12SAD122R0003 Amendment 9 Clarifications.pdf

RFP#12SAD122R0003

SURPASS

Amendment 9 – Responses to Clarification Questions

Question 63 Response Clarification:

Question: In response to question 19 and as a result of Amendment 1, the down-select process could possibly result in the selection of a vendor without a viable UNIFI replacement system because Phase I doesn’t include a UNIFI Functional Business Requirement evaluation.

Additionally, USDA’s position regarding past performance could result in a down-select of a small business without evidence they have a viable UNIFI solution.

Government’s Response: No, the acquisition process will not result in the selection of a vendor without a viable system solution that meets or exceeds SURPASS requirements.

An Offeror’s solution will not be selected only based on phase one. Any vendor invited to Phase 2 will have to provide a full proposal that will be evaluated based on factors not requested in Phase 1.

If only small businesses are invited for phase two, an award will only take place if (1) adequate competition has taken place between two or more qualified responsible business concerns that submitted phase two proposals and (2) the intended awardee is a responsible vendor who meets a Satisfactory or higher confidence level. Satisfactory Confidence means that the Government has satisfactory confidence that the Offeror understands the requirement, proposes a sound approach, and will be successful in performing the contract with some Government intervention.

Question: Meanwhile based on these issues are we correct that a large business with a Cloud based LOS with 35 active clients meeting 85% of the requirements that can be fully operational in 12 months for a fraction of the contract budget could be eliminated?

Government’s Response: If an award cannot take place exclusively with small business concerns after phase two evaluations have concluded, if only small business concerns are asked to participate in the phase two, then the other than small business (large business concerns) deemed responsible from phase one will be notified to submit phase two at that time. An award will only take place if (1) adequate competition has taken place between two or more qualified responsible business concerns that submitted phase two proposals and (2) the intended awardee is a responsible vendor who meets a Satisfactory or higher confidence level. Satisfactory Confidence means that the Government has satisfactory confidence that the Offeror understands the requirement, proposes a sound approach, and will be successful in performing the contract with some Government intervention

Question 73 Response Clarification

Question: For the purposes of the MVP and DME, can you define the difference between a COTS solution and an “Integrated product solution”, as mentioned in the PWS?

Government’s Response: The term COTS solution, as utilized in the SURPASS PWS, refers to products that are native to Loan Origination (i.e., LOS COTS products). The term Integrated Product Solution refers to software that is not native to LOS but can be configured to deliver the detailed requirements. Additionally, the term COTS refers to commercial-off the self-products that could be used in an integrated product solution.

For example, RD uses FICO Blaze, a COTS product, in integrated product solutions to provide an automated underwriting function/capability.

Below are the Government’s definition of the term COTS Solution and COTS Integrated Solution.

COTS SOLUTION DEFINTION: A COTS solution is a cloud-based Loan Origination System (LOS) product offered by a single software manufacturer. The manufacturer’s product meets all requirements as stated in the 12SAD122R0003 SURPASS solicitation and does not require any additional software products to meet the requirements.

COTS INTEGRATED SOLUTION DEFINTION: A COTS Integrated Solution is a solution that provides a cloud-based solution that uses products from several different software manufacturers that are tightly integrated working seamlessly together to meet all requirements as stated in the 12SAD122R0003 SURPASS solicitation.

Question 77 Response Clarification:

Question: The FedRAMP Marketplace currently contains several Cloud-based Digital Platforms that include application plugin ecosystems. Would it be acceptable to the government for the offeror's solution to be based on a FedRAMP Moderate PaaS offering with a re-usable application plugin?

Government’s Response: Government is seeking a cloud-based solution that utilizes COTS and/or COTS integrated solution that meets all security cloud requirements including obtaining FedRAMP Authorization status for non-FedRAMP’d solutions as applicable.

Question: According to our 3PAO consultant only multi-tenant (multi-client) applications are qualified for FedRamp Authorization. Single tenant COTS or separate instances of a previous multi-tenant application must be FISMA/NIST 800.53 authorized by the client agency. Will USDA accept an LOS that includes other Client Loan Programs running with the same software and database?

Government’s Response: Any cloud-based solution must have FedRAMP Authorization since by definition a cloud is multi-tenant. If a software product is FedRAMP authorized and it received an ATO, the product and its components will be listed on FedRAMP’s Market Place site.

While FedRAMP and FISMA share significant similarities, there are also some specific distinctions between them. The primary difference between FedRAMP and FISMA is in their applicability. Systems evaluated under FedRAMP are commercial cloud-based (IaaS, PaaS, SaaS) systems and can support the general business processes of government agencies and commercial companies alike. Systems that fall under FISMA are traditionally on-premise (e.g. in a government data center) systems that were designed to address the business processes of a specific federal agency. These systems generally aren’t leveraged by multiple federal agencies either. Within SP 800-145, NIST defines cloud computing as “a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.” Within SP 800-145, NIST also defines the essential characteristics of cloud computing and the various service and deployment models. So, bottom line, if the system is cloud-based, it will be evaluated under FedRAMP.

The USDA will not accept an LOS that includes other Client Loan Programs running with the same software and database unless it is FedRAMP authorized with appropriate access controls to prevent any other organization or person from accessing USDA’s data.

Question: Also Is COTS integrated solution the same as an “Integrated Product Solution”, if so can you explain the difference between COTS and COTS integrated and provide an example?

Government’s Response: Below are the Government’s definition of the term COTS Solution and COTS Integrated Solution.

COTS SOLUTION DEFINTION: A COTS solution is a cloud-based Loan Origination System (LOS) product offered by a single software manufacturer. The manufacturer’s product meets all requirements as stated in the 12SAD122R0003 SURPASS solicitation and does not require any additional software products to meet the requirements.

Example: There are numerous LOS COTS products, and this example only provides names of 4. This is not an endorsement by the Government, statement of preference by the Government, or confirmation that any of these products meet the Government’s requirements. ICE Mortgage Technology offers Encompass, Black Knight offers Empower, Fiserv offers Mortgage Director, and MortgageFlex offers MortgageFlexOne.

COTS INTEGRATED SOLUTION DEFINTION: A COTS Integrated Solution is a solution that provides a cloud-based solution that uses products from several different software manufacturers that are tightly integrated working seamlessly together to meet all requirements as stated in the 12SAD122R0003 SURPASS solicitation.

Example: There are numerous LOS COTS Integrated Solutions. This example only provides XX possible solutions. This is not an endorsement by the Government, statement of preference by the Government, or confirmation that any of these products meet the Government’s requirements. Rocket Mortgage’s Mortgage as a

Service platform, Blend’s Mortgage suite offering coupled with one of the COTS LOS solutions mention above or other COTS LOS, other product set that use a COTS Point-of-Sale (POS) integrated with a COTS LOS or COTS components that provide the exact same functionality as a COTS LOS.