B26_SQA_-_LE_RMS_QA_1_(Final)(20240311)_0002.pdf

Question and Answers #1

140D0424R0004

Single Award Indefinite Delivery Indefinite Quantity Contract for a Law Enforcement Records Management System for the Department of the Interior’s Office of Law Enforcement and Security

Date: March 11, 2024

Item No.

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response

1 Did the Government see product demonstration as part of the market research?

If so, which products?

Yes, we saw various products. Some examples are Mark43 RMS; Axon Records; Kaseware; Niche RMS;

CentralSquare Platform; Premier One;

Global Justice SML Data Model and the National Information Exchange Module, and Jail Tracker.

2 List of all Government entities that the system will work with/touch o List of 3rd party applications and systems used o What is custom o What items are having trouble connecting with SN

See question 31 and 130.

We did not understand the third bullet point. We are unaware of any connection issues.

3 Does the Government prefer vendors who are CMMI and ISO certified? The Government has not stated a preference in this regard in the solicitation or for scoring of potential awardees.

4 Does the Government prefer vendors who have law enforcement records management past performance?

See Factor 5: Company Experience and Factor 6: Past Performance.

Item No.

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response

5 It is our understanding that some vendors are bidding on multiple teams as a sub for part of the scope, and also may be bidding the whole scope themselves as the Prime without subs.

a. What precautions can the Government implement to prohibit price fixing and/or price collusion by being on multiple teams and bidding as a Prime?

There are Federal Statutes and regulations which prohibit price fixing and collusion. The Government is not placing any restrictions on prime subcontractor relationships, other than what is already listed under the RFP, i.e., 52.209-6, 52.219-14, etc.

RFP Questions 6 1, 18 Attachment List:

References NIST 800-53 DOI Revision and RFP page 18 cites Appendix F.

Please clarify where Appendix F is located. See page 147 of the.pdf file titled SOL_140D0424R0004.pdf. The document is titled “Attachment 3:

Security and Privacy Control Stand Access Control Version: 1.0 December 2022.” See Amendment 0002 for additional clarifications.

7 3 Section 1 – Contract Type and Ceiling

We understand that the budget is set at $60 million, per section 1.1 of the RFP, for the LE RMS project, however, can the DOI define the budget allocation for implementation vs. maintenance and operations phases?

The ceiling value represents the potential value of the overall IDIQ, but it does not necessarily represent what the overall system will cost. It will depend on the final award.

8 3 Section 3 - RFP Response Due Date

Regarding RFQ 140D0424R0004, we seek clarification on the submission deadline for March 1st, 2023. Given the complexity of the solicitation requirements, we are concerned about the feasibility of preparing a comprehensive and high-quality response within the given timeframe indicated. Could you please confirm if an extension to the submission deadline is possible, thanks?

See Amendment 0001 and 0002 which extended the due date and time.

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response

9 3-4 Section 4: Stages of the Evaluation, Phase 1B, Factor 2: Technical Demonstration of Selected Functionality

As [a] Technology vendor, we anticipate multiple small business partners submitting responses with our technology. If there are multiple down selections to Phase 1B, is it DOI's intention to have multiple technical demonstrations of the same technology?

All offerors that receive a “Go” on Factor 1 in Phase IA: Proposal Submission will demo their product.

10 3-4 Section 4: Stages of the Evaluation. Phase 1B, Factor 2: Technical Demonstration of Selected Functionality

If multiple bidders propose the same product, will the government include them all in the Phase 1B/Tech Demo?

All offerors that receive a “Go” on Factor 1 in Phase IA: Proposal Submission make through IA will demo their product.

11 3-4 Section 4: Stages of the Evaluation, Phase 1B, Factor 2: Technical Demonstration of Selected Functionality

How soon after 3/1 does DOI anticipate scheduling demos with offerors?

We are anticipating demos starting about a week after closing of Phase IA Proposal submission.

12 3-4 Section 4. Stages of the Evaluation, Phase II

“Upon completion of Phase I and the advisory notification provided by the Government, Offerors may provide a Phase II Proposal Submission no later than the specified date and time provided.”

Will the specified date and time be provided as part of/within the advisory notification?

Yes.

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response

13 3-4 Section 4: Stages of the Evaluation, Phase II

Approximately when does DOI plan to initiate Phase II of the RFP process?

What is the estimated response time for Phase II Proposals (e.g., 3 weeks)?

Does DOI intend to permit a second Q&A Period to address questions for Phase II responses?

It will depend on how many technical demonstrations occur during Phase IB.

We would anticipate that proposals will be due around four weeks after the advisory down-select. At this time, we will have a second Q&A period for those firms that choose to participate in Phase II. We anticipate the Q&A Period will close within 1 week of notification of the Advisory- Down Select.

14 4-13 Section 5: Proposal Requirements

The Government requests a proposal in response to the attached SOW. See Section 5, below, regarding the Proposal Requirements.

DOI's SOW is >100 pages. Instructions request 30 page SOW response. Does the government intend vendors to only reply to Eval criteria for SOW response?

In regards to Factor 3 and 4, offerors should specifically address and discuss those items specifically outlined in Section 5.

15 4-5 Section 5: Proposal Requirements. Factor 1:

FedRAMP Moderate Hosting Authorization & Attachment B

"The undersigned hereby certifies that the application will be hosted in an authorized FedRAMP Moderate hosting environment as identified in the Statement of Work for solicitation 140D0423R0004."

Given vendors will submit responses with multiple components to the solution (e.g., CAD, RMS), does DOI request evaluation of the core RMS FedRAMP package only? If an application is provided in a FedRAMP Moderate hosting environment, does this address the required criteria?

Offerors solution must be hosted in a FedRAMP approved moderate hosting environment, to include CAD, and Jail Management Solution. Note that Factor 1 deals with the hosting of the solution only.

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response

16 4-5 Section 5: Proposal Requirements. Factor 1:

FedRAMP Moderate Hosting Authorization & Attachment B

If the vendor is submitting PaaS; will the FedRAMP equivalent compliance documentation be required in Phase 1A for any application not currently FedRAMP authorized?

Will the equivalent compliance be required as Phase 1B?

FedRAMP Moderate Hosting must be proven at Phase IA.

Application layer FedRAMP review be evaluated under Factor 3 which is part of Phase II. When submitting your Phase II, the offeror can then demonstrate their FedRAMP equivalent compliance for the Application layer.

17 4-5 Section 5: Proposal Requirements. Factor 1:

FedRAMP Moderate Hosting Authorization & Attachment B

“Offerors must complete the form for Certification of FedRAMP Moderate Hosting Authorization (Attachment B), so the Government can verify their status. Their offering must reside in an authorized FedRAMP Moderate hosting environment.”

We recommend the Government allow solutions that are FedRAMP Moderate or High. This is because agencies can issue ATOs at lower-impact levels within a FedRAMP High environment without being subject to the High impact level controls.

For example, DOI can select to issue an ATO at the Moderate level for its tenant within the offeror’s FedRAMP High environment and will only be subject to the Moderate level controls. Ultimately, it is the Government’s desired impact level that dictates the control baseline and impact level – not whether the solution has FedRAMP Moderate or High Authorization.

The Government will only consider a solution in a moderate hosting environment. Under no circumstances will the Government accept a hosting environment higher than moderate.

The application solution maybe FedRAMP High certified, but it MUST be hosted in a Moderate Environment. See Amendment 0002.

A high hosting environment results in many issues, primarily related to security compliance, cost, and potential over-engineering as discussed further below:

1. Security Controls Mismatch Over-Provisioning of Security Controls: FedRAMP High environments are designed to protect against the highest level of risk, requiring more stringent security controls than Moderate environments.

A Moderate application in a High environment might be subject to security measures that are more robust than necessary. This can lead to unnecessary complexity in managing the application.

Compliance Challenges: Ensuring that a Moderate application complies with all the additional security controls of a High environment could be challenging and resource-intensive.

The application might need additional configurations or modifications to meet the High baseline controls.

3. Cost Implications Increased Costs: Hosting in a FedRAMP High environment typically incurs higher costs due to the more stringent security measures and controls. For a Moderate application, this might mean paying for a level of security that the application's risk profile does not justify.

Resource Allocation: The additional security measures require more resources in terms of both hardware and personnel, which could be better allocated elsewhere if the application's security requirements are genuinely Moderate.

3. Operational Efficiency Complexity: Operating within a High environment can introduce additional operational complexity not necessary for the protection of Moderate impact level data. This complexity can slow down system updates, patches, and

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response changes due to the more rigorous security review processes.

Overhead: The overhead of maintaining compliance with the High controls for a Moderate application may not add proportional security value and can divert attention from focusing on other areas of risk.

4. Potential Over-Engineering Applications and services might be over-engineered to meet the High requirements, potentially leading to inefficiencies in development and deployment processes. This over-engineering could make the system more complex than needed, increasing the chance of configuration errors or oversights.

18 4-5;

7-8

Section 5: Proposal Requirements. Factor 1:

FedRAMP Moderate Hosting Authorization & Attachment B and Factor 3: Technical Capabilities

“Offerors must complete the form for Certification of FedRAMP Moderate Hosting Authorization (Attachment B), so the Government can verify their status. Their offering must reside in an authorized FedRAMP Moderate hosting environment.

On page 8 of the solicitation package, in “Volume I, Section 5: Factor 3, Technical Capabilities” section under the “SOW Para 4.2 Task Area 2:

Application and Data Management of FedRAMP Moderate” it states that “The offeror will provide a copy of the application layer FedRAMP Moderate approval status, in process, or equivalent status.”

On page 14 of the package, in the “Evaluation Factors” section, it states that the FedRAMP.gov website and the offeror’s certification form “must show authorized with a Moderate rating no later than the closing date of the Phase I solicitation.”

The referenced requirements are ambiguous whether the FedRAMP authorization must be finalized or in-process by the March 1st date.

Please confirm that a status of “FedRAMP In-Process – PMO Review” on the March 1st, 2024, submission date is allowed for this requirement.

We recommend the Government consider solutions that are currently “FedRAMP In Process - PMO Review” that are Agency-sponsored, i.e., with an Agency Authorization Type. This is because:

1. PMO Review is the final stage in the Authorization process, and vendors that make it this far in the FedRAMP process will get through within a matter of weeks. Therefore, if a vendor is currently in PMO Review for their FedRAMP Moderate/High package, it’ll easily be authorized by DOI’s go-live date.

2. Unlike a Joint Authorization Board (JAB) Authorization type where vendors “pay to play,” an Agency Authorization Type means the federal agency has already issued an ATO against the vendor’s FedRAMP package. This evidences the quicker timeline and higher probability of

Note that Factor 1 deals with FedRAMP Moderate Hosting Authorization while Factor 3 Technical Capabilities deals with the application layer. As stated under Factor 3, “the offeror will provide a copy of the application layer FedRAMP Moderate approval status, in process, or equivalent status. For equivalent status of the application layer, the offeror must provide documentation of cloud security and authorization standards which meets FedRAMP guidelines that comply with rigorous security and privacy standards. “

Also see Question 17.

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response success anticipated for FedRAMP packages with an Agency Authorization Type currently under FedRAMP PMO review.

Additionally, including vendors that are in FedRAMP PMO Review fosters better competition and outcomes for DOI without introducing risk or exaggerated timelines. DOI will still have to issue its own agency ATO, and leveraging a sponsoring agency’s FedRAMP package will rapidly accelerate DOI’s timeline.

19 4-5 Section 5: Proposal Requirements. Factor 1:

FedRAMP Moderate Hosting Authorization

The RFP indicates in Section 4 Stages of Evaluation that the offeror must provide “an authorized FedRAMP Moderate Hosting Environment” and Section 5 Proposal Requirements Factor 1 indicates that the “offering must reside in an authorized FedRAMP Moderate hosting environment.” The AWS GovCloud is FedRAMP authorized High.

a. Will DOI accept an offering that is hosted on the AWS GovCloud environment as compliant?

b. Is the contractor name, signature and company UEI that of the offeror?

See question 17 above regarding “High” hosting environment concerns.

In reviewing FedRAMP marketplace, it appears that AWS GovCloud has both a moderate and high hosting environment. The Government would only be interested in the moderate environment.

Attachment B, The signature, contract name, and SAM UEI is for the offeror and not the FedRAMP host.

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response

20 4-5 Section 5: Proposal Requirements. Factor 1:

FedRAMP Moderate Hosting Authorization

SOW page 17 task area 4 “All Cloud Service Providers (CSP) must adhere to Federal Risk and Authorization Management Program (FedRAMP) standards. For any CSPs that are not fully FedRAMP authorized, those contractors must be able to demonstrate or support FedRAMP equivalent compliance. They must provide a copy of the equivalent information required, which will allow the Department to authorize and continually monitor. All FedRAMP equivalent activities and artifacts must be maintained in the DOI Governance, Risk and Compliance (GRC) tool. All FedRAMP equivalent activities and artifacts must be maintained in the Department GRC tool including the signed waiver.”

a. Define/Clarify what is meant by FedRAMP equivalent compliance.

b. Is StateRAMP ATO from other Federal, State Local agencies considered compliant in lieu of FedRAMP.

Note that Factor 1 deals with FedRAMP Moderate Hosting Authorization while Factor 3 Technical Capabilities deals with the application layer. As stated under Factor 3, “the offeror will provide a copy of the application layer FedRAMP Moderate approval status, in process, or equivalent status. For equivalent status of the application layer, the offeror must provide documentation of cloud security and authorization standards which meets FedRAMP guidelines that comply with rigorous security and privacy standards. “

The Government may choose to accept StateRAMP ATO depending on the documentation provided.

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response

21 4-5 Section 5: Proposal Requirements. Factor 1:

FedRAMP Moderate Hosting Authorization

Based on the guidance provided by FedRamp, PMO we’ve been advised that any agency (in this case DOI) may leverage the FedRAMP program for Reusing_Authorizations_for_Cloud_Products_Quick_Guide.pdf (fedramp.gov) to issue their own expedited ATO at the Moderate impact level, leveraging the existing completed package. And that while the offeror’s system components are validated to the High control baseline through their existing agency ATO, the DOI would not be subject to any controls beyond their own ATO's control baseline.

a. Will the DOI concur and consider acceptable a SaaS offering that currently holds an agency-issued ATO at the High impact level, and that is currently in the final review stage with the FedRAMP PMO awaiting Authorized status on the Marketplace?

See question 17 above regarding “High” hosting environment concerns.

Also see Amendment 0002 under section 5.

Note that Factor 1 deals with FedRAMP Moderate Hosting Authorization while Factor 3 Technical Capabilities deals with the application layer. As stated under Factor 3, “the offeror will provide a copy of the application layer FedRAMP Moderate approval status, in process, or equivalent status. For equivalent status of the application layer, the offeror must provide documentation of cloud security and authorization standards which meets FedRAMP guidelines that comply with rigorous security and privacy

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response

22 14 Section 7: Evaluation Factors (a)

“The Government will evaluate Factor 1 (Phase IA) first and determine if an offeror’s proposed solution will be hosted in an authorized FedRAMP Moderate Hosting Environment. This factor is a down-select as it is considered a Go/No-Go Factor. The Government will review the offeror’s Certification form as well as the FedRAMP.gov website to ensure that the Offeror’s proposed solution will be hosted in an authorized FedRAMP Moderate Environment under the Marketplace. It must show authorized with a Moderate rating no later than the closing date of the Phase I solicitation. This requirement is consistent with the SOW Paragraph 4.2 which states the following: “A SaaS [Software-as-a-Service] solution, to qualify under this contract, must have FedRAMP approval covering all critical layers including networking, storage, servers, virtualization, middleware, runtime, data, and applications. If a contractor offers a Platform-as-a-Service (PaaS) solution, it must be FedRAMP approved for networking, storage, servers, virtualization, middleware, and runtime layers.”

a. In this paragraph is the agency referring to demonstrate that the hosted environment is Authorized FedRAMP Moderate? Or that the Offeror’s solution is to be fully Authorized by the Phase 1 closing date?

b. Further, please clarify whether “in progress” FedRAMP is acceptable with appropriate offeror provided support services to conduct continuous monitoring/agency ATO.

Note that Factor 1 deals with FedRAMP Moderate Hosting Authorization while Factor 3 Technical Capabilities deals with the application layer.

Factor 1 (hosting environment) must be fully authorized by the submission date for Phase IA. As stated under Factor 3, “the offeror will provide a copy of the application layer FedRAMP Moderate approval status, in process, or equivalent status. For equivalent status of the application layer, the offeror must provide documentation of cloud security and authorization standards which meets FedRAMP guidelines that comply with rigorous security and privacy

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response

23 14 Section 7: Evaluation Factors (a)

Please confirm that FedRAMP Authorization, of Moderate or Higher, is required of the vendor at the time of contract award.

Note that Factor 1 deals with FedRAMP Moderate Hosting Authorization while Factor 3 Technical Capabilities deals with the application layer.

Moderate Hosting Environment is required with the submission of Phase IA, at time of solicitation closing.

Also see question 17 above regarding “High” hosting environment concerns.

As stated under Factor 3, “the offeror will provide a copy of the application layer FedRAMP Moderate approval status, in process, or equivalent status…” as part of their Phase II proposal submission.

24 14 Section 7: Evaluation Factors (a)

Please confirm that the system will need to host law enforcement data elements, such as critical evidential data in a highly sensitive case, at the FedRAMP High level.

This information can be posted in a FedRAMP Moderate Environment. It does not necessitate the need for a FedRAMP High Hosting Environment.

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response

25 14 Section 7: Evaluation Factors (a)

Per the guidance of the FedRAMP PMO, is a SaaS offering holding an agency issued ATO at the High impact level and in the final FedRAMP PMO review for Authorized status (FedRAMP Package ID FR2235965777) on the Marketplace a compliant solution? While the offeror’s system components are validated to the High control baseline through their existing agency ATO, the DOI would not be subject to any controls beyond their own ATO's Moderate control baseline.

Note that Factor 1 deals with FedRAMP Moderate Hosting Authorization while Factor 3 Technical Capabilities deals with the application layer.

In regards to the application layer, the Government would need to ensure that it is treated at the agency’s moderate level. See Question 17 above.

26 4-5;

217 to

Section 5: Proposal Requirements. Factor 2:

Technical Demonstration of Selected Functionality and Attachment C:

Memorandum Areas Of Focus

The RFP Section 5 Proposal Requirements Factor 2 indicates each firm will have 90 minutes to present the offered software solution, indicating that the demo “must demonstrate how the solution meets or exceeds the software function described in Technical Demo Memorandum – Areas of Focus (Attachment B).”

a. Please clarify that this is Attachment C.

b. Can DOI please extend the time allotted for the offeror to demo to be 120 minutes (2 hours) instead of 90 minutes?

See Amendment 0002 for correction on the Attachment number.

See Amendment 0002 for extension of time.

27 4-5;

217 to

Section 5: Proposal Requirements. Factor 2:

Technical Demonstration of Selected Functionality and Attachment C:

Memorandum Areas Of Focus

Would the DOI consider extending the demonstration time to allow for full functionality to be demonstrated, as well as an overview of the proposed implementation?

See Amendment 0002 for extension of time.

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response

28 4-5;

217 to

Section 5: Proposal Requirements. Factor 2:

Technical Demonstration of Selected Functionality and Attachment C:

Memorandum Areas Of Focus

Are all the functionalities provided within the Area of Focus for the 90 min demo equally weighted or are there higher weighted functionality that you would prefer the vendor to demonstrate?

See Amendment 0002 which extends the demo timeframe.

As indicated in Section 7 of the solicitation “…The Government will utilize the Technical Demonstration Memorandum – Areas of Focus (Attachment C) when evaluating the proposed system. Systems that demonstrate a higher quality of user experience and meets a greater depth and breadth of the areas in SOW Paragraph 5.0 will be provided a higher weight by the Government.”

29 4-5;

217 to

Section 5: Proposal Requirements. Factor 2:

Technical Demonstration of Selected Functionality and Attachment C:

Memorandum Areas Of Focus

“The questions/areas of focus listed below are mandatory. They were condensed from Section 5 of the Statement of Work and are provided to ensure that each competitor has an opportunity to communicate their solution benefits clearly and comprehensively during the software demonstration.”

We recommend the Government extend the allotted technical demonstration time from 90 minutes to 4 hours to enable enough time to address all the mandatory requirements.

Alternatively, the Government could further prioritize and/or pare down the mandatory areas of interest and general functionalities to be demonstrated.

Based on our extensive experience demoing our XXX product, it is not feasible to address the extensive list of mandatory requirements in Attachment C in such a short timeframe.

See Amendment 0002 for time extension

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response

30 4-5;

1-15 if Att C

Section 5: Proposal Requirements. Factor 2:

Technical Demonstration of Selected Functionality and Attachment C

There is a significant difference between the requirements presented in the SOW and the Attachment C Demonstration requirements regarding functionalities. For example:

SOW 5.17 Civil Processes, and Att. C #13 SOW 5.18 Permits and Licenses, and Att. C #14 SOW 5.19 US Fish and Wildlife, and Att. C #15 SOW, 5.4, eTicketing #29, and Att. C #6

To highlight a specific example of the significant differences between the PWS and Attachment C, section 5.1.7 Civil Process (pg 51-2), the main requirement says "The LE RMS will provide the capability to attach civil papers to be served." However, in the demo attachment C on (page 11 of 15), there are a number of functionalities related to civil processes that do not align with what is written in the PWS under the Civil Process section such as the "ability to record the disposition of all actions required by the order, including court-ordered eviction, the seizure of property, and collection of court-ordered fees; Documenting the service attempts and circumstances;

Generating an affidavit of service to the court on successful service or expiration of the order."

Should we assume the appropriate civil process and Permits/Licenses requirements in the PWS take precedence over what is written in the demo attachment?

See Amendment 0002 for revised Attachment C.

31 4-5; 5 of Att C

Section 5: Proposal Requirements. Factor 2:

Technical Demonstration of Selected Functionality and Attachment C, 3.

Standard External Data Exchanges and 4. Standard Internal Data Exchanges

Please clarify expectations for demoing the Standard External/Internal Data Exchanges. We recommend the Government evaluate the solution’s API specifications, integration, and extensibility capabilities generally, as offerors lack access to the source systems to demo the actual connectivity in-kind.

Offerors may demonstrate the ability to do Standard External/Internal Data Exchanges by demonstrating the extraction/importation of information from the system utilizing industry standards such as PDF, CSV, XML, GJXDM or Global JXDM.

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response

32 4-5; 7 of Att C

Section 5: Proposal Requirements. Factor 2:

Technical Demonstration of Selected Functionality and Attachment C, 4.

Reporting

“Electronic submission with external information sharing programs, including FWS RLE incidents”

Offerors do not have access to DOI systems or agency API libraries and therefore cannot feasibly be expected to demo these integrations for Phase IB.

We recommend the Government replace these specific integration demonstration requirements with a general requirement to demonstrate their solutions’ API specifications to evaluate the platform’s integration and extensibility capabilities.

(Note – the referenced Attachment C text is just one example of Phase IB integration demonstration requirements that are not feasible.)

See Amendment 0002 for corrections in the SOW and Attachment C.

As mentioned in question 31 above, the offeror should demonstrate the ability to do Standard External/Internal Data Exchanges through one or more of the industry standards.

33 4-5;

1-15 of Att C

Section 5: Proposal Requirements. Factor 2:

Technical Demonstration of Selected Functionality and Attachment C, General Functionalities

If the offeror’s approach includes integrating with select existing DOI systems for specific functionalities, we recommend the Government evaluate the integration framework, as offerors do not have access to agency systems or API libraries.

See question 31 above, the offeror should demonstrate the ability to do Standard External/Internal Data Exchanges through one or more of the industry standards.

34 15 Section 7: Evaluation Factors (c), Factor 2:

Technical Demonstration of Selected Functionality (Phase IB)

The Government will evaluate the likelihood of success and any potential risks of the demonstrated software. The Government will utilize the Technical Demonstration Memorandum – Areas of Focus (Attachment C) when evaluating the proposed system. Systems that demonstrate a higher quality of user experience and meets a greater depth and breadth of the areas in SOW Paragraph 5.0 will be provided a higher weight by the Government.”

Considering the extensive number of mandatory requirements in Attachment C, we recommend the Government allow the submission of accompanying technical documentation or artifacts for the Phase IB product demo that can be evaluated and would support a thorough evaluation of proposed solutions.

The Government is not electing to have additional information submitted outside of the Technical Demonstration.

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response

35 6 Section 5: Proposal Requirements. Phase II - Volume I, Section 1:

General

“This cover sheet will include the information listed below in letters A – P:”

Should there be an item “P” that is missing or was this a typo that should read letters A – O”?

See Amendment 0002 which corrects it to reflect “A-O.”

36 6-7 Section 5: Proposal Requirements. Phase II - Volume I, Section 2: SAM Registration

“A screenshot of the Offeror’s SAM registration page is acceptable evidence.”

From a Teaming and/or Prime-Sub aspect, would screenshots from both offerors be required or would the Prime/majority partner suffice?

We only require the screenshot from the prime contractor.

37 7 Section 5: Proposal Requirements. Phase II - Volume I, Section 3:

Representations and Certifications

“… each Offeror must complete and return with its proposal submission:…”

From a Teaming and/or Prime-Sub aspect, would Reps and Certs be needed from both offerors, or would the Prime/majority partner’s Reps and Certs suffice?

We only require the Reps and Certs from the prime contractor.

38 7 Section 5: Proposal Requirements. Phase II - Volume I, Section 3:

Representations and Certifications

This solicitation contains the following provisions that each Offeror must complete and return with its proposal submission:

FAR 52.204-24 – Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment (Nov 2021) FAR 52.212-3 – Offeror Representations and Certifications-Commercial Products and Commercial Services (Nov 2023)

FAR 52.212-3 is not provided in the solicitation.

Also, on page 18, it states “Offerors shall fill out the applicable provisions (included below and highlighted) and submit with their proposal.” Nothing is highlighted in our copy; we presume it is referring to the 2 FARs mentioned in the instructions.

Please indicate that you want only the two identified in the instructions included in the proposal.

FAR 52.212-3 is included by reference under Section 8 in the table on page

18. A full-text version of the provision is available at https://www.acquisition.gov/far which you can copy.

See Amendment 0002 which removed the first sentence in Section 8.

Only the provisions listed in Section 5 under Volume I, Section 3 are required to be submitted with the proposal.

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response

39 7 Section 5: Proposal Requirements. Phase II - Volume I, Section 3:

Representations and Certifications

Does this instruction/requirement apply to FAR Provision 52.201-1- Acquisition 360: Voluntary Survey?

See Amendment 0002 and question 38 above.

40 6 Section 5: Proposal Requirements. Phase II Proposal - Table

Given the 30-page limits for Factor 3: Technical Capabilities, and Factor 4:

Management Approach, would the government please confirm vendors do not need to provide line-by-line response to SOW Section 5, SOW Section 6, SOW Section 7?

Offerors should review Section 5 for Phase II Volume I, Section 5: Factor 3

– Technical Capabilities and Volume I, Section 5: Factor 4 for Management approach. It specifically mentions the areas of interest that should be included in the proposal.

41 6 Section 5: Proposal Requirements. Phase II Proposal - Table

Factor 5: Company Experience (6 pages)

Since instructions indicate the use of three (3) past performance per contractor, would the government please increase the page count to two (2) pages per past performance, as opposed to six (6) pages total?

The Government is providing up to six pages for up to the three examples of Company Experience. Firms may choose how they wish to allocate the use of those pages

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response

42 8 Section 5: Proposal Requirements. Phase II - Volume I, Factor 3 – Technical Capabilities;

SOW Para 4.2 Task Area 2:

Application and Data Management of FedRAMP Moderate

The offeror will provide a copy of the application layer FedRAMP Moderate approval status, in process, or equivalent status. For equivalent status of the application layer, the offeror must provide documentation of cloud security and authorization standards which meets FedRAMP guidelines that comply with rigorous security and privacy standards.

Currently (as of 2/16/24), there seems to be a limited, if any, FedRAMP authorized CAD solutions within the FedRAMP Marketplace. Will the government permit supplementary plug-in components hosted within a FedRAMP authorized environment (i.e., AWS)?

What is difference between the FedRAMP Moderate approval status of the application layer and hosting environment?

Will the Government provide details for what constitutes an equivalent status for an in- progress FedRAMP certification?

See Section 4.2 of the SOW which demonstrates the SaaS and PaaS Offerings. See question 20 above.

As long as the plug-in are part of the system on the FedRAMP environment, that should be acceptable. We do not know what you mean by supplementary plug-in.

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response

43 8 Section 5: Proposal Requirements. Phase II - Volume I, Factor 3 – Technical Capabilities;

SOW Para 4.2 Task Area 2:

Application and Data Management of FedRAMP Moderate

“The offeror will provide a copy of the application layer FedRAMP Moderate approval status, in process, or equivalent status. For equivalent status of the application layer, the offeror must provide documentation of cloud security and authorization standards which meets FedRAMP guidelines that comply with rigorous security and privacy standards.”

The requirement to provide FedRAMP approval status in Phase II is duplicative of the Phase IA portion.

We recommend that this requirement be removed from the Phase II Volume I section to remove duplication, or that this requirement be removed from the 30-page page limit.

Note that Factor 1 deals with FedRAMP Moderate Hosting Authorization while Factor 3 Technical Capabilities deals with the application layer.

They are not necessarily the same. It depends on whether it is a SaaS or PaaS solution.

See Amendment 0002 for updated in Section 5 regarding page limitations for Factor 3.

44 9 Section 5: Proposal Requirements. Phase II - Volume I, Section 5: Factor 3 – SOW Para 4.2 - Task Area 2: Hosting with Application and Data Management Services

“Offerors will also discuss their ability to meet, and or exceed, the minimum Government reliability requirements; notification strategies for maintenance and patching; scalability of users and data storage; security of Government data; the systems ability to permit integration with other potential systems and tools for DOI law enforcement personnel to maximize efficiency and minimize manual data entry; approach and frequency of anticipated upgrades and enhancements; and strategy to ensure a less than four (4) hour recovery time objective as part of their Continuity of Operation Plan.”

Do all components of the system require the same RTO or can elements such as the analytical layer have a greater RTO?

It should all be the same.

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response

45 Section 7: Evaluation Factors, (c) Factor 3:

Technical Capabilities (Phase II)

“The Government will evaluate the Offeror’s proposal to determine the likelihood of success and risk of failure associated with their proposed solution to meet the Government’s requirements for the NIST 800-53 DOI, CJIS compliance requirements, FedRAMP Moderate approval at the Application layer, and Section 508 Compliance.”

a. Will the agency evaluate equally for PaaS offering? Factor 3 only implies SaaS. Please clarify and update the factor 3.

This requirement would be relevant and evaluated for both SaaS and PaaS offerings.

46 9 Section 5: Proposal Requirements. Phase II - Volume I, Factor 4, Management, SOW Para 4.3

DOI says the vendor will “provide a solution response in two hours or less by email and phone.” Can the government clarify whether the customer should expect a solution or a response in two hours?

See Amendment 0002 SOW Changes in paragraph 4.3.

47 10-12 Section 5: Proposal Requirements. Phase II - Volume I, Factor 5;

Company Experience

There is no preceding Section 7. Please confirm Factor 5 should be Section 7, correct?

See Amendment 0002 for corrections.

48 10-12 Section 5: Proposal Requirements. Phase II - Volume I, Factor 5;

Company Experience and Factor 6- Past Performance

Would the DOI OLES please confirm that the past performance write-ups are provided within Section 8, and that PPQs are provided as the response within Section 9?

See Amendment 0002 for corrections.

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response

49 10-11 Section 5: Proposal Requirements. Phase II - Volume I, Factor 5;

Company Experience and Factor 6- Past Performance

It states that “Projects that are similar in size to anticipated orders under this IDIQ are projects with individual values of $3,000,000.00 per year or greater."

Although most local law enforcement jurisdictions are smaller than federal jurisdictions, they still represent a very relevant reference to DOI’s LERMS requirement. The contract value is driven by number of licenses and not the functionally required by the customer. Will the government consider lowering the similar size standard threshold to $1M/year in order to give these law enforcement references equal value to larger references?

The Government will evaluate any projects provided in response to this solicitation. As noted in Factor 5 a, “…The Government will provide higher weight to project(s) that are more similar in size, scope, and complexity, more recently performed, and valued at $3,000,000.00 per year or greater…”and in Factor 5, “…There are three aspects to the past performance evaluation: recency, relevancy (including context of data, and quality (including general trends in contractor performance and source of information)…”

50 11-12 Section 5: Proposal Requirements. Phase II - Volume I, Factor 6 - Past Performance. Paragraph 4

The Offeror and/or subcontractor will provide existing documentation of the reference’s opinion of Offeror’s performance of similar projects by including a Past Performance Questionnaire (PPQ) for up to three (3) projects that are similar in size and scope and were awarded in the last five (5) years from date of the Phase I solicitation issuance. Will the Government allow the subcontractor to provide all three (3) Past Performance references?

Yes.

51 11-12 Section 5: Proposal Requirements. Phase II - Volume I, Factor 6 - Past Performance. Paragraph 4

Will the Government allow Past Performance references from the prime Offeror from projects where the Offeror was the key subcontractor?

Yes

52 11-12 Section 5: Proposal Requirements. Phase II - Volume I, Factor 6 - Past Performance. Paragraph 4

Per the preferred timeline stated in Section 1.1. of the RFP, Would the DOI consider project proposals that reflected past experiences of successful implementations that exceed 6 months? With our extensive knowledge and background, a complete end-to-end implementation in 6 months cannot guarantee a successful implementation.

See Amendment 0002 SOW Para 1.1 for changes. Yes.

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response

53 11-12 Section 5: Proposal Requirements. Phase II - Volume I, Factor 6 - Past Performance.

Can the government please clarify the content required for Volume 1, Section 9: Factor 6 - Past Performance, and how it differs from Volume 1, Section 8?

See Amendment 0002 Section 5 for updated section numbers.

When providing the content, please consider how the Government evaluates the two factors. Under the company experience factor, the Government examines the degree to which an Offeror had experience performing similar projects; under the past performance factor, the Government considers the quality of an Offeror's performance history in regards to projects submitted under company experience as well as others based upon CPARS.

54 11-12 Section 5: Proposal Requirements. Phase II - Volume I, Factor 6 - Past Performance.

It states that “Factor 6 - Past Performance” is “Volume I, Section 9.”

Please confirm Factor 5 should be Section 8, correct?

See Amendment 0002 for corrections.

55 1, 12- 13, Attac hment 2 and A.

Section 5: Proposal Requirements. Phase II – Volume II, Factor 7 – Price

Attachments 2 and A. Task Area 5: Additional Functionality and Customizations

Are we able to propose additional Labor Categories?

No

56 12 Section 5: Proposal Requirements. Phase II – Volume II, Factor 7 – Price

This should read Attachment A vice B. See Amendment 0002 for corrections.

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response

57 12 Section 5: Proposal Requirements. Phase II – Volume II, Factor 7 – Price

Since Attachment 2 is an embedded form, should respondents create a similar form on a spreadsheet? Perhaps it would be easier to state something like "Recreate Attachment 2 as a separate, unlocked Excel Compatible Spreadsheet) and submit."

The Government made available a fillable Attachment 2 and A pricing spreadsheet is available for download at SAM.gov and is titled “A04_SOW_- _Att2___A_Pricing_(Final)(20240110 ).xlsx

58 12 Section 5: Proposal Requirements. Phase II – Volume II, Factor 7 – Price

Please confirm that all offerors must bid the same hours per the Sample Project in Attachment A.

Yes

59 1, 12- 13, Attac hment 2 and A.

Section 5: Proposal Requirements. Phase II – Volume II, Factor 7 – Price

Will the vendor be able to propose additional labor categories at the task order level for future customization? For example, if enhancements are built in the future, we would recommend a QA Specialist to test changes before DOI OLES User Acceptance Testing (UAT).

No.

SOW Questions (Attachment 1) 60 ii, 42-

43, 60-

TOC: 5. System Requirements

SOW:5. System Requirements

In the SOW’s Table of Contents (TOC) and throughout Section 5. System Requirements within the SOW doc, there are multiple subsections duplicated (i.e.

Will the Government please correct any duplicate Task numbers listed in order to avoid improper references made through out a formal proposal?

See Amendment 0002 SOW for changes.

61 2 General Information, 1.1 Purpose

Please elaborate on how the six-month estimate was arrived at. This is also discussed on page 16 of the LE RMS SOW as part of Task Area 1. It should be noted that this implementation target is a significant area of schedule and cost risk for potential bidders.

See Amendment 0002 SOW Para 1.1 for changes.

We based the information based on putting similar systems in place at another agency, but we have provided an extension in the Amendment.

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response

62 2 General Information, 1.1 Purpose

What happens to the program if there is not a replacement in 6 months; a.

is/are the current system(s) being sunset?

We are not sunsetting the current systems until the new one is in place.

63 2 General Information, 1.1 Purpose

Will the Government accept a timeline that is greater than six months? Yes. Please see Section 7: Evaluation Factors under Factor 4: Management Approach which indicate under SOW Para 4.1 “Offerors that provides a realistic transition and shorter transition period may be weighted higher than a lengthy transition period by the Government. “

64 2 General Information, 1.1 Purpose

Can the government clarify if deployment should occur for all bureaus within 6-months or if the 6-month timeline is for specific bureaus? If for specific bureaus, please confirm which ones.

See Amendment 0002 SOW Para 1.1 for changes.

It should be for all bureaus.

65 2 General Information, 1.1 Purpose

The Government states: "As the Government anticipates a COTS system, it is anticipated that the entire solution will require six months or less for installation, implementation, transition of and cleanup of old database records to the new system, testing of the new system, and training for law enforcement personnel." Does the Government anticipate any Discovery? If so, is Discovery included in this timeline?

See Amendment 0002 SOW Para 1.1 for changes.

The Government does not understand what you mean by the term discovery.

We do anticipate that the entire transition would occur during this period.

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response

66 2 General Information, 1.1 Purpose

The SOW states, “The Government anticipates that the new system will take six months or less to deploy” What factors are leading to the government making this assumption? Would DOI consider extending the timeline if the right solution required it?

See Amendment 0002 SOW Para 1.1 for changes.

Please see Section 7: Evaluation Factors under Factor 4: Management Approach which indicate under SOW Para 4.1 “Offerors that provides a realistic transition and shorter transition period may be weighted higher than a lengthy transition period by the Government.” Also see answer to question 61 above.

67 2 General Information, 1.1 Purpose and

The scope and complexity of the requirements suggest that multiple cloud solutions will be required to meet the unique needs of DOI LE offices described in this RFQ. Configuration or customization will be required. Has DOI considered that this may not be achievable in 6 months?

See Amendment 0002 SOW Para 1.1 for changes.

Please see Section 7: Evaluation Factors under Factor 4: Management Approach which indicate under SOW Para 4.1 “Offerors that provides a realistic transition and shorter transition period may be weighted higher than a lengthy transition period by the Government.

68 2 General Information, 1.1 Purpose

Does DOI anticipate that a COTS RMS solution will meet all the needs in the

SOW?

Yes.

69 2 General Information, 1.1 Purpose

The solution can be integrated with other COTS products to meet the specific LE RMS requirements. DOI’s OLES Program Needs

What are the known COTS products to be integrated with?

It depends on what the Offerors approach is to the solution. Offerors will need to evaluate the market to determine how to meet the requirements of the SOW.

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response

70 3 General Information, 1.1 Purpose

“Finally, information collected by DOI needs to be shared among the bureaus, and with other federal agencies such as the Federal Bureau of Investigation (FBI) and the Department of Homeland Security (DHS).”

Are the interfaces to FBI and DHS already operational? Are there any new interfaces to be developed?

The solution should demonstrate the ability to do Standard External/Internal Data Exchanges through one or more of the industry standards and be able to export to their systems.

71 2-4 General Information, 1.1 Purpose

The Department of the Interior's Office of Law Enforcement Services has a very important mission with a unique coverage of jurisdiction and responsibilities. Would DOI OLES be open to a COTs solution that provides immediate CMS, RMS and Investigation value, while co-enhancing the JMS Component to be bespoke for DOI's use case, a JMS designed and built for them based on their users needs. Or is the expectation for all of the needed functionality to be live on Day 1?

The Government is anticipating a solution that will be functional on Day 1.

Page Section, Paragraph or Attachment

Question/Comment/Clarification Answer/Response

72 4 General Information, 1.2 DOI’s Current Solution

Details of over old legacy system o What system is used?

O Is this customized?

O How many records are being moved?

O Will there be open tickets?

Old Legacy Systems:

LEMIS is a custom system built on Microsoft SQL Server with some custom code built on .net.

IMARS is a commercial product called NicheRMS and they may have done some customization based on user requests.

How many records are being moved?

See Question 82

Open Tickets:

We are not sure we understand the question. But if the question is whether there is an open ticket in IMARS or LEMIS and whether you are responsible, you would not be.

73 4 General Information, 1.2 DOI’s Current Solution

IMARS is now operational and allows…