Vendor Questions - 1232SA24Q0053.pdf

1232SA24Q0053 – Secure Data Enclave Services Vendor Questions:

Q1. Would the Government please grant a (1) week extension to the RFP due date to allow time for bidders to evaluate the Government’s responses to the Q&A?

A1. Solicitation closing date is extended to Monday, 09/09/2024.

Q2. We respectfully request that USDA extend the deadline for proposal submission by at least a week to 9/13/2024.

A2. Solicitation closing date is extended to Monday, 09/09/2024.

Q3. Will USDA consider extending the proposal submission due date to ensure that bidders have at least 10 business days between when the responses to questions are released and when proposals are due?

A3. Solicitation closing date is extended to Monday, 09/09/2024.

Q4. Would the Government please remove the pass/fail requirement that all bidders must have a USDA ATO to bid? We feel this unfairly limits the competition.

A4. No, this is a federal requirement. Use of FedRAMP is required for all agencies, and since the work needs to begin immediately upon award the certification is needed at the time of submission of the quote.

Q5. Will USDA accept a custom solution that does not have a current ATO but is developed with integrated software and tools that do have FedRAMP certification?

A5. No, a USDA ATO is required.

Q6. Section E.4.1.1 of the CONTINUATION OF COMBINED SYNOPSIS SOLICITATION 1232SA24Q0053 states, “If a contractor does not have a current active FedRAMP certification and a USDA Authority to Operate (ATO) they will be removed from consideration and will not be eligible for award”. It is our understanding that FedRAMP certification applies to a Cloud Service Offering not a contractor.

i. Can USDA clarify what specific FedRAMP certification requirements are necessary for the contractor to provide?

ii. It is our understanding that an agency ATO applies to an existing system. Can USDA clarify what specific ATO requirements are needed for this new solicitation?

iii. It is our understanding that an agency ATO applies to an existing system. Could USDA clarify if the ATO for the solution under competition is specific to the incumbent?

A6. FedRAMP authorization/certification applies to Cloud Services offered by Cloud Service Providers (CSP). This solicitation is for Fed RAMP authorized cloud services that meet all the requirements herein.

i. The Secure Data Enclave could service offered must have an active FedRAMP Moderate authorization using the Software as Services (SaaS) service model. The FedRAMP package ID must be included in the proposal such that it can be validated against the GSA FedRAMP marketplace (https://marketplace.fedramp.gov/products)

ii. The Secure Data Enclave could service offered must have an active FedRAMP Moderate authorization using the Software as Services (SaaS) service model. The FedRAMP package ID must be included in the proposal such that it can be validated against the GSA FedRAMP marketplace (https://marketplace.fedramp.gov/products

iii. There is no incumbent. USDA has not previously had a contract of this magnitude.

Q7. Does the Prime bidder have to be FedRAMP certified themselves, or do the technology solutions themselves need to have FedRAMP ATO?

There is confusion on our part because page 2 of the SOW states:

The enclave must be implemented and operated in accordance with Federal Risk and Authorization Management Program (FedRAMP) authorization requirements, achieve appropriate balance between ease of access and functionality for data users, and provide confidentiality and privacy protection for data providers. The enclave service must have an active FedRAMP Authority to Operate (ATO) at the time of proposal, and the FedRAMP package ID must be included with the proposal. In addition, the service must maintain its FedRAMP ATO throughout the contract period of performance.

However, page 22 of the “Continuation Document” states:

Prime Contractor must have a current, active FedRAMP certification. Quotes must include active FedRAMP package ID as found on the General Services Administration (GSA) FedRAMP Marketplace website (marketplace.fedramp.gov).

A7. The Prime Contractor must have a current, active FedRAMP certification.

Q8. Will USDA accept a custom solution that does not have a current ATO but is developed with integrated software and tools that do have FedRAMP certification?

A8. No, a USDA ATO is required.

https://marketplace.fedramp.gov/products https://marketplace.fedramp.gov/products

Q9. Should a contractor propose a FedRAMP solution that is on the marketplace list, but is not currently in use within USDA, it would not hold a current ATO. Is USDA stating that a proposed FedRAMP certified solution would be removed from consideration, if it is not currently in use within USDA, hence only allowing solutions currently in use which have obtained a USDA ATO to be considered?

A9. Offerors must have a USDA ATO.

Q10. We noticed that the cover page and table of contents do not contribute to the total page count. Is it acceptable to include the cover page and table of contents in the same document as the response to Factors 1-4? Or should we submit these as separate documents?

A10. Yes, it’s acceptable to include the cover page and table of contents in the same document as Factor 1: Technical Factors and Subfactors.

Q11. Can you clarify if we can use our company name, logo, and named technology in the submission or if the evaluation is intended to be blind?

A11. The company name (to include logos), point of contact, address, telephone number, e-mail address, RFQ number, contractor’s SAM.gov UEI number, and Commercial and Government Entity (CAGE) shall be included on the cover page/table of contents; however, it shall not be included in the technical section submittal (Factor 1: Technical Factors and Subfactors).

Q12. In Section E.3.1.2., Technical Approach and Technical Experience are combined into Subfactor 2; however, in Section E1 (page 19) and E.4.1.1., Technical Approach and Technical Experience are listed as two separate subfactors in the Technical Factors portion of the submission. Please clarify if Technical Approach and Technical Expertise should be specified as separate subfactors (e.g., Subfactor 2 and 3 as outlined in E.1. and E.4.1.1) or as a single subfactor (as outlined in E.3.1.2.). In addition, if Technical Approach and Expertise should be specified as separate subfactors, please clarify the page limits for the two subfactors.

A12. See revised “Continuation of Combined Synopsis Solicitation 1232SA24Q0053” combining Subfactor 2 and 3 into Subfactor 2: Technical Approach and Technical Experience for a total page limitation of 10 pages in accordance with Section E.3.1.2.

Q13. We noticed that Subfactor 1 is limited to 5 pages; can you clarify if there are other elements that should be included in this section beyond FedRAMP Certification and current USDA ATO verification?

A13. The limit is 5 pages, and we will not review anything in excess of that.

Q14. If your team is not looking for any additional information in this section, can we manage the division of total page count between all technical subfactors (e.g., add additional pages to the Technical Approach or Technical Experience sections)?

A14. See revised "Continuation of Combined Synopsis Solicitation 1232SA24Q0053”.

Q15. The SOW states that Quality Control and Security Monitoring Plans should be included with our proposal. Please verify if these plans should be included in the submission; and, if so, indicate how they should be included in the submission (e.g., as appendices to the submission or as separate documents). Alternatively, is the expectation that these plans would be provided upon contract award?

A15. Quality Control and Security Monitoring Plans should be included with Subfactor 2. The page limit for Subfactor 2 is increased to not to exceed10 pages.

Q16. In section 7.0 Deliverables schedules, Deliverable 7 documentation is due at the time of the proposal, can USDA clarify if they are expecting a deliverable as part of the proposal?

A16. Proof of compliance with FedRAMP and NIST 800-171 requirements must be submitted at the time of the proposal. The contractor must submit continued confirmation of compliance with the monthly reports. The deliverable is the monthly compliance reporting.

Q17. The Deliverables Schedule in the Procurement Statement of Work specifies that the enclave migration will be complete 90 days after the kick-off meeting. Is it correct to assume this 90-day period after the kick-off includes migration of new users, data, and projects into the data enclave as well as migration of any USDA users receiving services under current service agreements?

A17. Migration of new and existing users, data, and projects will begin immediately after the kickoff meeting and will be completed within 90 days. New users for this 90-day completion requirement are defined as any known users at the time of contract award who have not previously used Enclave services.

Q18. Section 7.0 in the Statement of Work, can USDA provide details of the scale of data that would need to be fully migrated to the new enclave within 90 days from the kick-off meeting?

A18. Initial uploads of data would approximate 20 TB

Q19. A new contractor would have difficultly joining the USDA IT ecosystem in a way that allows for storing their data within this narrow timeframe. Would USDA extend this timeframe to 90 days to accommodate contractor transitions and onboarding?

A19. USDA would be willing to discuss an extension of this timeframe.

Q20. Section 2.1.2 in the Statement of Work indicates that the enclave will need to be cloud-based and in a scalable environment. In which cloud platform, is the USDA Secure Data Enclave currently hosted? Would USDA be open to migrating the new Secure Enclave Services to another cloud environment for hosting the proposed secure enclave?

A20. The Secure Data Enclave cloud service offered may be hosted on any public or private cloud platform provided that the Secure Data Enclave cloud service has an active FedRAMP Moderate authorization using the Software as Services (SaaS) service model. The FedRAMP package ID must also be included in the proposal.

Q21. Section 2.1.4 in the Statement of Work states, “Subject to provision of licensure by USDA.”

Can USDA clarify if these software licenses (SAS, STATA, SUDAAN, ArcGIS, GAMS, GTAP, GEMPACK and others) will be provided by USDA or is the contractor to include these license costs in its Quote?

A21. The offeror would need to include the costs of licenses in their quote.

Q22. Section 2.3.4 (User Accounts) in the Statement of Work states that the USDA will allow access to the Enclave by non-USDA personnel who are responsible for self-pay services. Can USDA share the previously established fee structure charged for the self-pay services that the contractor would need to use?

Can USDA share how the non-USDA personnel pay for their self-pay services?

A22. No, the pricing structure and mechanism for payment would be determined by the vendor and cannot be directed by USDA.

Q23. In the Pricing Schedule (Attachment 2), the Sample Task Order sheet will be completed based on the service volumes specified in the Statement of Work for Sample Task Order. Please clarify the service volumes to be used for the IDIQ Pricing. Unless otherwise instructed, we will assume the volume is 1 for each CLIN/service.

A23. Offerors can quote in quantities of one.

Q24. Data File Workspace & Storage CLIN 0002AB and Additional Storage CLIN 0004AB: Storage costs per gigabyte are different for unstructured and structured data. To provide greater transparency into the storage costs, we modified the Price Schedule to show separate costs for unstructured and structured data for both the IDIQ Pricing and Sample Task Order views. Please confirm that this modification is acceptable to you.

A24. Yes, structured and unstructured data can be quoted separately.

Q25. Data Ingestion CLIN 0002AC/AD/AE: The Statement of Work for Sample Task Order specifies that CLIN 0002AC be used for years 2 & 3 and CLINE 0002AD be used for years 4 & 5. Which CLIN(s) should be used for year 1?

A25. CLIN 0002AE is most applicable to the first year, but CLIN 002AC and 0002AD need to be priced for the first year. These would be exercised during the year when new researchers are added to the system.

Q26. Data Ingestion CLIN 0002AC/AD/AE: Is there a mix of small, medium and large data ingestions that should be assumed for the Statement of Work for Sample Task Order?

A26. This is addressed in the sample Statement of Work. For these ingestions, please assume a quantity of one.

Q27. Data Ingestion CLIN 0002AC/AD/AE: The Pricing Schedule does not make any distinction between an initial ingest of a dataset and recurring ingests of the same dataset, which require fewer labor hours. Should we provide separate unit pricing for initial and recurring data ingestions? If the answer is "yes", for the Sample Task Order, should we assume that data ingests for ordering periods 2-5 are recurring ingests of some mix of initial and recurring ingests?

A27. Multiple ingestions of the same dataset will not be occurring.

Q28. Advisors CLIN 0003AE: We do not see Advisors (0003AE) included in the Sample Task Order (Attachment No. 3); however, we do see Advisors listed in the Sample Task Order Pricing Sheet (Attachment No. 2). Our assumption is that we should include the pricing for the Advisor configuration in the IDIQ Pricing tab in Attachment No. 2; but we would not include the Advisor configuration in the Sample Task Order tab because there was no volume specified. Please confirm if this assumption is correct. If not, please specify an amount of Advisor seats to be included in the Sample Task Order submission for Attachment No. 2.

A28. Advisors have been added to the Sample Task Order. Please include and use a quantity of four.

Q29. Installations and Upgrades CLIN 0004AA: Please clarify what is expected for the pricing of this CLIN. We price requests for installations of client provided user software based on the labor hours required to complete the installation. We also make available optional user software that carries a per user fee. The Sample Task Order specifies a volume for Python/R Repository which is one of the optional user software packages we offer. Unless otherwise instructed, we will include the Python/ R Repository pricing for 1 researcher on the IDIQ Pricing and for 150 researchers on the Sample Task Order. We will not include any costs for installation of client provide user software. Please provide instructions if we should proceed in a different manner.

A29. Please price the software installation and upgrades on a per user basis. The quantities you have provided meet the criteria for this pricing.

Q30. Technical Support CLIN 0005AB: Please clarify what is expected for technical support. We ordinarily provide technical support for all users with no limit on the number of support tickets submitted. The Statement of Work for Sample Task Order provides an assumption of 150 researchers and 24 tech support incidents per year, far less than one support incident per researcher. How is ""tech support incident"" defined? Is this a higher level of support for specific incidents or events beyond the normal user support tickets?

If tech support incidents are separate and distinct from normal user support tickets, we will incorporate the costs for normal user support tickets in the Workspace Configurations pricing unless otherwise instructed."

A30. A tech support incident would be anything that requires above-routine support. Routine, minor incidents, such as resetting passwords should be considered as part of the Workspace Configuration pricing. Separate pricing for more difficult (what we call Tier 2 incidents) issues should be stipulated. An example of a Tier 2 incident would be the loss of access to the enclave which involved significant tech support time to restore. We do not anticipate a large number of these types of incidents.

Q31. Data Export: There is no reference to data exports in the Pricing Schedule. The Procurement Statement of Work specifies that the contractor will "provide cursory reviews of export requests and securely transfer requested export files for disclosure risk review". Where should the pricing for cursory reviews of export requests be incorporated on the IDIQ Pricing and Sample Task Order?

What volume of cursory reviews should be assumed? Clients often specify a volume of cursory reviews on a per researcher level.

A31. We are estimating not more than one export per researcher per year. CLIN 0005AC has been added to the Pricing Schedule

Q32. Artificial Intelligence and Machine-Learning Training: There is no reference to AI and Machine- Learning training in the Pricing Schedule. The Procurement Statement of Work specifies "As needed, the contractor will provide training for data enclave users in Artificial Intelligence and Machine Learning. These will be organized events put together jointly by the contractor and USDA.

Please provide individual pricing for this item as the frequency of this task is undecided." Please clarify if and how this training should be incorporated in the Pricing Schedule.

A32. CLIN 0005AD has been added to the Pricing Schedule and the Sample Task Order. The Sample Task Order has the assumption of one training per year.

Q33. The RFP (2.1.2) notes that “cost efficiency in scalability is ideal” and also requires (2.3.10) portability to move, rebuild the data enclave. To meet these requirements, a general FedRAMP-certified cloud-based data enclave/repository that can used with different analytics engines and AI tools may benefit USDA and its agencies more than a purpose-built solution. Please clarify if USDA is looking for a purpose-built enclave solution or a data repository solution that provides more flexibility and future portability.

A33. USDA has need of a solution that provides flexibility and future portability.

Q34. Additional Services: Should all of the items outlined in SOW 2.4 Other Deliverables be included in Additional Services? (e.g., The training section includes a request for additional pricing)

A34. CLIN 0005AD has been added to the Pricing Schedule and the Sample Task Order. The Sample Task Order has the assumption of one training per year.

Q35. Migration of Existing Projects and Users and Prorated Pricing: Section 2.3.16 of the SOW indicates that line-item pricing is needed for the migration of existing projects and users at prorated pricing. "USDA has existing data users and projects (set up in another research environment) that will need to be migrated over to the data enclave. These research projects are midstream and will need to finish their work in the data enclave. These users will require a special data ingest to bring in their project files, programs, and materials. Line-item pricing is needed for the data ingest, project set-up, and prorated annual user fees." The Sample Task Order does not address this need, nor does the Pricing Schedule include a place to capture the line-item pricing. How should this pricing be included in the pricing submission?

A35. The data ingestion will be priced according to the size of the ingest, regardless of whether it is an existing project. Please price these in 0002AC. 0002AD, or 0002AE. Prorated amounts would apply to any researcher with less than one full year of access and would be priced under CLIN 0001.

Q36. Additional Storage CLIN 0004AB: Confirm that we should assume an additional 15 GB of storage for both unstructured and structured data and two price figures will be provided.

A36. Offerors are open to suggest the GB size for pricing under this CLIN. For price analysis, government will take offered size and compare pricing and units.

Q37. Is there a current incumbent for the Secure Enclave Services? If so, can USDA clarify if the previous contract was procured through a competitive process, awarded as part of another contract, or through a sole source award?

A37. There is no incumbent. USDA has not previously had a contract of this magnitude.