IHS_Web_Support_Services_Questions_and_Answers_Amend_003_0003.pdf

IHS Web Support Services Solicitation Q&A PWS Questions

Q1. Can you provide historical information on the labor categories and hours being expended on the current contract over the past year or life of the contract?

A1. The current contract consists of 18 FTE which is made up of mostly SharePoint Administrators, Database Administrators, System Administrators, Application Developers, Web Designers, and various Analysts.

Q2. Can you provide information on any new requirements being projected for either the internal web sites and/or the public facing web sites or new SharePoint requirements?

A2. The web service team is planning to upgrade the OS and other software on the servers very soon. We are still researching options for migrating to cloud. There is potential for other requirements to come up that have not yet been identified.

Q3. What is the typical/average timetable for required background checks?

A3. Typically, this takes 4-8 weeks.

Q4. Currently is there a Digital Asset Management System (DAMS) in place? Will there be a requirement for a DAMS?

A4. No. There is no formal DAMS requirement. The team currently uses version control for code and a SharePoint site for Photo/Asset Repository.

Q5. Is the Mura Content Management System (CMS) the only CMS being utilized?

A5. Yes. Mura CMS is the only CMS being utilized.

Q6. How is Dreamweaver currently being used for development?

A6. Dreamweaver is used by the developers to create and maintain the web pages. Visual Studio Code, Eclipse, and other tools can also be used for development.

Q7. Are videos being hosted locally or cloud based? YouTube?

A7. Videos maintained by the Web Services Contract are hosted on IHS’s channel on YouTube.

Q8. There are currently 270 web content manager accounts. Will that number increase, stay consistent, or decrease over time?

A8. There’s no good way to predict this, but we expect this number to continue increasing over time.

Q9. Draft PWS, Section 3.1 (e), 3.5 (d): Migration from SP 2013 on-premises to O365 is a major undertaking, depending on the level of our role.

• What migration has started, completed, or in progress?

• What stage are we coming into the migration process?

• What level of responsibility will we have in the migration process? For example, are we responsible for migrating the content, or simply planning and preparing content for migration and testing post-migration?

• Will we be responsible for communications and training content owners on the new system as part of the migration schedule, or will that be performed by another vendor?

• Will the same level of development need to be maintained during the migration which would require a potential surge in staffing during the migration? Or will the team be able to prioritize migration activities within their workload?

A9. We are in the early stages of the migration process.

Q10. Draft PWS, Section 3.1 (f)(i): Are we responsible for developing an enterprise-wide security program and security standards and guidelines OR simply ensuring compliance and accessibility with existing regulations? If these items are references that must be complied with, it could be moved to an appendix for clarification.

A10. Yes. The web services team is responsible for ensuring compliance and accessibility with existing regulations.

Q11. It states in the table for Basis of Award- Volume IV- Past Performance- Shall be completed in MS Word or PDF & using Attachment 4, PPQ, required for all provided ref.s that do not have a CPARs on file. My Company provided staffing on a Dept. of Labor contract. Can I use this for past performance?

A11. Past performance can be provided for contracts completed for both public and private sectors.

Q12. Will there be any work on this opportunity related to the IHS RPMS?

A123. No. RPMS is just to maintain a website where they host training and documents.

Q13. Does the Government anticipate an agency wide marketing campaign to make stakeholders aware of all the new functionality with SharePoint Online and best practices for its usage?

A13. Yes. The Government will use mass emails, Knowledge Now Articles, and IHS.gov website to advertise this new functionality and best practices.

Q14. How many annual tickets are being received at Tier 2?

A14. We do not collect these metrics.

Q15. How many problems are being escalated to Tier 3 support by application?

A15. We do not collect these metrics.

Q16. What is the percentage of tickets, by severity, for each of the applications in scope?

A16. We do not collect these metrics.

Q17. Will the Government be open to break down Large site collection into smaller multiple site collections for ease of migration?

A17. Yes. The government is open to all realistic suggestions proposed by the contractors.

Q18. Is the Government open to rethink and reimagine very large SharePoint sites for ease of migration?

A18. Yes. The government is open to all realistic suggestions proposed by the contractors.

Q19. Is the Government open to work with the contractor to identify which customizations to keep during the migration?

A19. Yes. The government is open to all realistic suggestions proposed by the contractors.

Q20. Can the Government confirm whether empty lists and libraries will need to be migrated?

A20. It’s too early in the migration process to confirm this.

Q21. Will the Government ensure that file names and URLs which are more than 256 characters will have to be reduced to be 256 or less characters in length?

A21. It’s too early in the migration process to confirm this.

Q22. Will the Government please share the total data size to be migrated to SharePoint online for the space that has been assigned?

A22. There are 473 sites and 5127 personal sites. For the Content Database, 2.24 TB of 6.62 TB allocated is being used.

Q23. Does the Government have tools like ShareGate or is that would be something that the Government is looking for contractor to provide?

A23. The government does not have ShareGate, but the government is open to considering all tools suggestion by the contractor. The government usually purchases all software used by the contractors.

Q24. What is the avg. time it takes for someone to received their NACI clearance f/IHS? Can a contractor get an interim NACI clearance? If so, how long on avg. does this take to receive?

Can a contractor start doing work as an IHS contractor before receiving clearance or interim clearance?

A24. The average time it takes to be pre-cleared is within 15 days of e-QIP initiation. Note that the pre-clearance allows you to begin working/obtain access/obtain a PIV if necessary based on the completion and submittal of the e-QIP to our investigative service provider (ISP).

Q25. Does the Government currently hold G3 or G5 type of O365 license?

A25. The Government currently has an O365 G3 GCC license.

Q26. Does IHS currently have Office 365? If so, what version is IHS using?

A26. IHS currently has an O365 G3 GCC license.

Q27. Does the Government have automated tools to deploy code 2 per week or is the Government looking for the contractor to form a Continuous Integration and Continuous Delivery pipeline?

A27. No. The Government does not have automated tools to deploy code. This is done manually.

Q28. Is the government planning on migrating any of their external (public) sites?

A28. The government is not planning on migrating any of the external (public) sites right now.

Q29. What mobile vendor application does IHS use?

A29. IHS does not use mobile vendor apps.

Q30. Is the Government open to modernizing the sites where appropriate instead of a direct migration?

A30. No. The government will not modernize the site and will be migrating to SharePoint Online.

Q31. Would the government be open into migrating infrastructure (Non SOP) into a Azure environment (if it’s not being used today)?

A31. Yes. The government is open to all realistic suggestions proposed by the contractors, but there are no plans at this time to migrate into an Azure environment.

Q32. Can the government provide the languages that are in use for SharePoint 2013?

A32. The languages used for SharePoint 2013 are CSS, HTML, javascript, jquery and some ASP.net.

Q33. Please confirm that all SharePoint workflows are at least 2013 or newer. Please provide the programming languages used in writing those custom workflows?

A33. The languages used for SharePoint 2013 are CSS, HTML, javascript, jquery and some ASP.net.

Q34. Are you looking to deploy items such as AIP? If so do you have required licenses or are you looking to have us recommend appropriate licenses based on the guidance of features and functionalities that are available at this time?

A34. The web service team is not looking to deploy items such as AIP at this time.

Q35. What is the size and scope of the SharePoint site a contractor would need to create within 3-5 business days?

A35. SharePoint sites vary in size and scope. The initial creation of the site is due within 3-5 business days. A customer will be given admin access to their site, so they can customize their site. Contractors will work with customer to answer any SharePoint related questions to help them standup their site.

Q36. Is IHS using cloud storage now? If so, what vendor and version?

A36. No. IHS is not using cloud storage now.

Q37. What software packages will the government provide with ServiceNow (ITSM, ITOM, etc..)?

A37. The government will provide access to ServiceNow, which is ITSM (Incident, Problem, Portal, Service Catalog, Knowledge and Change Management).

Q38. 525 live SharePoint databases - What is the average number of tables per database?

A38. The average number of tables per database is 138.

Q39. What versions is IHS using of the following technology: MS Windows Server, MS SQL Server, LSoft List Serv, L-Soft Maestro, Mura CMS, Adobe Fusion Reactor, Site Improve, Google Analytics, Visual SVN, Synack, Adobe CC, Bitnami Bug Reports, ServiceNow, Splunk, Eclipse, Tenable.cs, Symantec Management Console, Apache & IIS Web Servers, Getty Images & Visio?

A39. MS Windows Server. Ver. 2012-2019 (planning to upgrade soon) MS SQL Server, Ver. 2012-2017 (planning to upgrade soon) L-Soft List Serv, Ver. 17.0 L-Soft Maestro, Ver. 10.1 Mura CMS, Ver. 7.1 (planning to upgrade soon) Adobe Fusion Reactor, Ver. 28 (planning to upgrade soon) Site Improve, Ver: NA (Website Subscription) Google Analytics, Ver: NA (Website Subscription) Visual SVN Enterprise, Ver: 5.0.3 Synack, Ver: NA (Website Subscription) Adobe Cloud Suite Complete, Ver: (Subscription) Bitnami Bug Reports, Ver: 2.6.0 ServiceNow, Ver: ITSM (website) CrowdStrike, Ver: 6.45 Splunk, Ver 8.2.4 Eclipse, Ver: Mars (with Cold Fusion Plugins) Tenable.cs, Ver: 5.23.1 Symantec Management Console, Ver: 8.5 Apache, Ver: 2.4.54 IIS Web Servers, Ver: 8-10 Getty Images, Ver: NA (Website Subscription) Visio Ver: Office 2016

Q40. Can the Government identify the scope areas (under the Draft PWS, Attachment 1, Section 3.0) the incumbent contractor is currently performing?

A40. The level of effort is very similar, but the tools used are continuously changing.

Q41. Can the Government please specify whether there have been any changes in scope of this solicitation from the scope of the incumbent contract?

A41. No. The scope has not changed in any significant way.

Q42. Can the Government please specify whether that have been changes in the anticipated level of effort from that on the incumbent contract?

A42. No. The level of effort has not changed in any significant way.

Q43. Can the Government please specify whether that have been changes in preference of education and experience of the labor categories for the current solicitation?

A43. There have been no changes in the Labor Categories (LCATS) for the current solicitation.

Q44. Where are the servers located? Are they on-site, in a colocation facility, in AWS GovCloud, somewhere else?

A44. Our servers are hosted in a federal datacenters.

Q45. If no work is to be performed on-site, who is responsible for maintaining physical server and network infrastructure?

A45. The physical server is hosted in a federal datacenter. The web service team is responsible for maintaining the compliance to security guidelines. The network infrastructure is managed by another IHS contract.

Q46. Where is the current instance of SharePoint 2013 hosted? Is it on-site, in a colocation facility, in AWS, somewhere else?

A46. The current instance of SharePoint 2013 is hosted on-site.

Q47. This section states "Develop required documentation to attain and maintain Web Services Authority to Operate (ATO). Anticipated approval of our ATO is January 2023." The period of performance for this contract begins on 2/1/2023. Does this mean that ATO documentation has already been completed, and the contractor will only be responsible for maintaining and updating it in preparation for renewal in Jan 2026?

A47. The ATO documentation has already been submitted, and we’re currently waiting for approval. The contractors will be responsible for maintaining and updating the ATO documentation.

Q48. This section states "To gain routine physical access to an HHS facility..." but Section 2.2 states that no work will be performed on-site. Does HHS foresee any need for awardee personnel to need physical access to HHS facilities?

A48. PIV cards are required to access the IHS network, and the process of obtaining PIV cards must be done in-person at HHS and HHS-partnered facilities. These facilities are located throughout the US. HHS does not foresee any other need for awardee personnel to need physical access to HHS facilities.

Q49. Will HHS provide all required licenses for Adobe Creative Cloud?

A49. Yes. HHS provides all required licenses needed by the contractor including Adobe CC.

Q50. Are the listed tools/languages required by HHS or can the contract awardee choose to use different tools and languages, as appropriate?

A50. The listed tools/languages are not required by HHS, but the contract awardee must use tools and languages approved for use by security to run on the network. They should also meet IHS budgetary constraints.

Q51. This section states that "Executable code will be pushed to the live production server twice a week." Will the awardee of this contract be responsible for code deployment and maintenance of deployment pipelines, or is this handled by a separate operations team?

A51. Yes, the awardee of this contract will be responsible for code deployment. No, the code deployment is not handled by a separate team.

Q52. Can HHS/IHS share any information about the quantity/frequency of SharePoint user support requests? Contractors will need this information to properly size the support team.

A52. Our previous months show 15-20 tickets per month for SharePoint. There could be an uptick of tickets during the migration to SharePoint Online.

Q53. Are you using any CRM tools (i.e. Salesforce, Remedy, ServiceNow, Smartsheets, or other)?

A53. We are using ServiceNow

Q54. Would you be open to alternative web app hosting, ie, Drupal or other CMSs?

A54. The government is open to all realistic suggestions, but all CMSs will need to be approved by security at HHS.

Q55. This section states, "Provide User Support for all web application users internal and external to IHS." - Can IHS share any information about the quantity/frequency of user support requests for these web applications so that contractors can properly size support teams?

A55. ServiceNow tickets vary throughout the year, but our previous months show that our team fields about 100 tickets created per month.

Q56. This section states "The Contractor will be required to support all routine monitoring of the web server infrastructure, critical services, and website issues." - are satisfactory monitoring and alerting systems already in place for these systems, or will the Contractor need to create them?

A56. Satisfactory monitoring and alerting systems are already in place. The contractor will be required to update existing systems or create new systems as security and organization guidelines change.

Q57. This section states "Ensure all identified IHS.gov web application users are assigned the appropriate level of security and report access as defined by the application owner before production status." - does this mean that all web application users are currently assigned the appropriate levels of access, or will the Contractor be expected to audit all user access at the beginning of the PoP?

A78. All web application users are currently assigned the appropriate levels of access. The contractor is expected to adjust the level of access per customer requests.

Q79. Are all of the servers listed running on Windows Server operating systems? What versions of Windows Server are being used?

A79. All servers listed are running in a Windows server Operating Systems. We use Windows Server 2012-2019. We plan to upgrade all servers to 2019 soon.

Q80. This section said "Manipulate graphics/images and optimize for website use." Does the contract require image creation or video editing?

A80. The web service contract requires image creation and video editing.

Q81. This section states "Develop documentation, including Systems Requirements Specifications (SRS) documents and Business Requirements Documents (BRD)". These are traditionally generated with a waterfall methodology. Could the SAFe agile methodology be used instead of waterfall?

A81. The government is open to all realistic suggestions proposed by the contractors. Our team is not currently using agile.

Q82. How much content is stored in the on-premise SharePoint farm?

A82. For the Content Database, 2.24 TB of 6.62 TB allocated is being used.

Q83. How many users use the system on daily basis?

A83. On average there are about 2,000 concurrent users at peak time during the week. There are typically about 17,000 active users per day.

Q84. How many employees to be trained, how often?

A84. All employees are required to complete mandatory IHS training annually.

Q85. Is the current on-premise SharePoint farm configured for High Availability?

A85. The current on-premise SharePoint farm configured is not configured for High Availability.

Q86. Is this contract responsible for maintaining the Splunk implementation, and creating/managing Splunk dashboards? Are there any Key Positions identified? What is the current LOE? Are there any preferred or suggested LCATS?

A86. No, the contractors are not responsible for creating/managing Splunk dashboards.

Q87. The SF 1449 Period of Performance is given as 02/01/2023 - 01/31/2028. The RFP Sec. 1.1

- Period of Performance states it is 01/04/2023 - 01/03/2028. Which is correct?

A57. The Period of Performance (PoP) for the new contract will be from 02/01/2023 - 01/31/2028.

Q58. What form of daily communication do you prefer (i.e. Slack, MS Teams, etc)?

A58. The preferred form of daily communication is MS Teams, Skype for Business, Zoom, and email.

Q59. Will the contractor need to provide own equipment or will GFE be provided for development and production?

A59. Equipment (laptops, monitors, keyboard, and mouse) will be provided to the contractors.

Q60. Will any meetings in person be required at any point in time of the contract (i.e. Planning, etc)?

A60. No, in person meetings will not be required. PIV cards are required to access the IHS network, and the process of obtaining PIV cards must be done in-person at HHS and HHS-partnered facilities. These facilities are located throughout the US. HHS does not foresee any other need for awardee personnel to need physical access to HHS facilities.

Q61. PWS states “All costs associated with Background Investigation (BI) are to be borne by the Contractor; the Government will conduct the BI and will advise the Contractor of the costs.” Can the Government please provide the typical cost of a BI per candidate?

A61. IHS does the background investigation, and the PWS has been updated to remove the verbiage above.

Q62. What, if any, tools are currently being used to ensure 508 compliance?

A62. Site Improve and Adobe CC are used to ensure 508 compliance.

Q63. Can the Government please detail if there are any specific wireframing and prototyping products that must be used?

A63. There are no mandatory wire-framing/prototyping tools, but all tools must be approved for use on the network by security.

Q64. Can the Government provide the written IHS standards including Health and Human Services (HHS) Enterprise Performance Life Cycle (EPLC) standards to offerors?

A64. https://www.ihs.gov/cpic/lifecycle/

Q65. Does the Government require SonarQube or Fortify to be ran against all code produced?

A65. IHS follows HHS guidelines for security.

Q66. Can the Government please detail the relative percentages of site deployment configurations – how many of the sites are developed with CFML versus how many are maintained within Mura CMS, SharePoint, or deployed with a site-specific build system?

A66. All new sites are built with MURA CMS (90%).

Q67. PWS states “There is a requirement for off-hour support for scheduled maintenance (ex.

applying patches/updates to servers), which is anticipated to be no more than 8 hours per month.” Can the Government please define “off- hours”?

Additionally, can the Government provide the estimated number of staff needed for the anticipated 8 hours per month of off-hour support, and/or volume of patches/updates typically needed each month?

A67. Off-hours is any time worked that is outside normal business hours. Number of staff needed for off-hour support is usually no more than one person. Contractors are expected to use this time to push routine patches and software updates and emergency fixes on the servers.

Q68. PWS states “Contractors should be available to respond in most cases within a maximum of forty-five (45) minutes.” Can the Government please confirm that the response is defined as via telephone either by pickup of such call and/or return call by forty-five (45) minutes?

Additionally, can the Government provide what is required to be part of the “Call Tree” is a single phone number required? Is someone expected to be on call, if so what hours, days?

A68. People responsible for server uptime are expected to be on-call at all times (1-2 people needed). Contractors can share as many phone numbers as they’re comfortable with sharing.

The response is the pickup and/or return call within forty-five minutes.

Q69. PWS states “Develop and deliver ad hoc presentations and informal training for members and the web services team as needed.” Can the Government please provide the medium for these presentations and the necessary content, for example a handout, PowerPoint presentation, on-site link?

A69. The medium used is up to the contractor. These presentations are usually done with collaboration tools like Skype, Teams, and Outlook. The contractor should use whatever format is needed to get the job done.

Q70. PWS states “Provide informal training and support to IHS.gov Web Content Managers for documentation compliance needs.” Can the Government please provide the medium for these presentations and the necessary content?

A70. The medium used is up to the contractor. These presentations are usually done with collaboration tools like Skype, Teams, and Outlook. The contractor should use whatever format is needed to get the job done.

Q71. PWS states “Provide training for employees on the use of SharePoint and its available features.” Can the Government please provide the medium for these presentations and the necessary content?

A71. The medium used is up to the contractor. These presentations are usually done with collaboration tools like Skype, Teams, and Outlook. The contractor should use whatever format is needed to get the job done.

Q72. PWS states “The Contractor will be required to support all routine monitoring of the web server infrastructure, critical services, and website issues”. Can the Government please define the frequency associated with “routine monitoring”?

A72. The government provides the tools needed to support routine monitoring. The frequency is determined by HHS security guidelines and how the tool is configured.

Q73. PWS 3.2.a & I, Website Content code push - How many graphics/images are pushed to the server each week (2 pushes)?

A73. The number of graphics/images pushed to the server vary each week depending on the requirement. We don’t track this metric. Feel free to review ihs.gov for a more accurate representation.

Q74. PWS 3.3.o, Web Applications code push - How many releases are pushed each week? How many patches?

A74. The web service team pushes code twice a week. The amount of patches depends on what vulnerabilities the security team finds and how many servers have this particular software.

Q75. Would the Government please provide the 12-month historical log and current backlog of SharePoint requests with their “priority” ratings?

A75. Our previous months show 15-20 tickets per month for SharePoint. There could be an uptick of tickets during the migration to SharePoint Online. There is currently no backlog of SharePoint requests.

Q76. Would the Government please provide historical information about the alerts, frequencies, criticalities, and current backlog?

A76. The government does not collect these metrics.

Q77. Are there multiple language requirements for web content? Which languages?

A77. The language required for the web content is English. The programming language required for web content is HTML/CFML.

Q78. Will the Government please share metrics or logs that show the history of uptime/downtime for the servers and communications in the IHS.gov environment?

A78. The government has tools for gathering these metrics, and the server uptime is usually 99.9%.

Q79. Would the government consider including an estimated Level of Effort table?

A79. No. The government will not include an estimated Level of Effort table

Additional Solicitation Questions

Q1. The Attachment 3 Pricing Sheet does not provide a section to populate Fringe and Overhead costs. Would the government please include columns so the Offeror may provide Fringe and Overhead build up against labor rates prior to the application of G&A and Profit?

A1. For the sake of Fringe benefits, please feel free to add a section that allows you to calculate your fringe benefits and then just enter total of those values within the appropriate cell within the spreadsheet. Please let us know if this doesn’t make sense and you need additional clarification.

Q2. Could you please provide instructions on how you would like the Price Narrative Tab in Attachment 3 completed?

A2. It was requested by a contractor that we allow narrative for the pricing. If you would like to provide a narrative, you can, but it is not required.

Q3. Would the government consider awarding this work as a T&M contract?

A3. It has been decided to procure this contract as a Firm Fixed-Price contract the requirement is defined within the PWS. Additionally, there are no materials required to be procured under this contract.

Q111. Will the Government accept a summary that fits within the page limit for Vol II and allow us to append our full draft outside of the page limit?

A111. Yes, the PWS has been revised to indicate the draft QA/QC Plan is due within 10 days of award of the contract. Contractors can submit QA/QC plans that provide their overall plan as a summary that fits within the page limits.