SCI_Q-A.pdf

Date of Submission Question Answer Response Provided

3/19/2018 Can you clarify? “RFI’s shall not exceed thirst pages.” Good catch. That should read “thirty” as in 30. 3/20/2018

3/30/2018

Are they looking for a vendor's physical hosting facility or will they be okay with cloud facilities such as secure AWS or Microsoft Azure

No they are not looking for a vendor’s physical hosting facility. Commercial cloud facilities such as AWS or Azure that meet FEDRAMP status are desirable options.

4/2/2018

3/23/2018

The RFI talks about the scope of modernization effort, stream‐lining development and the applications that provide services to your customer, but I'm curious if you intend to achieve this with current standardized environment, or if you're willing to look at replacing certain components with OpenSource alternatives that achieve all your requirements and reduce costs?

The answer is Yes. We are completely open minded to innovate ideas that reduce cost while achieving the requirement. This includes open source and commercial cloud solutions that meet FEDRAMP certification.

4/2/2018

3/30/2018

Does AMS support mobile devices such as phones and tablets for offline activities? If not, does AMS support the creation of customer desktop application? What is the application approval process for such applications?

AMS offers very limited support for mobile devices currently. AMS does support the creation of custom desktop or offline browser applications that meet the IT standards denoted in the RFI. The application approval process involves meeting with ITS CAB management as well ensuring the custom code meets 508 and vulnerability scanning requirements.

4/2/2018

3/30/2018

Will the Government be open to access through mobile applications for this requirement? If the distributed client applications on a laptop provides minimal functionalities to the users, will this limited/minimal functionality be defined at the RFP stage?

Yes and Yes.

4/2/2018

3/30/2018

Can the Government clarify if there is requirement for the source code (for the modernized systems) to be open‐source? Are the current SCP/SCI systems open source?

There is no specific requirement that the solution be open source, although AMS is sensitive to reducing long term maintenance cost. If the solution being proposed is a COTS or SAAS solution that meets the requirements, then AMS is acceptable to that.

4/2/2018

3/30/2018

Can the Government clarify this requirement, is this in addition to USDA (AMS) established gate review processes and review/approval activities? Will this Technical Debt Sprint follow every release (deployment sprint)?

No. The technical debt sprint is at the end of the full delivery. The 90 warranty starts once the final solution is delivered. 4/2/2018

3/30/2018

Is the Government open to review and/or stratify the requirements needed for developer skiil set expertise (and associated industry cost) for a COTS integration project?

Yes. AMS is open to this suggestion based on the proposed solution being implemented. This requirement would obviously need to be amended if a COTS or SAAS solution is accepted.

4/2/2018

3/30/2018

Does AMS have current data integration tools available? Is the Government looking for industry recommendations as part of the overall solution?

AMS has other solutions that integrate with inside and outside solutions. This is done using industry standards such as web services, API, and database links. AMS is seeking industry recommendations on doing this type of integration in the more efficient and effective method.

4/2/2018

3/30/2018

Can the Government provide more specifics regarding the need for Microsoft.Net skills? Is this regarding current .Net based AMS systems that will be re‐ factored and/or subsumed?

AMS IT standard is .Net. If the proposed solution is .Net, then the contractor shall staff the project with the appropriate technical expertise. If the solution proposed is open source, then the contractor shall staff with the appropriate technical expertise. AMS is simply wanting to ensure the contractors staffs the project appropriately.

4/2/2018

3/30/2018 Does the Government plan to release a complete list of all SCP and SCI legacy systems and the supporting technologies at the RFP stage?

This is a complete list. AMS will provide further technical information on each when the RFP is released.

4/2/2018

3/30/2018

Can the Government provide any additional information (such as nature and status) on other similar system modernization initiatives the SCP will integrate with over time?

The integration of these external solution is a long‐term goal and not part of the initial delivery. Integrating with these solutions will be incremental.

4/2/2018

3/30/2018

Under the Standardization Initiative, it is mentioned that SCI is working on business process standardization initiatives. Can the Government clarify the transition and knowledge transfer mechanisms between the standardization and modernization initiative

AMS has two separate groups that are becoming one. That "transition" is ongoing.

The business process standardization is ongoing and will be complete before development on this solution begins. AMS wishes to have all standardization complete so as to reduce any rework in the new modernization effort.

4/2/2018

3/29/2018

Section 11, page 16 of the RFI mentions two key roles, the Scrum Master and the Certified Scrum Developer.

In the second bullet point it also refers to developers in plural. What is the government’s estimated range of the team size?

AMS has broad experience with working with contractor Agile teams. On some projects the teams are 4 to 5 people. On other projects, the teams are larger. AMS is leery to direct a contractor to make a team X numbers. AMS relies on the recommendation of the contractor on how they feels the project team is best staffed. The intent of this requirement is to ensure that the contractor has proven, experienced staff on the agile team. AMS is open to suggestion that the contractors feels would improve team efficiencies and shorten the development time.

4/2/2018

3/29/2018

Will the government be interested to see a vendor whose capabilities include end‐to‐end payment processing as an alternative to an integration with Pay.gov?

AMS is completely open minded to seeing the capabilities of each vendor. Pay.gov is AMS’s standard for payment. Deviating from that current standard will be an organizational challenge.

3/29/2018

Will the government consider adding strategic marketing to drive adoption as a required function?

This will create awareness of newly integrated services and ensure that new technologies and capabilities are accepted and properly leveraged by internal and external stakeholders.

AMS is completely open minded to adding this in if it can be shown to add value to AMS without adding significant cost to the overall solution. 4/2/2018

3/29/2018

Can the USDA E‐Authentication single sign‐on (SSO) technology be used to authenticate public users or extranet users in addition to USDA staff?

Yes. E‐Auth allows Level 1 and Level 2 authentication. Public users may have either at no charge. Level 2 offers a higher level of authentication.

4/2/2018

3/29/2018 What is the anticipated FISMA security level for the new system (e.g. Low, Moderate, High)?

Moderate 4/2/2018

3/29/2018

Can the government please clarify the role of the contractor in the Standardization Initiative? For instance, is the government looking for the contractor to drive the initiative or will they just need to provide a solution that supports the new standardizations?

AMS is going through an internal business process and standardization initiative. This is self‐led. AMS is not seeking a contractor to drive this effort. AMS seeks a contractor to develop a technical solution that support this new standardization.

4/2/2018

3/29/2018

Does this statement imply that contractors cannot host the system in the cloud since those facilities are not owned by the contractor? Similarly, can the contractor host the production system in the cloud or are they expected to host the solution within USDA datacenters?

During development, the contractor bears the cost to host their development environment.

Where that is, is entirely up to the contractor as long as the environment matches the production environment. This can be a locally hosted at their facilities or in the cloud. AMS wishes to ensure all environments match to ensure effective testing. If hosted in the cloud, FEDRAMP certification is required. AMS has its own government run data center that supports both SAAS and PAAS, as well as dedicated server hosting. The solution proposed by the contractor will be evaluated for cost and capability. AMS is completely open minded to commercial cloud hosting as long as FEDRAMP status is met.

4/2/2018

3/29/2018

Will the government extend the submission date to allow sufficient time for both the government to respond to questions and for vendors to review and incorporate the answers into their final submissions?

No. In order to keep this high priority project on schedule as well allow AMS to evaluate all responses, AMS feels 30 days is sufficient. 4/2/2018

3/30/2018 SaaS is discussed. Will AMS also consider PaaS? Yes. AMS has several PaaS solutions. 4/2/2018

3/30/2018

Is a formal analysis of alternatives (AoA) desired in Phase 1?

No. Phase I will be for the contractor to fully flush out and document the business requirements that AMS has defined. Phase I will allow for the contractor to enter Epics and User Stories in Team Foundation Server and to work with AMS to prioritize the development (Phase II).

For PaaS, yes AMS will pay the cost either for USDA Data Center or commercial hosting. 4/2/2018

3/30/2018 For SaaS, AMS will pay the respective vendor for access to SaaS.

4/2/2018

3/30/2018 Has the FIPS 199 categorization (CIA) of the replacement applications been determined?

Moderate 4/2/2018

3/30/2018

Does AMS have anticipated durations for Phase 1 and Phase 2?

Phase I is estimated to be 60‐90 days. Phase 2 will be at a minimum one year, if not longer.

AMS has minimal core functionality that will be identified in Phase I that needs to be in the initial base release

4/2/2018

3/30/2018

Does AMS have an official SDLC that must be followed, in addition to what's listed in RFI?

No, but AMS does have a formal CAB (Configuration Approval Board) that must approve any significant software development or release to the environment. AMS ITS will shepard this process but contractor participation may be required.

4/2/2018

3/30/2018 Will the contractor participate in process‐mapping activities at the beginning of Phase 1? (pre‐User Story definition)

Possibly but limited in duration. If any, it will be limited in duration as AMS for the most part has this mapped out.

4/2/2018

3/30/2018

Does the AMS environment support container management platforms such as Docker or OpenShift?

If so, can they be specified in Appendix A.

AMS does not understand this question. The new solution will be hosted either at the USDA Data Center or in a commercial cloud data center meeting FEDRAMP certification. If it is common practice for data centers to accept container management platforms, then the answer is yes.

4/2/2018

3/30/2018

Given the references to .NET and TFS, are most applications .NET based?

Yes, but AMS does have other solutions that fall outside of .Net such as Java and JSP that run on open source solutions that are acceptable. Agile Epic and User Stories will be stored in TFS regardless of the software chosen.

4/2/2018

3/30/2018

Given that the contractor will host the development environment, and presumably a test environment, what is the anticipated hand‐off to AMS? For example, if containerization is supported, containers could be promoted up.

AMS desires that the development, test, and production environment mirror each other to ensure stability, effective testing, and streamlined release processes.

4/2/2018

3/30/2018 The RFI states that "typing shall not be less than 12 pitch." Do you mean that typing shall not be less than 12 font?

Yes.

4/2/2018

3/30/2018 The RFI states that the response will not exceed thirst pages. Do you mean thirty (30) pages?

Yes. This was corrected shortly after initial release. Thank you for bringing that to our attention.

If SaaS is used, or PaaS, will that be GFI?

The RFI reads, that based on the requirements, it’s the agency’s preference for a COTS/Cloud/PaaS solution to replace BIIS and FEIRS? Can you confirm?

Yes, but SaaS is also a viable option. AMS is not opposed to a customize coded solution however the concern is cost for long term maintenance and ensuring the solution remains current.

4/2/2018

3/30/2018 Specifically, what is the Billings and Inspection Information System (BIIS) current IT platform?

BIIS is a web bases ASP.net solution connected to a SQL Server backend database. 4/2/2018

3/30/2018 Specifically, what is the Fresh Electronic Inspection and Reporting/Resource System (FEIRS) current IT platform?

FEIRS is a compiled client installed on AMS workstations coded in C++ connected to a SQL Server backend database.

4/2/2018

3/30/2018

Specifically, what are the other “legacy” systems and platforms involved in the project?

There are several smaller applications that support the certification process. These smaller applications will be further outlined in the RFP.

4/2/2018

3/30/2018

In Phase 3 would a Train the Trainer approach be acceptable?

Possibly, but the SCI user base is broad and diverse. There may still need to be hands on training depending on the complexity of the solution.

4/2/2018

3/30/2018

How often will AMS Records Management training be given and at what geographical locations? Would virtual training be acceptable?

Records Training is completely online done via USDA Aglearn. User (including contractors) must do annual Records and Security Training.

Users can normally test out of the training upon starting the online training session. If the user does not test out, then training normally takes one hour. This is a low impact department requirement for your staff.

4/2/2018

3/30/2018 What data classifications are in scope? (e.g. PII, PHI, Restricted, Private, Public or other)

The classification of this system is moderate. 4/2/2018

3/30/2018

If a “teaming” approach is used to respond to the potential RFP, will the Prime be able to use past performance from a Subcontractor?

Yes, as long as it clearly stated who did what work. If the sub‐contractor did the work, then clearly state that. There should not be any ambiguity or intent to misrepresent the past performance of the Prime.

4/2/2018

3/30/2018

Is there a preference/requirement for specific “data visualization” tools/platforms to be used for data quality review of data sets? AMS does not have a predetermined preference.

AMS prefers a COTS or SaaS solution over a customized code solution to render the data sets mainly because of cost to maintain long term.

4/2/2018

3/30/2018

What are the anticipated geographical locations vendor would need to be physically at to complete Phase 1 regarding user stories sessions?

Initial project Kick Off will be held in Washington DC, with a few follow up meeting to set ground rules and start the badge/network access logistics. Most Phase I meetings can be done virtually via LiveMeeting and conference calls. If that proves difficult, or turns out to unproductive or contractor performance is unsatisfactory, then more onsite meeting may be required

Can you confirm that in this scenario the Contractor must be FedRAMP certified (per Sec4 bullet 1) AND that the production system will need to be deployed to private AMS Technical Environment data centers (per Sec. 18)?

If the solution is hosted as a commercial cloud provider, the FedRAMP applies. If the solution is hosted at USDA Data Center (NITC), then this site is already FedRAMP. AMS does not have a private data center that will host this solution. It will either be commercial or NITC.

4/2/2018

3/30/2018

Can you confirm that as a FedRAMP certified SaaS provider that hosting the production system on a FedRAMP certified PaaS/IaaS service such as MS Azure Government Computing Cloud or AWS GovCloud will not be acceptable?

No, this is acceptable.

4/2/2018

3/30/2018 Will the SaaS need to run entirely in a Windows Server environment (per AMS Technical Environment) as opposed to a Linux environment?

No, it can run either.

4/2/2018

3/30/2018

Will the backend database need to be exclusively MS SQL Server and/or MySQL (per AMS Technical Environment) or as a FedRAMP certified SaaS provider will other database technologies be allowed?

The backend database will need to be a current industry standard database that supports a relational database and provide enterprise level performance. AMS does not want to engage with any proprietary software that required long term cost.

4/2/2018

3/30/2018

Will the business intelligence dashboards need to be created with TIBCO Spotfire, SiSense or others listed in AMS Internet Technical Environment or as a FedRAMP certified SaaS provider will other business intelligence systems be allowed?

AMS is completely open minded to this. AMS is not bound to existing dashboard software.

4/2/2018

3/30/2018

Will the Contractor be required to maintain the service or will AMS Information Technology Service maintain the service and network independently from the contracted provider?

AMS may seek an Operations and Maintenance contract following development of the application itself until such time as AMS ITS can support internally. The hosting of this solution will not the responsibility of the contractor.

4/2/2018

3/30/2018

Does Pay.gov currently offer or plan to offer secure integration points or application programming interfaces (API’s) for SaaS services to integrate with?

TBD. This will have to be researched.

4/2/2018

3/30/2018

What is an acceptable definition for real time in the requirement “Real time external reporting” in Section 4, ie. instantaneous, within 15 minutes, 1 hour?

Real time means, near real time as reasonably as technically possible within most cost efficient manner. That is the best that we can answer at the present time. As Phase I commences, those technical details will be flushed out and answered.

The intent of this requirement is to give our customers and users access to their data as reasonably as possible within most cost efficient manner.

4/2/2018

3/30/2018

With regard to the requirement “Customer Relationship Management (CRM) functionality for managing customer pertinent information” on page 6.

Is it known at a high level what types of customer information and what types of CRM functionality will be needed?

Basic customer information. Company, POC, Phone, Address, Certificates, Payment history, Inspection History.

Information (PII) are expected to be needed in the CRM functionality and overall service offering? Is it anticipated that the level of PII would allow for a FedRAMP Tailored authorization as opposed to a FedRAMP Agency or JAB authorization.

The new system will be rated as a Moderate. We don’t intend to capture full name, but we will have inspection history, payment information that is rated as restricted.

4/2/2018

3/30/2018

With regard to the requirement “Backend auditing capabilities that capture data collection, manipulation, and reporting metrics to ensure data quality.” Who will conduct these audits of data quality, AMS, Contractor or other? Are there anticipated triggers for conducting an audit?

The auditing is envisioned as either stored procedures or triggers that execute when data is manipulated or when users do “something”. The solution should have some sort of interface where AMS Administrators of the system can conduct periodic audits of user activity to ensure compliance with agency business processes. This duty is not envisioned to be a contractor managed feature. There may be external auditors that periodically audit the system. This interface would aid them in auditing data changes.

4/2/2018

3/30/2018

With regard to the requirement “Standardized business rule engine offering a dynamic backend interface that allows flexible changes to be introduced without contractor interface.” Is this requirement pertinent to all aspects of the system or more relevant to specific areas of the system? Ex. A dynamic backend for FEIRS replacement versus dynamic backend for CRM or inspector dispatch and routing?

This requirement is to drive the standardization effort of SCI. If there is a business rule that needs to modified on how grading inspections or certificates are generate across the board, then this dynamic business rule engine would provide that capability.

4/2/2018

3/30/2018

With regard to the section where “internet connectivity is not available” on page 6. Is this anticipated to be a temporary or situational (ex. they are in an area with bad coverage)? If temporary or situational, would it be acceptable to still use HTML5 with local storage to operate disconnected until a connection is reestablished and previously cached data can be submitted to backend?

It is both temporary or situational as some graders don’t have internet onsite but get it back when they return to the office. Using HTML 5 with local storage and Chrome has been done with other AMS solutions and is acceptable.

4/2/2018

3/30/2018

Please confirm that “RFI’s shall not exceed thirst pages” in section 21 was meant read “RFI’s shall not exceed thirty pages

Yes, 30 is the correct number and was pointed out quickly upon releases and fixed in the currently RFI online. Thank you for pointing that out. 4/2/2018

3/28/2018

What are the systems currently in use today and is the data stored in underlying databases? If not, where is that data stored?

Both existing systems are legacy systems that have outlived their usefulness and no longer meet the current needs of AMS. The data is currently stored in each of their respective systems.

4/2/2018

3/28/2018

Does the USDA intend to incorporate legacy data into the new system or will it reside in legacy systems?

Yes. We want to migrate legacy grade standards and other inspection data so that certificates could tecnically be generated from legacy data.

4/2/2018

3/28/2018 Is the USDA looking for a completely new system or can the legacy systems be connected via new technology?

New system

3/28/2018 What are the processes that need to be put in place behind the new system?

AMS seeks clarity on this question, as "Processes" is a broad term.

4/2/2018

3/28/2018 Is this a funded project? Yes 4/2/2018

3/28/2018 What are the rules regarding generation of certificates?

This is far more complex to cover in the RFI state. It will be better defined in the RFP process.