Small_Business_Q_A_for_NASIS_0004.pdf

Q&A FOR NASIS SOLICITATION 140A2325Q0066

SMALL BUSINESS

1. PWS §1.2: Must the contractor include any FACE program data predating SY 2006–2007 in the migration, or is all historical data strictly from 2006–2007 onward?

From School Year 2006-2007 forward.

2. PWS §2.2.2: For contingency plan testing under NIST SP 800-34 Rev. 1, do we need to provide a full functional disaster recovery test annually, or is a tabletop exercise sufficient to meet the BIE requirement?

Full functional disaster recovery test is required.

3. PWS §2.2.5: Will the Government designate or procure from a specific 3PAO to conduct the

Assessment & Authorization testing, or does the contractor select from a Government-approved list of 3PAOs?

This is a vendor responsibility using a certified 3PAO provider.

4. PWS §2.2.21: Regarding the Contingency Plan Test results, please clarify whether the

Government’s acceptance criteria includes a specific Recovery Time Objective (RTO) and Recovery Point Objective (RPO), or if the contractor must propose both?

Please propose objectives the vendor feels necessary to annotate contingency plan testing metrics. The Recovery Time Objectives (RTO) will be determined by the BIE program and their answers to the Business Impact Analysis (BIA).

5. PWS §2.2.22: For monthly vulnerability scans, can the Government confirm whether the

Government provides the scanning tool licenses (e.g., Tenable, Qualys, etc.), or is the contractor expected to procure and operate scanning tools independently?

As an ISP Coco, this is a vendor responsibility. The DOI currently uses for internally vulnerability and compliance scanning and is licensed for Tenable.SC.

6. PWS §2.2.23 & §2.2.24: Will the Government provide or share the existing Privacy Impact

Assessment (PIA) and System of Records Notice (SORN) documentation from the incumbent system for contractor reference, or must the contractor develop both anew?

Existing non-proprietary artifacts can be used as reference when the vendor prepares its own documentation. The DOI SORNs URL site: Privacy Act Systems of Records Notices | U.S.

Department of the Interior. The DOI PIA URL site: Privacy Impact Assessments | U.S.

Department of the Interior.

7. PWS §2.2.27 (implied from SOW references to scanning/monitoring): Will the contractor be granted direct access to deploy Splunk Forwarder, HCL BigFix, and Microsoft Endpoint tools on the hosting environment, or are these installed/configured solely by IA-OIMT staff?

https://www.doi.gov/privacy/sorn https://www.doi.gov/privacy/sorn https://www.doi.gov/privacy/pia https://www.doi.gov/privacy/pia

As an ISP Coco, the installation of the DHS Continuous Diagnostics and Mitigation (CDM) tools is a vendor responsibility.

8. PWS (General): If an off-the-shelf SIS lacks a mandatory PWS feature (e.g., ISEP functionality or 508 compliance elements), is the contractor allowed to customize strictly to achieve compliance, or would any customization be considered out-of-scope?

The vendor should propose a solution that meets the requirements of the PWS.

9. PWS §3.1.1: Beyond the general acceptance of on-site/remote blends, are there any mandatory in-person intervals or minimal on-site presence requirements for the Senior Project Manager?

This can be determined upon award so as to ensure that the vendor can successfully implement and manage the new system.

10. PWS §3.5.2: For data standardization, are there any existing data dictionaries or data mapping documents from the legacy NASIS that list all non-standard codes currently in use at each school, or must the contractor build these inventories from scratch?

Data Schemas are available from the current provider with appropriate clearance.

11. PWS §3.6.2.2: If proposing a cloud-based solution rather than the Albuquerque Data Center, please confirm whether hosting within a FedRAMP Moderate environment meets all BIE, DOI, and IA-OIMT requirements for the “Contractor Owned and Contractor Operated” model (i.e., AWS GovCloud, Azure, etc.)?

Contractor owned/contractor operated facility is a non-government owned, privately operated facility that provides goods and/services to a federal agency under contract.

12. PWS §3.6.3.1 & §3.6.3.4: For help desk coverage 5 days a week (5 AM to 5 PM MST), is there a preferred after-hours escalation process for urgent issues or outages outside those core support hours?

A preferred after-hours escalation process will be jointly determined post award between the government and the vendor.

13. PWS §3.6.2.3 (IPv6): Must the application be fully IPv6-only by a specific date, or is dual-stack (IPv4/IPv6) acceptable for the life of the contract?

Federal requirements for IPv6 mandate that all new networked Federal information systems are IPv6-enabled prior to being made operational by FY 2023. The policy also requires a plan to phase out use of

IPv4 for all systems by either converting to IPv6-only or replacing or retiring systems. Dual-stack is an interim solution to meet the IPv6 requirement.

14. Instructions §1: Does the Government anticipate awarding a single contract vehicle only, or will it consider multiple awards if different contractors propose complementary solutions?

This will be a single award. Any subcontracting arrangements are at the sole discretion of the vendor.

15. Instructions §1.2: For the Acknowledgement Page, please confirm if the Government requires an original wet signature or if a digital/electronic signature is acceptable, provided it is from an authorized representative.

Both are acceptable

16. Instructions §1.6.1 (Factor 1 – Technical Solution): Should the 8-page Technical Solution include diagrams or images, and if so, do diagrams/images count against the page limit?

High level architecture diagrams are encouraged. Hyperlinks to images may be used.

17. Instructions §1.6.1 (Factor 3 – Experience): Can relevant experience examples reference subcontracts or teaming arrangements, or must they be prime contractor experiences only?

Prime contractor experience only.

18. Instructions §1.6.2 (Factor 2 – Pricing): Given this is a firm-fixed-price contract, may offerors include optional pricing details (e.g., additional cost assumptions) beyond the Attachment 4 Pricing Schedule, or should only the standard schedule be submitted?

Only the standard schedule is acceptable.

19. Instructions §2 (Questions Deadline): If the Government’s response to offeror questions necessitates significant proposal revisions, will the Government consider extending the due date beyond April 4, 2025?

Per amendment 3 the proposal due date for Small Business proposals is May 19, 2025 by 3PM

CT.

20. Instructions §3 (Quote Submission): Is there a maximum allowable file size for each email submission, and if so, will the Government accept a secure file transfer link if the attachments exceed that size limit?

No, submit as outlined in the solicitation.

21. Evaluation Criterion (52.212-2) – Technical Solution (Factor 1): For the Transition Plan portion, are there specific metrics or milestones the Government would like to see addressed (e.g., parallel run, cutover approach, data validation steps), or should we propose a transition methodology in our own format?

The vendor should propose a transition methodology that it feels would be appropriate given the size and sensitivity of the existing system.

22. Evaluation Criterion (52.212-2) – Pricing (Factor 2): Could the Government clarify what constitutes “significantly unbalanced” pricing, or will the Government simply evaluate unusual cost distributions on a case-by-case basis?

Case-by-case basis.

23. Evaluation Criterion (52.212-2) – Experience (Factor 3): Does the Government have a preferred format (e.g., matrix, narrative) for demonstrating experience across multiple large-scale K-12 SIS implementations, or is it up to the Offeror’s discretion?

At the contractor’s discretion.

24. Evaluation Criterion (52.212-2) – General: Will the Government allocate discrete point values or weighting factors for each sub-factor (e.g., 40% for Technical, 30% for Price, 30% for Experience), or is this a best-value tradeoff without a specified weighting formula?

Best-value tradeoff without a specified weighting formula

25. PWS §1.1–1.2: Please clarify whether the SIS’s primary goals, beyond collecting and storing student data, also include supporting student achievement for diverse Native American communities.

Yes. The data collected in the SIS must be aligned with all applicable statutory and regulatory education program requirements to be utilized for school improvement planning and supporting student achievement.

26. PWS §1.2 & §3.3.3: For which educational levels does the SIS need to support data management (K–12 only, or also adult education, tribal colleges, and FACE programs)?

Pre-K through 12

27. PWS §3.3.3 & §1.1: Can the Government provide additional functional or data requirements specific to the FACE (Family and Child Education) program beyond what is stated in PWS §3.3.3?

FACE (Pre-K) student data and functionality would be the same as required for K-12

28. PWS §2.2 (general): Is HIPAA compliance relevant for student health data (e.g., nurse visits, immunizations) within this SIS, or is PII primarily governed by FERPA and BIE policies?

PII is governed by FERPA, BIE Policies and other federal privacy requirements as specified by contract clause references.

29. PWS §2.2.1 & §2.2.6: Does the Government require integration with other existing education platforms (such as state assessment systems or learning management systems), and if so, what data exchange standards apply?

Standard Application Programming Interfaces for LMS and Assessment Integrations are used.

OneRoster 1.2 is an example of one.

30. PWS §1.2 & §2.2.1: In regions with limited or intermittent internet connectivity, does the SIS need to provide any offline functionality or special design for low-bandwidth environments?

The vendor may propose alternate access methods or approaches to address connectivity issues, remote or in-general

31. PWS §3.5.1 & §1.2: Beyond the 2006–2007 onward legacy dataset and the “large” data volume noted in Q&A #58, are there any additional data sources or specialized data formats (e.g., separate FACE files) requiring a distinct migration approach?

Migration approaches will be determined post award as part of the vendor’s transition plan.

32. Is the government looking to replace the existing SIS with a completely new system? If so, when is the new system expected to be finished? PWS page 44 sections 3.6.2

The government is looking to compete its SIS requirements. Vendors may propose solutions that meet those requirements.

33. Is the government looking to do Operations and Maintenance & Application modernization on the current solution? PWS page 42-43 Section 3.6 The government is looking to compete its SIS requirements. Vendors may propose solutions that meet those requirements.

34. What products are currently being licensed, at what rate, and what quantity? PWS page 44 section 3.6.1

The current system is Infinite Campus with Campus Learning additions for all Bureau funded schools.

35. Are any of the current systems hosted in the cloud, if so which cloud and what are the annual fees associated with that? PWS page 44 section 3.62-3.6.2.2

The current system is vendor hosted. Cloud fees are not applicable.

36. Can the government provide a system architecture design for the current solution that includes the number of servers and roles for each system? PWS page 15 section 2.2.20

The government can provide non-proprietary high level architecture diagrams. Quantity specific information will be determined by the vendor’s proposal.

37. Are the systems and services described in the PWS highly available and/or redundant? PWS page 15 section 2.2.20

The vendor should propose a system that meets the Service Levels identified in the PWS.

38. How are identities currently managed where are they stored and do they support multifactor authentication? PWS page 10 section 2.2.5

The proposed system will need to support PIV authentication for federal users and Multifactor authentication for cleared tribal users (for Tribally controlled schools)

39. What persona groups use this system? I.e. regional/district administrators, school administrators, teachers, students, or parents/guardians. PWS page 39 section 3.4.3.1

The system is the designated SIS for the BIE. Appropriate access and functionality must be available for all BIE-funded school user groups and all user groups within the regional and state levels.

40. Is the government more preferential to a new solution, or would they prefer to upgrade the existing system? PWS page 42 – 44 section 3.6

Vendors may propose solutions that will meet the requirements specified in the PWS.

41. Can you clarify the intellectual property rights for any software developed under this contract and any specific terms related to this? PWS page 13 section 2.2.13

Per FAR 52.227-14, refer to https://www.acquisition.gov/far/52.227-14, as outlined in the solicitation.

42. What are the specific data validation requirements and processes that need to be followed?

PWS page 34 section 3.2.6.6

This refers to specific field level validation. Standard data management processes are adequate.

43. Are there specific qualifications or certifications required for key personnel beyond what is mentioned in the RFP? SOL page 19 sections 1.61 ii Factor 3

The vendor may propose key personnel with qualifications and certifications that would demonstrate the company’s capabilities.

44. Are there any preferences or restrictions regarding the choice between managed hosting and cloud hosting solutions? – PWS page 44 section 3.6.2 – 3.6.2.2

The PWS references a Contractor owned/contractor operated facility that is a non-government owned, privately operated facility that provides goods and/services to a federal agency under contract.

https://www.acquisition.gov/far/52.227-14,