1331L519R13OS0005_Responses_to_Inquiries.pdf

BAS RFP 1331L519R13OS0005 Responses to Inquiries

No. Document Section Page Question Response

1 J.10_Attachment_10 3.5 26

What is the total database size (actual data size and/or the number of tables, columns, and rows) per source system that is expected to be ingested into the

EDW?

What is the expected daily transaction rate for each source system?

To the extent the request for further information relates to transaction counts, journal entries, accounting lines, database size, network throughput, connectivity, open obligation and contracts, user roles, or user accounts, Commerce has provided the most current and best information available for developing a proposal. Any further deliniation carries significant risk to misinterpretation as it would be based on non-standard, multi-instance configurations of legacy systems.

2 J.10_Attachment_10 3.10.5 46 Please provide a list of DOC and Bureau training assets (e.g., Learning Management System, training rooms, video recording/editing equipment, software licenses for tools such as Adobe Captivate) that offerors are able to leverage for BAS.

DOC has a learning management system that is used by all bureaus. There may be separate bureau specific applications in use; we do not have that data to provide. There are not licenses available for tools like Adobe Captivate at the BAS PMO nor is there access to video and audio recording equipment.

However, DOC has access to WebEx and Go To Meeting as well as training rooms in Germantown, Gaithersburg, Silver Spring, and Suitland (Department and Bureau Locations). There may be other training rooms outside of the DMV area; but we do not have that data to provide.

1331L519R13OS0005_BAS_Fi nal_RFP L.5.1 53 Please confirm Cover Letters are not included in the volume page limitations.

A proposal cover letter is excluded from the page limitation count for the Technical, Experience & IT Security volume and the Past Performance volume of the offeror's proposal.

4 J.10_Attachment_10 Introduction 6

OMB and Treasury QSMO contract writing standards have not been published via https://ussm.gsa.gov/fibf-procurement/, and the QSMO for Procurement has not yet been named.

Please clarify the reference. If the Government intends for offerors to comply with future compliance items, please confirm offerors should include this in their Firm Fixed Price bid.

The government intends for the systems to comply with established federal standards and processes and the systems/vendors should be flexible and be able to accommodate updates to federal regulations and new federal regulations as they are created/determined.

5 J.10_Attachment_10 2.2, Notional

Implementation Timeline

Section 2.2 of the PWS states: "Additionally, the BAS Hosting and O&M services described in Task 3.12 shall be provided beginning after the Go-live date for each Implementation Phase." This does not reconcile with the CLIN structure provided in Attachment 12 and Section 3.12.1 of the PWS, which states that hosting services should be provided to support development, configuration, integration, data conversion/migration, testing, training, staging, system cut-over, and post-production.

Please confirm the statement in Section 2.2 applies to O&M services, and that hosting services begin on Day 1, per Section 3.12.1 and Attachment 12.

O&M services (and the corresponding price for O&M) are applicable to the go live, steady state post deployment phases for the BAS requirement (viz., CLINs 0205, 0304, 0306, 0404, 0405, and 0501 - 1901. Conversely, during implementation activities will be required to set up and configure the hosted environment, including setting up security, testing connections, setting up environments, etc.

Hosting services are thus applicable to the implementation phases of the reqirement (viz., CLINs 0004, 0104, 0206, 0307, and 0406.)

6 J.10_Attachment_10 Interfaces and Conversion 34

Are there any systems the BAS solution must interface with until such time all Bureau implementations are complete? For example, does any DOC system need to be populated by BAS so that Departmental wide data can reside until such time that system may be replaced by BAS.

The contractor should provide a solution that is flexible and able to be adjusted when a new federal requirement is released. DOC expects this to be part of operations support provided by the vendor.

7 J.10_Attachment_10 Introduction 6 OMB and Treasury QSMO financial management data standards are not yet defined.

If they are subsequently defined after a phase implementation is complete, what is expected of the contractor?

The contractor should provide a solution that is flexible and able to be adjusted when a new federal requirement is released. DOC expects this to be part of operations support provided by the vendor.

8 J.10_Attachment_10 3.15 58 Given the requirement to comply with the Treasury QSMO standards, who approves related enhancements and what is the governance process for approval?

DOC does not believe this question is relevant to the proposal process. There will be a CCB that is stood up at DOC as part of the IT concept of operations that will approve enhancements for the entire suite. But that is a future process and not relevant to the proposal process.

9 J.6_Attachment_06 Transaction Counts 1

Transaction counts may not be fully representative of size and scale due to the number of accounting lines and attachments with large contracts or orders.

Please provide the number of journal entries or accounting lines.

DOC cannot currently estimate how many accounting lines or journal entries will be required for a given transaction in the future. DOC will have simple transactions with only one or two associated lines of accounting and more complex transactions with potentially hundreds of associated lines of accounting. Commerce is not looking to replicate its current line of accounting architecture under BAS therefore the total number of current lines of accounting or journal entries is not a good basis of estimate for BAS.

10 J.10_Attachment_10 4 61 Please confirm the phrase “all data related to the BAS Solution Set” means all data that DOC provides to the Contractor in connection with the DOC BAS contract and data that DOC uploads to the BAS Solution Set.

Confirmed.

11 J.10_Attachment_10 4 61

Under “Ownership of designs, improvements, and documentation," the statement “...that originate in connection with Contractor’s work for DOC shall be the exclusive property of DOC” conflicts with FAR 52.227-14.

Please revise to state: "All designs (including, but not limited to entity relationship diagrams), improvements (including, but not limited to software configurations / extensions), and documentation (including, but not limited to developer notes) that are first produced under this Contract shall be governed by FAR 52.227-14."

Pursuant to 52.227-14, the Government shall have unlimited rights in data first produced in the performance of this contract; data delivered under this contract (except for restricted computer software) that constitute manuals or instructional and training material for installation, operation, or routine maintenance and repair of items, components, or processes delivered or furnished for use under this contract; and all other data delivered under this contract unless provided otherwise for limited rights data or restricted computer software in accordance with paragraph (g).

1331L519R13OS0005_BAS_Fi nal_RFP F.5 14 - 15

Section F.5 contains several sentences that conflict with each other. The reference to FAR 52.227-14 is correct, but 4 other sentences negate that reference, as well as references to the CAR and FAR data rights clauses in Sections H.2 and I.1.

Section F.5 should be revised to state: "The Government has unlimited rights to all documents/material first produced under this contract pursuant to FAR 52.227-14, Rights in Data-General. As required under Sections H.2 and I.1, the Contractor agrees to assign copyright to the Government to data containing Personally Identifiable Information (PII)."

Section F.5 will be updated to reference applicability of 52.227-17, Rights in Data-Special Works to data and/or deliverables containing PII.

13 J.10_Attachment_10 3.12.1 N/A

What is DOC's current network throughput to the existing applications?

What kind of user connectivity is required?

Does DOC require tunnels to the cloud, and how many locations to be tunneled between?

This network varies by bureau and is locally owned and operated at each bureau. There is not a central DOC network. Additionally, there are a variety of access management procedures and processes and the user connectivity varies by bureau.

DOC requires connectivity to the new environment. It is up to the vendor community to propose the best solution for ensuring that DOC users can connect to the new SaaS BAS Solution Set.

To the extent requests for further information relate to network throughput or connectivity, Commerce has provided the most current and best information available for developing a proposal.

Any further delineation carries significant risk to misinterpretation as it would be based on non-standard, multi-instance configurations of legacy systems.

14 J.10_Attachment_10 3.12.1 N/A With respect to accessing the cloud from a network perspective, does DOC plan to use VPN, cloud services [e.g., Direct Connect (AWS) or ExpressRoute (Azure)], or another method?

This has not been determined yet; it is intended that the vendor community propose the best networking solution to allow DOC to connect to the new environments.

15 J.10_Attachment_10 3.12.1 N/A Will DOC use a Trusted Internet Connection (TIC) or MPLS which traverses a Government Managed Firewall to provide the direct connection to the cloud?

This has not been determined yet; it is intended that the vendor community propose the best networking solution to allow DOC to connect to the new environments.

16 J.10_Attachment_10 3.12.1 N/A How does DOC plan to federate identity management/application access to the cloud (e.g., Government Active Directory)?

This has not been determined yet; it is intended that the vendor community propose an access management policy and then collectively, the vendor and DOC will work to achieve this post contract award as part of implementation.

17 J.10_Attachment_10 3.12.1 N/A How will DOC pass security tokens?

This has not been determined yet; it will be determined post contract award when DOC is working through connectivity and security to the new environments.

18 J.6_Attachment_06 N/A N/A Please provide an estimate of open obligations and contracts by fund type projected for the end of the fiscal year.

To the extent requests for further information relates to open obligation and contracts Commerce has provided the most current and best information available for developing a proposal. Any further delineation carries significant risk to misinterpretation as it would be based on non-standard, multi-instance configurations of legacy systems.

19 N/A N/A N/A

Does DOC have enterprise-wide Oracle licenses that can be leveraged as part of this procurement? Does DOC have an ELA/ULA with Oracle?

What technology items are on the ELA/ULA?

When does the ELA/ULA expire?

There are no existing licenses to be leveraged for the BAS solution set/deployment. There are current licenses for our current environments but licenses for the BAS solution set are part of what DOC is seeking in the procurement. There is not an ELA/ULA with Oracle.

20 J.10_Attachment_10 3.1.1 Deliverables 20

Deliverables 11/12 (Draft/Final Scope Definition and Management Plan) appear to be potentially duplicative with Deliverables 34/35 (Draft/Final Scope Management Plan). Please clarify; are Deliverables 11/12 meant to be the Draft/Final Scope Definition, while Deliverables 34/35 are meant to be the Draft/Final Scope Management Plan?

That is correct. Deliverables 11 and 12 will finalize all scope requirements at the front of the project (deeper dive into Scope post contract award) and 34/35 will be the final scope management plans that will govern the project through its lifetime.

21 J.5_Attachment_05 BAS User Count Estimates N/A DOC identifies 3,273 Workflow users. To support an accurate understanding of the needs of these users, please provide the categories of roles supported by the Workflow Users.

Workflow users include a variety of different functions including system administrators, invoice reviewers, contracting officers, administrative assistants, etc. each of whom have a role dictated by our current environment. DOC intends to leverage the e-invoice routing functionality inherent in the vendor's solution, which will define the needed workflow roles under BAS.

22 J.4A_Attachment_04A Interfaces N/A DOC identifies a Bankcard solution that interfaces with Citibank. How do users reconcile their credit card changes today? Directly in Citibank, or do they have another system?

Currently, they use the Citibank reconciliation tool that was deployed during the SmartPay3 deployment at DOC.

23 N/A N/A N/A In today's environment at DOC, are there users that have access to both CBS and C.Suite?

Yes

24 N/A N/A N/A In an integrated solution, are there users that will have responsibilities in both the Acquisitions and Finance module? This information is required to make reasonable estimates on the user count for BAS.

Yes, there could be users in the future who have access to both.

25 J.5_Attachment_05 Notes N/A

User counts are based on FY14/FY15 data.

Are current and expected user counts anticipated to remain consistent with these numbers?

These numbers were validated in 2018 and 2019 by DOC bureaus. They are up to date.

26 J.5_Attachment_05 Notes N/A Please clarify if the 10% increase in users is only in Decennial Years (i.e., 2020, 2030, and 2040), or if there will be an increase in users in the months leading up to and following those years. If the latter, please provide specific timeframes.

There is an increase of users associated with Decennial when the Decennial time frame arises. The ramp up typically happens 6-9 months prior to the Decennial year, lasts throughout the Decennial year, and then ramps back down within 6-9 months of the conclusion of the Census.

27 J.5_Attachment_05 Property N/A Are the Decennial and Non-Decennial users combined in the Decennial Years? For property, yes.

28 J.5_Attachment_05 Property N/A

With respect to NIST, in Total Number of Projected Users, the user counts shown for Personal Property and Fleet as well as Real Property in the Non-Decennial years appear to be inverted, based on the counts provided for the Decennial years.

Please confirm or update as appropriate.

The user counts were validated by DOC bureaus in the 2018/2019 time frame. They represent the most up to date information DOC has at this time.

29 J.5_Attachment_05 General N/A Please define whether any of the distinct users of Core Financials are also included in the user counts for Acquisitions, Property, and BI.

The user counts were validated by DOC bureaus in the 2018/2019 time frame. They represent the most up to date information DOC has at this time.

1331L519R13OS0005_BAS_Fi nal_RFP I - Clauses Incorporated by

Reference 35 Please incorporate FAR 52.233-1 Disputes into the RFP.

FAR 52.212-4 as contained in section I.1 of the solicitation already incorporates FAR 52.233-1 by reference.

1331L519R13OS0005_BAS_Fi nal_RFP L.5.2, Tab 1, e., iii. 57

Please confirm the SOC Report should be provided as an Appendix, excluded from the overall page limit, as these reports are often more than 100 pages in length.

In addition, please confirm the reference to SSAE should be SSAE 18.

The SOC Report can be provided as an appendix and will not count towards the page limit. Yes the reference should be to the SSAE 18 and the solicitation will be amended accordingly.

32 J.10_Attachment_10 3.10.1 44

The PWS states: "The Contractor shall develop an Organizational Change Management Plan to plan and successfully manage change (departmentally and at the bureau level) and then shall execute (in conjunction with the Government PMO) what is in the approved plan."

Given the integrated nature of the Government PMO and the awarded contractor's PMO in supporting organizational change management and business process engineering, please confirm any offerors currently supporting DOC's Enterprise Services PMO would be precluded from an award in connection with this solicitation, either as a prime contractor or subcontractor.

OCI determinations are not being made within the forum of RFP inquiry, however, the Contracting Officer will consider the relevant facts and circumstances related to any potential Organizational Conflict of Interest (OCI) in accordance with CAR 1352.209-70, 1352.209-71, 1352.209-74 and FAR Subpart 9.5.

With regard to the Enterprise Services (ES) PMO, please note that the progam owner for BAS is the Chief Financial Officer (CFO) and the CBS Program Office who are organizationally under the CFO. ES is a separate operating unit aligned under the Deputy Secretary. Contracted support for the ES PMO has not participated in the requirements development, acquisition strategy, program schedule, change management, selection criteria or any other aspect of the BAS acquisition in any manner. The ES-Acquisition office is the supporting acquisition activity for the Office of the Secretary and all assigned tennant units. Consequently, the only connection ES has with the BAS requirement at this time is the acquisition/procurement function.

1331L519R13OS0005_BAS_Fi nal_RFP L.5.1 53

The RFP states: "Pages shall be numbered sequentially from “1” through the total number of pages in the volume." In addition, the RFP states: "The offeror shall number each page in order to eliminate any confusion."

For Volume I - Technical, Experience & IT Security, Key Personnel Resumes and Letters of Commitment are not included in the 75-page limit; however, this Element is to be provided as #4 of 6. In this case, sequential page numbering would "exceed" the 75-page limit. Please remove the first sentence from the RFP. This will allow offerors to number each page in line with the order of the required Elements, and enable offerors to eliminate potential confusion and ambiguity.

The resumes submitted in response to Element #4, Key Personnel, may be included as an appendix to the offeror's proposal and excluded from the 75 page limit count. The offeror's response to Element #s 1, 2, 3, 5 and 6, however, shall be numbered sequentially in the offeror's Technical, Experience & IT Security volume.

1331L519R13OS0005_BAS_Fi nal_RFP L.5.2, Tab 1, a., iv. 54

Please provide a list of enterprise/perpetual licenses available for use in support of BAS. This will allow all offerors to provide a best-value solution to DOC and support pricing parity.

There are no perpetual licenses available for BAS. There are current licenses on the current system;

DOC is looking to procure new licenses for the BAS solution set.

1331L519R13OS0005_BAS_Fi nal_RFP L.5.2, Tab 1, a., iii. 55

Please allow the CMMI SCAMPI Appraisal certification to be provided as an Appendix, excluded from the 75-page limit.

The documentation for the CMMI appraisal can be provided as an appendix and will not count towards the overall page limit.

1331L519R13OS0005_BAS_Fi nal_RFP L.5.2, Tab 2, a 58

Please exclude Tab 2: Experience from the 75-page limit. Offerors' teams will vary in size. Excluding this Tab from the overall page limit will allow offerors to provide an equivalent level of detail in response to the other technical elements, regardless of team size.

This will be included in the 75 page count. Changes have been made to the proposal instructions based on vendor requests to have portions of the proposal be submitted as appendices. Because of those items being moved to appendices, this opens up more pages for this section. This will remain in the 75 page limit.

1331L519R13OS0005_BAS_Fi nal_RFP L.5.2, Tab 3, c 58

The RFP states: "Validation of the FISMA ratings for the proposed solution set obtained from previous federal agency implementations." Please confirm this response should be narrative form.

This response can be provided in narrative form. It should address the systems implementations and the associated FISMA ratings on each system.

1331L519R13OS0005_BAS_Fi nal_RFP L.5.2, Tab 1, ii. 54

Given page limitations, please confirm the implementation schedule included within Tab 1 should reflect critical milestones.

In addition, will the Government allow offerors to provide a detailed implementation schedule as an Appendix, excluded from the 75-page limit?

Yes, the implementation schedule should include critical milestones consistent with the implementation approach proposed. A detailed schedule may be provided as an appendix that will be excluded from the page limit.

1331L519R13OS0005_BAS_Fi nal_RFP L.6 62 We request the Government allow a hand delivery.

Packages must undergo a scanning process before delivery and as a result hand delivery will not be accepted.

1331L519R13OS0005_BAS_Fi nal_RFP L.7 63

We request the Government provide a two-week extension to accommodate preparing a proposal submission in response to the breadth and depth of requirements outlined in the RFP.

The due date and time will be extended.

1331L519R13OS0005_BAS_Fi nal_RFP M.2.2 N/A

Given DOC's low appetite for risk and the extended period of performance, please clarify why a product demonstration is not included in the evaluation process.

We recommend DOC require a demonstration as part evaluation, as this effort represents a significant transformation and implementation effort for the Department and in-scope Bureaus. A product demonstration would provide increased confidence that requirements can be met through configuration versus customization. We recommend DOC provide specific scenarios so they can evaluate bidders fairly.

Based on market research DOC anticipates that commercially available applications are able to meet BAS solution requirements and that evaluation of an offeror's proposal to meet Technical, Experience, IT Security and Past Performance requirements as contained in the evaluation criteria sufficiently mitigates procurement risk.

1331L519R13OS0005_BAS_Fi nal_RFP L.5.2, Tab 1, e., iv. 57

Given the page limitations, please confirm the self-assessment against the NIST SP 800-53 Rev 4 Moderate baseline controls should be provided in narrative form at a summary level, as a detailed self-assessment would require as many pages as the total Volume I page limitation, if not more.

If this is not the Government's intent, please confirm the self-assessment should be provided as an Appendix, excluded from the page limit.

A summary should be provided as part of the page limit but a detailed assessment may be provided as an appendix and will be excluded from the page limit.

43 J.10_Attachment_10 1.2.2, 1.2.3, 2.2 8, 9, 11

In Sections 1.2.2 and 1.2.3 of the final PWS, the Government removed sentences from the draft PWS that stated "DOC does not intend to customize the COTS administrative system solutions". In addition, new language was added in Section

2.2 of the PWS to include "architecture (solution) design".

Please clarify the intent behind these updates.

In addition, given the updates noted above, please explain the preference for the FedRAMP SaaS ATO at proposal submission, as customization and architectural updates would potentially require a new ATO to validate security compliance is maintained. If DOC is intending to allow customization and architectural updates to meet requirements, we request DOC remove the preference.

Commerce is not intending to allow customization and architectural updates to meet requirements, except where necessary. Commerce is expecting a COTS solution that meets the requirement to achieve a FedRAMP authorization at the SaaS moderate level no later than 9 months after award.

1331L519R13OS0005_BAS_Fi nal_RFP H.23 34

It is requested that the Government either remove or revise non-standard clause H.23, Harmless From Liability, which requires the contractor to indemnify the Government for unlimited liability for all damages and injuries to persons or property. As written, the clause imposes unreasonable, uncapped liability on the Contractor in a manner that is inconsistent with the applicable FAR and CAR clauses.

The FAR and CAR clauses provide the Government with appropriate and adequate remedies within FAR policy. If the Government opts to amend the clause, then it is respectfully requested that the revised H.23 reasonably limit contractor liability to:

(1) Government claims only (explicitly excluding any third-party claims); (2) Direct damages only (explicitly excluding indirect, consequential, incidental, punitive, and other damages and losses of any other kind); and (3) For property damage, a maximum monetary cap over the life of the contract, as illustrated in the following language: “The Contractor shall indemnify the Government, its officers, agents, and employees against direct damages resulting from injuries sustained by any person or persons or damage to tangible property by virtue of performance of this contract, to the extent caused by the fault, negligence, wrongful act or wrongful omission of the Contractor, or any subcontractor, their employees, and agents. Except as required by law or regulation, the contractor shall not be liable under this clause to:

(a) third parties for any damages or losses of any kind or (b) the Government for any indirect, consequential, incidental, punitive, or other damages or losses of any kind.

For damage to tangible property, the contractor’s liability under this clause shall be limited to the amount actually paid under the contract in the trailing 12-month period when the damage occurred.”

The clause at H.23 does not impose new liability on the contractor that is in addition to liabilities consequent to clauses and terms and conditions contained elsewhere in the solicitation. Rather, the clause at H.23 stipulates that the contractor shall hold the Government harmless from liability for suits or damages caused by the fault, negligence, wrongful act or wrongful omission of the Contractor, or any subcontractor, their employees, and agents. Additionally, FAR 52.212-4 as incorporated in the contract already includes a limitation of liability provision concerning consequential damages in paragraph (p).

1331L519R13OS0005_BAS_Fi nal_RFP L.5.2, Tab 1, b., iv. 55

Please provide a list of recent departmental investments in technology and infrastructure that would be relevant to the BAS Solution Set.

The government is going to remove the requirement from Section L and Section M for the vendor to propose ways to leverage recent investments. This will still be a contract requirement and will be part of the discussion with the awardee during the fit gap time frame; but it will be removed as a specific part of the proposal evaluation.

46 J.1_Attachment_01 Lines 1323, 1324 46

Please provide additional specificity around the meaning of “financial related functions.”

In addition, please provide examples of what would be considered financial related, as well as examples of what would not be financial related.

The government is going to remove the requirement from Section L and Section M for the vendor to propose ways to leverage recent investments. This will still be a requirement and will be part of the discussion with the awardee during the fit gap time frame; but it will be removed as a requirement of the proposals.

1331L519R13OS0005_BAS_Fi nal_RFP; J.7_Attachment_07

M.2.2.1, Factor 1; SLA-01- 03-02

66; 2

The RFP evaluation criteria and Attachment 7 SLAs are not consistent when identifying the minimum environments to be provided. The RFP states: "The extent to which the offeror is providing the required minimum set of environments (production, test, and train) for each solution in the BAS Solution Set." Attachment 7 states: "The contractor shall provide at minimum environments for a Sandbox, Development, Integration, Testing (Staging and Acceptance), Training, Production, Post-Production and Disaster Recovery."

To ensure pricing parity, please confirm the minimum number of environments are as represented in Attachment 7.

The minimum number of environments required (for each application and the EDW) is Production, Test, and Train. Attachment 7 will be updated acccordingly. If the offeror has needs beyond these 3 environments, they should factor them into their proposal.

1331L519R13OS0005_BAS_Fi nal_RFP H.1 20

Clauses 1352.239.72 and 1352.237.70 reference the following documents, which are not available on the OCIO website. Please provide a reading room for offerors to review the documents.

1) DOC Information Technology Management Handbook

2) DOC IT Security Program Policy

3) The DOC Security Manual, Chapter 18

The DOC Information Technology Management Handbook is a legacy document that may be extensively updated in the future and is not currently available. The handbook is a supplement to the DOC IT Security Program Policy document and provides general guidance for compliance with DOC IT terms and conditions as contained elsewhere in the solicitation. The DOC IT Security Program Policy will be included as an attachment to the solicitation for reference. The DOC Security Manual, Chapter 18, is only cited in the clause for purposes of defining the term "National Security." The BAS acquisition does not encompass any requirements that are categorized at a National Security classification level and therefore the definition of National Security is not relevant to this acquisition.

49 J.12_Attachment_12 Hosting Worksheets - Base

& OPs1-4; OPs5-19 N/A

Given the Government's desire for a SaaS offering, please confirm offerors are not required to itemize each individual Cost Category separately.

A full itemization of the separate cost elements that make up an offeror's subscription fee for SaaS is not required. A summary level categorization of costs into the 5 cost categories listed below, however, is required for the Hosting CLINs for the implementation phase (viz., CLINs 0004, 0104, 0206, 0307, and 0406) as depicted in the "Hosting Worksheet Base & OPs1-4" tab of the Price Schedule.

- Licenses (Implementation Phase)

- Hardware/Infrastructure Design/Test/Deploy

- Networking Design/Test/Deploy

- Access Management Design/Test/Deploy

- Environment Test/Deploy (Test, Train Production)

Additionally, for the Operations & Maintenance (O&M) phase CLINs (viz., CLINs 0501 - 1901) a summary level categorization for Hosting and Infrastructure, Software Licenses and related cost categories is required as depicted in the "Hosting Worksheet OPs5-19" tab of the Price Schedule.

The summary level categorization of costs for Hosting CLINs during the implementation phase and for O&M CLINs during the production/steady state phase is required in order to provide DOC with visibility into the general composition of costs as they relate to the offeror's solution set.

50 J.12_Attachment_12 Hosting Worksheets - Base

& OPs1-4; OPs5-19 N/A

Please define/clarify the context of "Access Management Design/Test/Deploy" within the Hosting Worksheets.

DOC will require the ability to access/log into the SaaS environment and control the user authentication. There will be a need to authenticate against something (i.e. active directory, etc.).

This will have to be set up new for the new BAS environment. It will need to be a coordinated effort with the Contractor and DOC Government staff to authenticate users onto the solutions in the new hosted environment. We expect to see this as an activity for deployment and it is included in the price worksheets.

51 J.10_Attachment_10 3.5 26 What data types (structured, semi-structured, or unstructured) are expected to be ingested into the EDW?

This will be finalized during the discovery time frame with the Contractor post contract award. At a minimum, it must include the data types contained in the applications listed in the Performance Work Statement (Attachment #10) for the Enterprise Data Warehouse.

52 J.10 3.12.1 50

The Government states "The BAS solution set must operate on a cloud platform or vendor platform with FedRAMP authorization at the SaaS level" and "FedRAMP authorization must be achieved within 9 months of contract award." Would the government allow the vendors to apply for and achieve FedRAMP authorization on a timeline which aligns with the deployment timeline and ultimate go-live versus an arbitrary timeline of 9 months? If not, will the government explain why the requirement is “within 9 months of contract award” for the full BAS solution set when it’s 21 months before solution go live?

The 9 month time frame is not arbitrary. It was chosen through a series of dedicated conversations within the Department to balance an appropriate time frame and to reduce risk. DOC cannot go live on a solution set that is not FedRAMP authorized at the Saas Level. Additionally, there will be significant work performed in environments (i.e. dev, test) prior to the deployment date.

Consequently, "prior to go live" is too broad a time frame and increases the risk for DOC. The requirement is to propose whatever level the offeror currently has and then by 9 months after award, the FedRAMP authorization at SaaS must be achieved.

53 J.10 3.12.1 50

Would the government update the PWS requirement to allow the following:

- FedRAMP IaaS or PaaS authorization prior to migrating any live DOC data to the cloud or vendor platform (for either data conversion, transformation, testing, etc.)

- FedRAMP IaaS or PaaS authorization prior to Go-Live at the SaaS level (or agency

ATO)

No. The requirement for DOC is FedRAMP at the SaaS.

54 J.10 3.12.1 50 Does the government intend to go through a traditional DOC ATO process or issue an agency ATO via FedRAMP? Can the government specify the requirements and timeline that must be achieved?

The final process is still to be determined. It will depend on the final hosting solution, the solutions/applications being proposed, and it will require an in depth conversation with our OCIO post contract award.

55 J.10 3.12.1 50

The Government states "The BAS solution set must operate on a cloud platform or vendor platform with FedRAMP authorization at the SaaS level" and "FedRAMP authorization must be achieved within 9 months of contract award." Will the Government update the PWS requirement to indicate the BAS solution must receive a DOC ATO that leverages FedRAMP authorized IaaS or PaaS? Since so many different components of the BAS solution will be tailored for DOC, this option will give the government the most flexibility, while still achieving the greatest level of security and compliance with FedRAMP, FISMA, NIST, etc.? A FedRAMP SaaS solution limits the flexibility for DOC over the lifetime of a 20 year contract and it is unlikely that any existing FedRAMP SaaS solution can fully integrate with DOC systems, etc. as-is, which would necessitate changes to the SaaS solution.

No, the requirement for DOC is FedRAMP at the SaaS.

56 RFP M.2.2.3 69

Based on publicly available information, only one vendor has a financial management solution that is FedRAMP authorized at the SaaS level (marketplace.fedramp.gov). This requirement demonstrates a preference for one vendor and creates a barrier to competition. The Government should remove the evaluation criterion of “Preference will be given to a solution set that is FEDRAMP authorized at the SaaS level at the time of proposal”.

The evaluation criteria has been revised concerning the current FedRAMP status of offerors.

However, the requirement for DOC remains that the awardee's Solution Set is FedRAMP certified as the SaaS level no later than 9 months after award.

57 RFP L.5.1 Tab 3: IT Security b. 58

The Government has requested documentation to indicate the "date of application submission" and "target date for obtaining FEDRAMP authorization at the SaaS level." Can the Government remove this requirement and allow vendors to provide an approach and plan to achieve FedRAMP authorization or DOC ATO? With the removal of this, the government should align sections L&M and the PWS (3.12.1) to be consistent and allow vendors to provide a recommended approach.

If one or more applications are not authorized at the SaaS level at the time of proposal submission, the extent to which the FedRAMP Readiness Assessment Report (RAR) demonstrates the capacity for the overall solution set to obtain FedRAMP SaaS authorization within 9 months after award will be evaluated.

58 RFP M.2.2.3 69

The Government states it will evaluate "the extent to which the offeror's in process application for FedRAMP Authorization demonstrates: the status of the application and dates it was submitted and last acted on; target date identified for achieving FEDRAMP authorization at the SaaS level".

Can the Government remove this from the evaluation and instead evaluate the vendor's approach and plan to achieve FedRAMP authorization or DOC ATO? With the removal of this, the government should align sections L&M and the PWS (3.12.1) to be consistent and allow vendors to provide a recommended approach.

If one or more applications are not authorized at the SaaS level at the time of proposal submission, the extent to which the FedRAMP Readiness Assessment Report (RAR) demonstrates the capacity for the overall solution set to obtain FedRAMP SaaS authorization within 9 months after award will be evaluated.

59 RFP

L.5.1 Tab 3: IT Security b.

and M.2.2.3 58, 69

When the government cites FedRAMP authorization at the SaaS level and requests “In Process” documentation that requires coordination with DOC to include 1) an agency attestation from DOC and/or relevant Authorizing Official via email that includes FedRAMP PMO requested information; and 2) a contract award or demonstrated use of the cloud service. If a “FedRAMP In-Process” designation is requested, we ask that the government remove this requirement due to the information necessary from DOC.

If one or more applications are not authorized at the SaaS level at the time of proposal submission, the extent to which the FedRAMP Readiness Assessment Report (RAR) demonstrates the capacity for the overall solution set to obtain FedRAMP SaaS authorization within 9 months after award will be evaluated.

60 J.10 3.5.1 25 Is there a need to incorporate data from unstructured data formats (documents, audio/video files, etc.)?

This will be finalized during the discovery time frame with the Contractor post contract award. At a minimum, it must include the data types contained in the applications listed in the Performance Work Statement (Attachment #10) for the Enterprise Data Warehouse.

61 RFP

Tab 3: IT Security: High

Level Security Management Plan

Tab 3: IT Security section d "High Level Security Management Plan for managing the security process and implementing federal IT security standards for the BAS solution set and hosting platform, consistent with the requirements in the section 3.12 of the BAS PWS."

Given the tight page constraint for Tab 1, will the Government consider including this as an Appendix which is not factored into the 75-page count? This will enable offerors to respond more completely and enable the Government to better evaluate strengths and weaknesses of the prime and its subcontractors.

Yes, this can be provided an appendix and not counting towards the 75 page limit.

62 N/A N/A N/A Will the Government allow offerors to use font size Times New Roman 10 pt for body text versus Calibri 12 pt?

The proposal instructions will be updated to allow for Times New Roman or Arial 11 pitch type or Calibri 12 pitch type font.

63 RFP H.20 33

H.20 Future Modernization – States that the Government reserves the right to sunset requirements. It further states that the Contractor must agree to negotiate downward adjustments. Does this preclude changes that legitimately cause the price to increase? Please confirm how changes will be handled during the performance of the contract to allow and provide mutual fairness to the Government and the Contractor.

The clause at H.20 addresses the possibility that applications encompassed within the BAS Solution Set may be sunsetted in whole or in part as a result of future modernization or business process improvement efforts. Such sunsetting would result in a potential decrease in the scope of the BAS contract and would require a commensurate decrease in pricing.

In the event Government requirements as contained in the PWS are changed a bilateral modification will be processed to effect the change in accordance with FAR 52.212-4(c) through mutual agreement of the parties, with a fair and reasonable increase in price if appropriate as determined by the Contracting Officer at the time of modification issuance.

64 RFP L.5.2 - Tab 1 - b.ii 55

The RFP states: “A narrative demonstrating that the offeror’s proposed BAS Solution Set meets or exceeds all requirements of the PWS, including Attachment 1 – Final BAS Cor Financial, Acquisitions, and Property Management System Requirements matrix, and a discussion of why the proposed solution, taken as a whole, is the most advantageous Solution and modernization option for the Department of Commerce.”

While analyzing the RFP and the PWS it is clear that some PWS requirements will be addressed in Elements other than Element #2 – Solution. Please confirm that it is acceptable for offerors to address specific PWS requirements in sections other than Element #2?

Yes. You may address PWS requirements in other elements in addition to Element #2.

65 J.10 3.5.2 27

PWS requires "Capability for Master Data Management across BAS Application" in the EDW. Is DOC looking to implement a Master Data Management solution like Oracle MDM or Informatica MDM? Or are they looking to manage their master data like the chart of accounts with the EDW so that all transactions can be cross-checked with this master data?

No. We need to ensure that there is the capability to manage data standardization and data elements in a centralized capacity. We do not want all offices or all bureaus to have autonomy in managing their own data sets. There has to be a general data governance and data management capability for the EDW.

66 J.11 N/A N/A Please confirm that the Labor Category Descriptions provided in RFP Attachment J.11 apply only to the T&M component of the price proposal.

The labor categories contained in Attachment J.11, Labor Category Descriptions, and the associated hourly rates from the awardee's proposal that will be incorporated into the contract will be applicable only to work that may occur on a T&M basis.

67 N/A N/A N/A

In order to allow offerors the time to fully consider questions and provide more thorough and higher quality proposals, will the Government grant a 2-week extension to include a minimum of 3-weeks to respond after questions are answered?

The due date and time will be extended.

68 RFP B.2 9

The requirement to propose firm fixed prices for a 20 year period of time is likely to present significant cost, schedule and performance risk beyond 3-5 years due to uncertainties and fluctuations in economic indicators and labor market among other things. Would the Government please consider an economic price adjustment clause FAR 52.216-4, Economic Price Adjustment – Labor and Material based on the likelihood that there will be significant changes in labor costs over the 20 year life of this contract? This will greatly help to mitigate the risks to both the Government and the contractor over the 20 year period of the contract.

Fluctuation in labor costs over the lifecyle of the requirement is not considered an adequate basis per se for cost increases under this contract. Given inherent uncertainties with an overall 20 year period of performance, however, a mechanism for negotiating a potential increase in Firm-Fixed-Price hosting and O&M costs will be incorporated into the contract based on published or otherwise commercially available catalogs/pricelists associated with the BAS Solution Set. Notwithstanding the potential for such increases, it is anticipated that Hosting and O&M costs will stabilize or potentially trend downward over the life of the contract as a result of efficiences and economies gained in performance.

69 RFP H.19 33

The Dynamic Pricing Terms clause states that the Government reserves the right to renegotiate pricing for Hosting and O&M services downwards dependent on actual consumption, functional applications in use and/or market based conditions supporting price savings.

We recommend that any changes to the scope of the contract be negotiated and resolved to mutual agreement. Please confirm that the government plans to manage changes consistent with the commercial items Changes Clause or other appropriate clauses contained in FAR 52.212-4, Contract Terms and Conditions - Commercial items?

Renegotiated pricing pursuant to clause H.19, Dynamic Pricing Terms is subject to bilateral agreement of the parties in accordance with FAR 52.212-4(c).

70 RFP

Tab 1: Technical, Element

#5

"A sample service level agreement (SLA - consistent with the requirements provided in Attachment 07) governing the hosting and SaaS provision of services for the Department of Commerce; SLA could include suggested improvement/updates based on past SaaS experience or efficiencies to be provided via the offeror’s proposed solution."

Attachment 7 is 11 pages. Given the tight page constraint for Tab 1, will the Government consider including this as an Appendix which is not factored into the 75-page count? This will enable offerors to respond more completely and enable the Government to better evaluate strengths and weaknesses.

This can be provided as an appendix and will not count towards the page limit.

71 RFP L.5.1 52

The RFP states: "Cross-references should be utilized to preclude unnecessary duplication of data between sections."

To aid in the evaluation of a cross referenced response, can the Government please confirm that offerors may provide a compliance matrix? If yes, please confirm that the compliance matrix will be excluded from any page limitations.

Offerors may provide a compliance matrix, however this will not be required. If provided, this can be an appendix and will not count towards the 75 page limit.

72 RFP L 5.2 Tab1 b.iii 55

Can the "Appraisal Disclosure Statement (DS) from a Standard Capability Maturity Model Integration – Development (CMMI) Appraisal Method for Process Improvement (SCAMPI) Class A Appraisal showing our current CMMI rating" be excluded from page count and be referenced in an appendix?

This can be provided as an appendix and will not count towards the page limit.

73 RFP

Tab 1: Technical, Element

#1

"Include an implementation methodology for a single instance, single configuration solution of the BAS Solution Set (as defined in Section B of the RFP and Section 2.5 of the BAS Performance Work Statement)."

Will the Government confirm its intent for a “single instance, single configuration solution?” The BAS Solution Set, as defined, includes the Enterprise Data Warehouse, Data Management, and Interfaces (for example) which do not fit within the “single instance” concept.

Each system that is deployed must be in a single instance, single configuration of that system. For example, the end state financial management solution must be single configuration, single instance so when you log in at NOAA and log in at NIST, you're logging into an application that is the same.

Data should be partitioned and there should be separate books; but the configuration and functionality must be the same across the department. The same principle applies to the asset management system, the acquisitions management system, and the EDW.

74 RFP

Tab 1: Technical, Element

#1

"Identify opportunities to leverage existing interfaces and recent investments in new technologies at DOC, where appropriate."

The Government references ETS2 and SmartPay 3 as existing interface investments.

Are there additional “technologies” which should be factored in? This knowledge presents a more competitive and fair landscape among offerors to the advantage of

DOC.

The government is going to remove the requirement from Section L and Section M for the vendor to propose ways to leverage recent investments. This will still be a contract requirement and will be part of the discussion with the awardee during the fit gap time frame; but it will be removed as a specific part of the proposal evaluation.

75 RFP

Tab 1: Technical, Element

#2

"Evidence of the offeror’s ability to leverage recent departmental investments (past 5 years) in technology and infrastructure where appropriate."

The Government has documented a preference for a SaaS model for the BAS Solution Set. Will the Government clarify, therefore, its intent and evaluation criteria for offerors to leverage recent departmental investments in infrastructure?

There is no requirement to leverage recent investments in infrastructure. DOC's current environments are locally hosted and locally owned and a future state SaaS structure (in a cloud or vendor hosted environment) is a complete change.

76 J.10 52

The PWS requests that offerors provide an Archiving Strategy that includes “potential toolsets, approaches, methodologies, and techniques for archiving data in accordance with all applicable Federal and DOC data storage, retention, and security policies/guidelines.” The PWS also notes: “Once the Archiving Strategy has been reviewed and approved by DOC, the Contractor shall develop high-level and detailed designs and execute the full life cycle development[…]”

Given the toolset approval requirement by the Government, should the archiving solution be priced as an optional line item?

No. The archiving strategy is part of overall data management for the EDW. We know that converting existing data to the EDW may be difficult so we want to make sure that if cannot have all existing data converted to the new data schema, that there is an archiving strategy along with that to ensure long term access to historical data.

77 J.10 Section 3.5.1 10

"They will be…