05GA0A25Q0018 Questions and Answers .pdf
PDF 126 KB Posted
- Attached to
- Electronic Postage Services
- Solicitation number
- 05GA0A25Q0018
About this file
This document is an Amendment 0001 to RFQ 05GA0A25Q0018 for Electronic Postage Services, containing questions and responses related to the solicitation. The key details include requirements for FedRAMP authorization or SOC 2 compliance, with specific focus on protecting personally identifiable information (PII). Vendors must provide attestation of controls from a qualified independent third party, covering five principles: security, availability, confidentiality, processing integrity, and privacy. The solicitation emphasizes robust password security standards, requiring complex authentication mechanisms that significantly increase resistance to brute force attacks.
The procurement is a recompete of a previous award (No. 05GA0A24P0011) for the Government Accountability Office (GAO), seeking electronic postage mailing services with a 12-month base period and four 12-month option periods from July 2025 through June 2030. While cloud hosting is not mandatory, vendors must follow NIST 800-53 security guidelines. Quotations are due by 10:00 AM EST on March 27, 2025, and should be submitted via email to the Contracting Officer Adrienne Washington and Contract Specialist Courtney Seace.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Amendment 0001
RFQ 05GA0A25Q0018
Electronic Postage Services No. Question Reference
(RFQ Paragraph) Question Response(s)
1 C Description/Specifications/Statement of Work
The Solicitation lists the following “Functional Requirement:
“FedRAMP Authorized” and listed on the FedRAMP marketplace with a published FedRAMP package ID to protect personally identifiable information (PII), if not FedRAMP approved, MUST have an attestation of controls such as a System and Organization Controls (SOC 2) report.
Because federal procurement law requires that an agency provide sufficient information to a bidder in order to compete intelligently and on a relatively equal basis (CWTSatoTravel, B-404479.2, April 22, 2011, 2011 CPD Para. 87), are all the following SOC2 areas of focus required: security, availability, confidentiality, processing integrity and privacy?
Yes, the five principles are required.
Is the “attestation” of the controls a self-certification or is it required to be from a qualified independent third party?
The attestation is to be done by a qualified independent third party.
What other type of attestation of controls would be acceptable?
No other types of attestation will be considered acceptable.
2 The difference between a FedRAMP Authorized system and a SOC 2 system are dramatic. For example, a system that is SOC 2 compliant can be compliant with a password of just four numbers compared to a FedRAMP Authorized system that requires a password of “minimum of 12 characters, and at least one each of upper-case letters, lower-case letters, numbers, and special characters, one character change with each password changes, only transmit passwords encrypted, require lifetime restriction of one-day minimum and 60-day maximum, and prevent reuse of the previous 24 passwords”. NIST 800-53. Based on recent studies, a 4-character password can be hacked in no more than 9 seconds through brute force attacks. A 12-character password can be hacked in 164 million years through brute force attacks.
Please list the System and Organization Controls required for an acceptable response to the Solicitation.
Controls as outlined in the vendor’s identified framework:
FedRAMP, NIST, or SOCs. The attestation of controls and any identified deficiencies.
Please list the specific System and Organization Controls required for an acceptable response to the Solicitation that are required for password creation and authentication.
Specific system and organizational controls will be evaluated based on the vendors identified framework FedRAMP, NIST, or SOCs.
3 C Description/Specifications/Statement of Work
On-line postage systems must utilize and contain Personally Identifiable Information as that term is defined in the Controlled Unclassified Information (CUI) Registry at http://www.archives.gov/cui/registry/category-list.html.
Which System and Organization Controls are required for an acceptable solution that will protect Personally Identifiable Information?
Specific system and organizational controls will be evaluated based on the vendors identified framework FedRAMP, NIST, or SOCs.
Since any proposed solution will contain PII as defined in the Controlled Unclassified (CUI) Registry, is it a requirement of the solicitation that application be hosted in the GovCloud?
No, it’s not a requirement.
Amendment 0001
RFQ 05GA0A25Q0018
Electronic Postage Services If the GovCloud is not required, what cloud service provider is required?
We do not require a cloud-based solution.
Must the hosting environment be FedRAMP authorized?
We do not require a cloud-based solution.
4 Has GAO established written policy concerning its own application of FedRAMP security or other information protection requirement applicable to its information systems? If so, will that policy be made available to interested bidders?
GAO follows to the greatest extent possible NIST 800-53, which is a publicly available document.
5 Is there any incumbent/recompete or this is a brand-new project?
Yes, this is a recompete.
5a If yes, could you please provide us with their award number or even if the customer bought similar services in the past.
Customer has brought similar services in the past.
Previous Award No. 05GA0A24P0011
File details come from the government source that posted it. Updated .