Questions and Anwsers - MEP Surevy-2-25-2022.pdf

Page 1 of 4 February 25, 2022

RFQ 1333ND22QNB480069 – MEP CLIENT SURVEY SUPPORT SERVICES

Questions and Answers:

Questions Answers 1 It appears the incumbent contractor already provides a portal. Is that portal Government property that a new contractor would have access to for updates and changes?

The current survey portal is not government property.

2 Does the current solution meet all your needs or do you anticipate a new contractor would have to modify/update the portal (assuming it is not proprietary to the incumbent).

The current survey portal is not government property.

Yes, it does meet needs. We ask for occasional tweaks – for instance adding frequently asked questions to the FAQ page.

3 Who is the incumbent and what is the current contract number?

Yes, there is an incumbent.

Fors Marsh Group, SB1341-17-SE-0191

4 What are the page limits for the technical proposal?

The RFQ is being amended to add page limit to the proposal. The technical proposal cannot exceed 30 single side pages of 12-point font.

5 Which accessibility standard (e.g., WCAG 2.0 Level AA or WCAG 2.1 Level AA) is the portal required to be?

Contractor needs to be compliant with all 508 requirements.

6 Does the incumbent contractor use a proprietary or COTS software application to administer the web surveys and integrate to MEIS? If yes, what is the name of the proprietary or COTS software application?

No, the portal is a customized system. Transfer of survey data to MEIS system is manual. The government will provide the secure system for the manual transfer (secure file mechanism)

7 Does the incumbent’s web-based data portals currently meet DOC/NIST policy requirements (i.e., accessibility, security, etc.)? If not, please provide the Plan of Actions and Milestones (POA&M) tasks?

The current contractor’s web-based data portal is immaterial to this solicitation. Vendor needs to meet NIST IT Security/Privacy requirements. The government will require as part of the technical proposal, answers to security questions about securing PII and BII. The government will require after award, the contractor’s security documentation to verify NIST IT security and privacy requirements are acceptable.

8 Is the contractor system expected to obtain an authorization-to-operate?

No. The contractor is requirement to provide certification that the system meets the required level of security and privacy. NIST MEP has categorized the data you will receive, store, and process at security level Low for Confidentiality, Integrity, and Availability (C/I/A = L/L/L). This data is considered Personally Identifiable Information (PII) and Business Identifiable Information (BII). NIST uses NIST SP-800-53 Rev 5 to assess the security and privacy of systems. NIST does not conduct https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf

Page 2 of 4 February 25, 2022 assessments of contracted services. However, NIST is still required to perform due diligence to ensure that the data that is transmitted, stored, and processed by an external vendor is secure.

1) Within 30 days contractor will provide the government with information about the status of any 3rd party security assessment such as FedRAMP, or the American Institute of CPAs (AICPA) System and Organization Control 2 or 3 (SOC 2 or 3) or a similar assessment result. If available please also provide a security plan that references your policies and procedures, describes how your organization handles customer data, data collection and storage methods used, your business model and workflows, and supply chain risk management.

2) Contractor will provide annually the same updated status of a 3rd party assessment when requested by the COR.

9 Does NIST MEP contemplate a transition-in phase such that the incumbent contractor’s period of performance overlaps within the incoming contractor’s period of performance?

No, the government does not contemplate a transition period.

10 The PWS does not include provisions for OMB Clearance. Based on our review of the Federal Register, this project’s OMB package MEP for Client Impact Surveys (OMB Control No. 0693-0031) expires 08/31/2024 and MEP Management Information Reporting (OMB Control No. 0693- 0032) expires 12/31/2024. Does MEP anticipate modifying the PWS or the forthcoming contract to include the preparation of a new OMB Clearance package in the base period and/or option year 1?

No, the government will get the OMB clearance.

Contractor will need to update expiration date on their system.

11 For budgetary purposes, please provide the estimated level of effort for subtask 2.5 – Connectivity Between MEIS and Vendor Survey System.

The contractor will provide data file to the government, the government will upload into the MEIS system. At this time the government is not looking for an automated upload of data. We are under budget constraints – this is a wish list item.

12 Can NIST please confirm the proposal due date? Page 9 of the Solicitation

Proposals are due on Wednesday March 16, 2022, See the attached amendment.

Page 3 of 4 February 25, 2022 states the due date is “Wednesday, March 7”; however, March 7 is on a Monday.

13 The PWS states on page 1, “MEP centers assist approximately 10,000 manufacturers in a typical year,” however Task 1-1 on page 3 states approximately 3,000 clients will be surveyed per quarter and the table on page 8 in Section V states 3,000- 4,000 per quarter. Should the contractor provide pricing for 12,000- 16,000 surveys per year?

Please provide pricing for approximately 3,000-4,000 per quarter or 12,000-16,000 surveys per year.

14 Task 2-2 on page 6 of the PWS states the “Contractor shall provide an alternative method of data collection (e.g. telephone)”. Can NIST please confirm that the phone helpdesk should have Spanish capabilities?

Yes, Spanish speaking capabilities is requirement for helpdesk.

15 As a system that is collecting PII (personally identifiable information) and BII (business identifiable information), does the proposed solution need to be hosted in an ATO'ed environment?

IT Security and Privacy controls are given in NIST SP-800-53 Rev 5 https://nvlpubs.nist.gov/nistpubs/SpecialPublications /NIST.SP.800-53r5.pdf. NIST MEP has categorized the data you will receive, store, and process at security level Low for Confidentiality, Integrity, and Availability (C/I/A = L/L/L). This data is considered Personally Identifiable Information (PII) and Business Identifiable Information (BII).

NIST does not conduct assessments of contracted services. However, NIST is still required to perform due diligence to ensure that the data that is transmitted, stored, and processed by an external vendor is secure. The Contractor will provide necessary documentation to NIST MEP to request Authority to Operate (ATO) through the NIST CIO.

All Low baseline security and privacy controls must be in place in the final solution.

16 The scope of work as detailed in the PWS involves the electronic preparation, transmission, and receipt of survey data. There are additional scope elements around ensuring the validity and security of the collected data. The key personnel requested do not appear to align with the scope of work. The PWS does not include the development of the

The government has revised the key personnel in the SOW. Survey questions will be developed by NIST MEP.

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf

Page 4 of 4 February 25, 2022 survey questions, which would necessitate support from high-level behavioral science professionals. We request that the key personnel section be modified to remove the need for social science experience and to require expertise with using electronic means to engage with customers and to securely manage PII-sensitive data.

17 We request an extension to have 14 days to respond to the RFQ after the answers to questions are released

The due date has been extended until 11:00 am, Wednesday, March 16, 2022

18 Can you please provide us the Set Aside information

This is a 100% set-aside for small businesses