance scalability, and provide consistent support for both applications after migration. | |
| 34 | 11-12 | Section C | 3.0, 4.0, 4.1 | Hosting platform | Section 3.0 references an existing FedRAMP-compliant Microsoft Azure environment and describes a “Microsoft Azure/or Linux based platform that is compatible with FedRAMP,” while Section 4.0 requires an externally managed FedRAMP-approved platform and Section 4.1 references “Red Hat Enterprise Linux Microsoft Azure.” It is unclear whether Microsoft Azure is mandatory or whether another FedRAMP-authorized commercial cloud environment meeting the stated requirements would be acceptable. (Section C; 3.0, 4.0, 4.1; Pages 11-12) Confirm whether the awarded solution must reside on Microsoft Azure specifically or whether another FedRAMP-authorized cloud platform that meets the security, availability, interoperability, and U.S.-hosting requirements is acceptable. | Although Microsoft Azure is mentioned as the preferred platform and serves as our current FedRAMP-compliant solution, the GPO welcomes proposals using any commercial cloud platform authorized by FedRAMP, as long as they fulfill the necessary security, availability, interoperability, and U.S.-hosting standards. The goal is not to restrict options only to Microsoft Azure, but to ensure all solutions comply with FedRAMP requirements and operational guidelines. We invite submissions that utilize any appropriate FedRAMP-approved platform meeting these criteria. | |
| 35 | 13-14 | Section C | 4.4 | Item 11.1 | Section 11.1.1 requires “FedRAMP certification at Moderate level (or Security Categorization Level required by the contract SOW),” but the SOW does not otherwise state the required FIPS 199/FedRAMP impact level. | ||
| Will GPO please provide the specific FedRAMP impact level/security categorization required for the hosting environment? | In response to Section 11.1.1, the GPO requires FedRAMP certification at the Moderate impact level for the hosting environment, consistent with standard federal security practices and the contract SOW. All proposals should assume and demonstrate compliance with FedRAMP Moderate impact level standards unless otherwise specified in the SOW. If further clarification on the FIPS 199 security categorization is needed, GPO will provide additional guidance, but the Moderate impact level should be considered the baseline requirement for this project. | ||||||
| 36 | 11, 13-14 | Section C | Introduction; 4.0; 4.4 | Item 11.1 | The SOW requires the platform to be FedRAMP approved, certified, or hold an “equivalent certification,” while Section 4.4 lists either FedRAMP Moderate or an SSAE 16/SOC Type 2 report as acceptable independent audit certifications. It is unclear whether SOC 2 Type 2 alone is intended to satisfy the hosting security requirement. Could GPO clarify whether a current SSAE 16/SOC 2 Type 2 report without FedRAMP authorization satisfies the hosting security requirement and, if not, define what the Government considers an acceptable FedRAMP-equivalent authorization or certification? | If SOC 2 Type 2 is selected as the independent audit certification to satisfy the hosting security requirement, a current SOC 2 Type 2 report must be submitted annually to maintain compliance. This ensures that the platform's security controls are regularly reviewed and verified according to industry standards. | |
| 37 | 11-12 | Section C | 3.0 | Referenced GPO IT policies / Appendices B, C, and D | Section 3.0 states that the project must adhere to GPO IT policies provided in attached Appendices B, C, and D, including Cloud Computing and Hosted Services, Systems Development Life Cycle, and Configuration Management policies. These appendices are not identified in Section J and were not included with the solicitation package provided to Offerors. Could GPO provide Appendices B, C, and D and any other GPO IT/security policies that are incorporated into the requirement or confirm that the referenced documents are not proposal requirements? | GPO IT policies and Appendices B, C, and D. GPO will provide the requested Systems Development Life Cycle (SDLC), Cloud Computing and Hosted Services, and Configuration Management documents. These materials will be made available to Offerors as soon as possible. | |
| 38 | 11, 13 | Section C | 3.0; 4.4 | Item 4 | Section 3.0 describes single sign-on across FDLP.gov and FDLP eXchange as a planned future state, while Section 4.4 requires support for federation via secure Active Directory Federation Services on the GPO end as one acceptable authentication method. The SOW does not state whether cross-application SSO/ADFS federation is a current contract deliverable or a future objective. Could GPO please clarify whether SSO/ADFS federation between the two applications is a mandatory deliverable under this contract? If so, what is the required period of performance, identity-provider architecture, interfaces, Government responsibilities, testing requirements, and acceptance criteria? | To clarify, GPO intends to utilize Login.gov as the standard SSO solution for authentication across both applications. While Section 3.0 describes SSO as a planned future state and Section 4.4 outlines support for federation via secure Active Directory Federation Services (ADFS), the primary direction is to implement Login.gov as the identity provider to ensure secure, consistent access and compliance with federal standards. | |
| 39 | 11-13 | Section C | 2.0; 4.1 | Current-state system inventory and utilization | The SOW identifies major technologies such as Drupal, PHP, MySQL-compatible databases, RabbitMQ, and Solr but does not provide sufficient current-state inventory or utilization data to size and price hosting and support. Missing information includes environment topology, server/instance counts, compute and memory sizing, storage and database volumes, backup volumes, bandwidth/traffic, peak concurrent users, log volumes, application integrations, and current software/module versions. | ||
| Will GPO provide a current-state architecture/system inventory and representative utilization data for FDLP.gov and FDLP eXchange, including production and non-production environments, so Offerors can size and price the solution on a common basis? | The requested current-state architecture, system inventory, and representative utilization data for FDLP.gov and FDLP eXchange, including both production and non-production environments, will be provided in a separate document to ensure Offerors can accurately size and price the solution on a common basis. | ||||||
| 40 | 11-12, 16 | Section C | 2.0; 4.1; Hours of Operation | Support hours / incident response | The SOW requires 24/7 system support, 24/7 critical-incident support, core business-hour support from 7:30 a.m. to 5:00 p.m. EST Monday through Friday and miscellaneous Saturdays, and emergency call support 24/7. Section 4.1 also states that support must have “a response time of no less than 1 hour from the initial incident creation,” which would literally establish a minimum response delay rather than a maximum response time. No incident severity definitions or corresponding response/resolution targets are provided. Would the government please clarify the distinction among 24/7 monitoring, 24/7 critical/emergency incident support, and normal application/help-desk support; define the required coverage for miscellaneous Saturdays and Federal holidays; confirm whether “no less than 1 hour” should read “no more than 1 hour”; and provide severity classifications with applicable response, restoration, resolution, and notification targets? | 24-hour automated monitoring refers to the continuous surveillance of system health, performance, and activity using automated tools and processes. This monitoring is designed to detect anomalies, outages, or performance issues as soon as they occur, generating alerts for support teams. Automated monitoring does not necessarily involve immediate human intervention; its primary purpose is to ensure that systems are observed at all times so potential incidents are identified promptly. 24-hour critical emergency resolution, on the other hand, is the commitment to provide immediate human response and action when a critical incident occurs. This means that, regardless of the time of day or night, there are qualified support personnel available to address and resolve urgent issues that threaten system availability, security, or functionality. Emergency resolution includes troubleshooting, restoring services, and communicating with stakeholders until the problem is resolved. | |
| 41 | 11-14 | Section C | 2.0; 4.1; 4.4 | Item 5 / backup and disaster recovery | The SOW requires daily/weekly automated backups, redundant architecture with automated failover, hot backup/restore with minimal downtime, and storage of disaster-recovery data at a second off-site U.S. facility, but it does not define backup retention periods, recovery point objectives (RPO), recovery time objectives (RTO), restore-testing frequency, or acceptable geographic separation. Please provide the required RPO, RTO, backup retention schedule, restore/DR testing frequency, and any geographic separation requirements for the primary and disaster-recovery environments. | Thank you for outlining the backup and disaster recovery requirements in the SOW. To ensure industry-standard and efficient response times, we propose the following specifications: Backup Retention Schedule: Daily backups retained for 60 days; weekly backups retained for 12 months; monthly backups retained for Period-of-Performance. Recovery Point Objective (RPO): Maximum data loss of 24 hours (aligned with daily backup frequency). Recovery Time Objective (RTO): Systems restored within 4 hours of a failure or disaster event. Restore/Disaster Recovery Testing Frequency: Restore tests conducted quarterly; full disaster recovery simulation performed annually. Geographic Separation Requirements: Primary and disaster recovery facilities should be located at least 500 miles apart to mitigate regional risks and comply with best practices for off-site storage within the United States. These parameters follow standard industry practices for enterprise environments and support efficient recovery. | |
| 42 | 11 | Section C | 2.0 | Application security certification and monitoring | The SOW requires “Application security certification and monitoring” but does not identify the required application-level certification, assessment, testing methodology, reporting artifact, approval authority, or frequency. This requirement appears distinct from the hosting platform’s FedRAMP authorization. Would the Government please identify the specific application security certification or assessment required, including applicable standards, testing/scanning requirements, frequency, deliverables, and the party responsible for approval or authorization? | While the SOW does not distinguish these requirements from the hosting platform’s FedRAMP authorization, we recommend aligning application-level security assessments with FedRAMP Moderate (FedRAMP Medium) standards to ensure comprehensive protection and consistency across both the application and hosting environments | |
| 43 | 14 | Section C | 5.0 | Task ID 2 | Task ID 2 requires the vendor to work with proprietary software manufacturers so that system products and service licenses, patches, updates, and configurations are acquired and applied appropriately. The solicitation does not identify the proprietary products or state whether associated licenses/subscriptions are Government-furnished or must be purchased and included in the contractor’s FFP hosting/support price. | ||
| Could GPO please identify all proprietary/COTS software and services presently used by FDLP.gov and FDLP eXchange, including quantities and license terms, and clarify which licenses/subscriptions are Government-furnished versus contractor-furnished and priced under the applicable CLIN? | Please see the attached documents for the requested information regarding proprietary/COTS software and services, including quantities, license terms, and clarification on Government-furnished versus contractor-furnished licenses/subscriptions. | ||||||
| 44 | 14-15 | Section C | 5.0 | Task ID 3 | Task ID 3 requires ongoing UX adjustments, content reorganization, navigation enhancements, database enhancements/expansion, search enhancements, and News Alert support. These activities can range from minor configuration changes to substantial development, but the SOW does not provide a historical workload, backlog, expected quantity, size/complexity limits, prioritization process, or change-control mechanism. CLIN 0003 is Firm-Fixed-Price. Is GPO able to define the expected volume and level of effort for application enhancements under CLIN 0003, provide representative historical ticket/enhancement demand or a current backlog if available, and clarify the process for work that exceeds the contemplated FFP scope? | At this time, GPO is unable to provide historical level-of-effort data such as actual hours expended by task area from the incumbent contract or prior period of performance. However, based on prior experience and typical requirements for similar projects, GPO anticipates that personnel time commitments will generally range between 5 and 25 hours per week per task area. This estimate should help inform offerors’ staffing and pricing approaches, including considerations for ticket volume, staff dedication, and operational support. If more specific historical data becomes available, GPO will share it to further assist in proposal development. | |
| 45 | 4-10; Attachment J.1 | Section B; Attachment J.1 | CLIN 0004 and option-year equivalents | Project Management pricing | Section B identifies Project Management as a Firm-Fixed-Price CLIN with a quantity of 80 hours and a note of “Not to exceed 80 Hours per month.” Attachment J.1 instead instructs Offerors to enter a fully burdened hourly rate, uses an annual evaluated quantity of 960 hours (80 x 12), and states that actual payment is based on authorized hours actually performed. These instructions describe an hourly, usage-based payment structure rather than a conventional FFP CLIN and use a different evaluated quantity than Section B displays. Could GPO please clarify the intended contract type, evaluated quantity, and invoicing method for CLIN 0004 and corresponding option CLINs; confirm whether Offerors should price an hourly rate using 960 hours per year for evaluation and invoice only authorized hours actually performed, or provide a fixed monthly/annual price regardless of actual hours; and also confirm whether Offerors should enter 960 hours in the applicable annual Project Management quantity fields in Attachment J.1 or whether GPO will issue a revised pricing workbook with the evaluated quantities populated? | See #21 | |
| 46 | 27 | Section L | L.3 | Submission/Delivery Instructions / estimated staffing levels | Section L.3 states that the Government’s estimated staffing levels are provided for planning purposes only and allows Offerors to propose alternative staffing approaches. No Government-estimated staffing levels appear in the solicitation or attachments. Could GPO please provide the Government-estimated staffing levels referenced in Section L.3 or confirm that no Government staffing estimate is being provided and Offerors are to develop staffing entirely from the SOW requirements? | The Government is not providing estimated staffing levels. Offerors are responsible for proposing the staffing necessary to successfully perform all requirements of the SOW. The solicitation will be amended to remove the reference in Section L.3 indicating that Government-estimated staffing levels are provided. | |
| 47 | 27-28 | Section L | L.3; L.4 | Deliverable requirements and acceptance criteria | Section L.3 requires Offerors to demonstrate the ability to meet all deliverable requirements and acceptance criteria, but the SOW identifies delivery schedules without defining objective acceptance criteria for recurring hosting, maintenance, support, application enhancement, project management, reports, documentation, or transition activities. | ||
| Will GPO please provide the acceptance criteria and Government review/acceptance process for the required deliverables, including any review periods, correction periods, or service-level measures that determine acceptance? | Industry-standard acceptance criteria for a small Content Management System (CMS) support contract typically include the following elements: Functionality Verification: All deliverables must meet the functional requirements outlined in the SOW. This includes proper installation, configuration, and operation of the CMS as specified. Timely Delivery: Deliverables are submitted according to the agreed schedule. Late submissions may require justification and approval for extension. Quality Assurance: Deliverables are free from critical defects, thoroughly tested, and meet documented quality standards. System enhancements and updates are verified in a staging environment before deployment. Documentation: User guides, technical manuals, and support materials are complete, accurate, and reflect the current system state. Support Response: Support requests are addressed within specified timeframes (e.g., initial response within 4 hours, resolution within 24 hours for high-priority issues). Maintenance: Regular maintenance tasks (backups, updates, security patches) are performed as scheduled and documented. Project Management: Status reports, meeting notes, and project plans are submitted as required and reviewed for completeness and accuracy. Transition Activities: Knowledge transfer, system handover, and training are conducted, with confirmation from the receiving party. Review and Correction Periods: Government will review each deliverable within five (5) business days of submission. If deficiencies are found, the Offeror must correct and resubmit within three (3) business days. Service-Level Measures: Uptime must meet or exceed 99% monthly availability; critical issues must be resolved within 24 hours; non-critical issues within five (5) business days. The Government review/acceptance process typically involves an initial review of deliverables for completeness and compliance, followed by written acceptance or request for corrections. Acceptance is documented once deliverables meet all criteria and any required corrections are completed. | ||||||
| 48 | 15 | Section C | 5.0 | Task ID 4 | Task ID 4 requires a letter stating that all personnel have completed National Agency Check with Inquiries (NACI) screening before working on the project. Services are otherwise required to begin at award, but the solicitation does not explain whether GPO will sponsor required investigations, whether equivalent/current Federal investigations are reciprocal, or whether personnel may begin work while screening is pending. Please clarify the personnel screening requirement, including who initiates/sponsors the investigation, whether prior or equivalent Federal background investigations satisfy the requirement, required evidence, expected processing time, and whether personnel may perform any work pending completion? | NACI completion is required before starting work. Prior equivalent investigations may be accepted with proper documentation, but contractors are responsible for sponsorship and payment; the GPO will not cover these costs. For questions, contact the contracting officer. |
Screening Requirement: All personnel assigned to Task ID 4 must finish NACI screening before project duties begin.
Investigation Sponsorship and Payment Policy: The employer or contracting agency must sponsor and pay for NACI investigations. GPO does not fund federal background checks.
Reciprocity of Prior Investigations: Previously completed current or equivalent federal investigations may meet the screening requirement if documented and aligned with NACI standards.
Required Evidence: Contractors must provide official proof showing investigation type, completion date, and clearance status.
Processing Time: NACI processing generally takes several weeks; plan accordingly.
Work Eligibility Pending Screening: No one may start Task ID 4 until NACI screening is complete and verified. No exceptions for pending investigations.
| 49 | 14-16, 30-31 | Sections C and M | 5.0; M.5 Factor 1(1) | Transition Plan | The SOW requires the successful contractor to assume hosting/support responsibilities without interruption and to maintain transition-out documentation, while Section M requires a transition plan. However, the solicitation does not identify the incumbent contractor or its transition obligations. In addition, recurring hosting/support deliverables are stated as due at the date and time of award while the kick-off meeting occurs up to ten business days after award, leaving no defined transition-in period. | ||
| Please identify the incumbent contractor and the services it currently performs; confirm whether the incumbent is contractually required to provide access, exports, documentation, credentials, and knowledge transfer; and define the transition-in period, overlap, service-responsibility date, Government dependencies, and required transition milestones. | While the solicitation does not currently identify the incumbent contractor or specify its transition obligations, it is essential for a seamless transfer of hosting and support responsibilities. To facilitate this process, the incumbent contractor shall support the technical transition by providing timely access to systems, exporting relevant data, supplying necessary documentation and credentials, and participating in knowledge transfer activities. The transition-in period should be clearly defined, beginning at the date and time of award and continuing through the kick-off meeting, which is held up to ten business days after award. During this interval, both the incumbent and the incoming contractor will collaborate to ensure continuity of services, with overlap and shared responsibilities as needed. The official service-responsibility date will coincide with the completion of the transition-in period, subject to Government dependencies such as access to facilities, information, or personnel. | ||||||
| 50 | 3, 16-19 | Sections B, C, and F | Section C 7.0 | Base Period / Period of Performance | Section B states that the base period runs from date of award through 12 months, while Section C and Section F establish fixed dates of October 1, 2026, through September 30, 2027. It is unclear whether the period of performance floats with the actual award date or is fixed to the dates shown in Sections C and F. Could GPO please clarify whether the base and option periods are fixed to the calendar dates shown in Sections C/F or begin based on the actual award date? If the dates are fixed, explain how any award after October 1, 2026 will affect CLIN quantities, pricing, transition, and invoicing. | The anticipated award/effective date is October 1, 2026. The Base Period of Performance is October 1, 2026 through September 30, 2027. The solicitation will be amended to remove inconsistent references to “date of award through 12 months.” |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .