A14_MR_25R0043_Questions_responses_2.pdf

140D0425R0043 T&A RFI Question/Responses

Questions DOI Response Is there a previous contract associated with this RFI, and if so, please provide the incumbent contractor name, contract number, and contract value?

No. This is a new initiative to modernize existing functionality

What technologies or platforms does your solution utilize?

Described in the "Legacy Systems" section of the Request for Information (RFI). Refer to page 3.

Are there integration capabilities with existing systems? If so, how does the integration work?

A combination of integration tools and techniques are used across systems including: flat files, Application Programming Interface (APIs), direct connections, etc.

In most cases integration is bi-directional in that systems both send and receive data.

What is your process for handling system updates and bug fixes?

There are multiple defined process to handle system updates and bug fixes depending on which part of the system is being addressed. We have a comprehensive Configuration Management plan for assessing, updating code base and testing for enhancements as well as bug fixes. For system updates we partner closely with our Office of the Chief Information Officer (OCIO) who provides hosting/networking support for our applications to ensure patching is implemented timely with little disruption to system availability.

How do you ensure the security of data within your solution?

Our system has a defined Continuous Monitoring Plan (ConMon) plan for continuous monitoring and addressing detected vulnerabilities.

What data backup protocols do you have in place?

All hosts are backed up on a nightly basis.

All databases are backed up on a nightly basis with periodic archive/transaction log backups throughout the day.

Backups are generally scheduled to run between the hours of 10 P.M. and 6 A.M. local time.

Backup data is written to disk-based storage devices.

Production backup data is also replicated to an offsite storage device.

All backup data is immutable and encrypted (both in transit and at rest).

Can you provide details on how your solution mitigates potential security risks?

Our system has a defined ConMon plan for continuous monitoring and addressing detected vulnerabilities.

What steps are taken to ensure your solution complies with ongoing audit and reporting requirements?

Completion of annual Statement on Standards for Attestation Engagements (SSAE-18) audit

“to ensure flexibility, scalability, and efficient data management.” Please explain what metric and level of flexibility, scalability and efficient data management are desired.

There is no one metric. As a shared service provider servicing multiple different agencies, we need the ability to quickly implement new client agencies (scale up), implement regulatory changes into the production environment within strict timeframes (flexibility), update code base with user enhancements (flexibility), maximize use of configuration settings to account for agency-unique needs (flexibility) and adhere to specific data standards (data efficiency/Office of Personnel Management (OPM) Human Capital Business Reference Model (HCBRM).

“which will increase the total user population.”

What is the estimated user population?

Current population is approximately 166,000 users.

However, as a shared service provider we need the flexibility to quickly migrate new clients onto the system. Agency user base can vary in size from just a few users to over 100,000.

Section 3 – Rough Order of Magnitude -While stated as a hypothetical situation, it sounds like the Government has been impacted when a vendor has exceeded the proposed budget and forced a cost recovery burden on Payroll transactions. Is there an IBC customer board that must first approve justifications for Change Orders that may incur additional fees beyond the approved budget prior to work commencing?

In a formal contractual relationship, Interior Business Center (IBC) has an authorized Acquisitions Line of Business (LOB) that would manage all contractual work according to the Federal Acquisition Regulation (FAR). Any work being requested outside of the existing defined scope of work would follow a formal contractual process to proper modify the contract and authorize the work before being performed.

From a systems Operations and Maintenance (O&M) perspective, it is expected frequent regulatory changes will be required to be implemented into the production environment within strict timeframes. In addition, we have implemented a formal Client User Group through which agencies can submit, vote, and prioritize agency-requested system enhancements across the entire code base. Again, there is an expectation, in a normal O&M environment, to incorporate several of these enhancements throughout the year. IBC would be most interested in learning how industry streamlines the enhancement process to quickly bring those solutions into a production environment and minimize any enhancement backlog.

Section 3 – Rough Order of Magnitude, Bullet #2 Annual Operations and Maintenance Costs

- How much historical data should be migrated into the new system?

Due to the nature of the data and the need to be able to access historical data, all data will need to be accessible. At this time we estimate that to be Roughly

3.5 Terabytes (3438 GB). However, we would be

interested in learning of various data migration/storage/accessibility (real-time and/or near real-time) options.

Has funding been identified and confirmed for this initiative?

There is a process for requesting and securing funding within the Government. Part of the purpose of this RFI is to gain a better understanding of the funding needed to procure, implement and maintain (post migration) a new solution so funding can be secured for a future contracting action.

Requesting clarification on the government’s expectations regarding historical data conversion and storage.

Specifically, could you provide guidance on the volume and timeframe of historical data that would need to be converted and retained in the new system? Understanding these requirements will help us assess data migration needs and storage considerations.

Due to the nature of the data and the need to be able to access historical data, all data will need to be accessible. At this time we estimate that to be Roughly

3.5 Terabytes (3438 GB) . However, we would be

interested in learning of various data migration/storage/accessibility (real-time and/or near real-time) options.

Do you require shift swapping and shift bidding?

At this time this is not a requirement but the purpose of this RFI is to gain an understanding of the full capabilities of industry solutions.

Please say Yes or No if you require the ability to capture time entry using each of the following methods o Mobile device o RFID ** o Biometric o Kiosk

As a shared service provider, we have clients with many different needs and requirements for how they will utilize a solution. In addition, we don't know the requirements of potential future clients or how regulatory security requirements might change so we would like to understand all the capabilities offered by industry. Currently we have a requirement for mobile capabilities, Personal Identity Verification (PIV), Multi-factor authentication (MFA)/Single Sign-on(SSO)

Do you have any advanced scheduling requirements such as scheduling based on skills, certifications, licenses, etc? If yes, please elaborate in detail.

At this time this is not a requirement but the purpose of this RFI is to gain an understanding of the full capabilities of industry solutions.

Do you charge time out to unique qualifiers in addition to different cost centers, projects, activities, (ex, road mile markers)? If yes, please elaborate in detail.

o Ability for team members to clock-in and out with the functionality below:

o With and without selecting project/cost code details as specified o Include start/stop times for breaks, lunch etc o Prevent clocking in/clocking out via geolocation o Geolocation requirements need to be beyond city state/ latitude & longitude (ex street name)

As a shared service provider, we have clients with many different needs and requirements for how they will utilize a solution. In addition, we don't know the requirements of potential future clients so we would like to understand all the capabilities offered by industry.

What are the current pain points with Time & Attendances recording?

508 Compliance, performance testing, and other areas that OCIO may have outlined previously. Speed to implement regulatory changes. Having the ability to accomplish system admin on functional side. Admin configuration dashboard. Client configuration dashboard, possibly, very limited access to routine modifications.

Do you use Geofencing?

At this time this is not a requirement but the purpose of this RFI is to gain an understanding of the full capabilities of industry solutions.

If clock terminals are used, is there a common type of device?

At this time this is not a requirement but the purpose of this RFI is to gain an understanding of the full capabilities of industry solutions.

Is forecasting and shift planning common within locations? If so, what software is used to do this?

At this time this is not a requirement but the purpose of this RFI is to gain an understanding of the full capabilities of industry solutions.

If forecasting is carried out, how is future demand predicted?

At this time this is not a requirement but the purpose of this RFI is to gain an understanding of the full capabilities of industry solutions.

When employees record time do they record it against cost centers, projects, maintenance orders and other cost objects?

As a shared service provider, we have clients with many different needs and requirements for how they will utilize a solution. In addition, we don't know the requirements of potential future clients so we would like to understand all the capabilities offered by industry.