BOP_QA_List_.pdf

15BCMS26Q70000005

Vendor Questions and Answers

A. Closed-Gap Artificial Intelligence System, Artificial Intelligence Restrictions, and Large Language Model (LLM) Requirements

1. Section 6.0 requires a 'closed-gap artificial intelligence (AI) system' and prohibits public or open LLMs and transmission of Bureau of Prisons (BOP) data to third-party providers.

Would the Government confirm that (a) a self-contained analytical environment operated on contractor-controlled hardware with no external data transmission satisfies this requirement, and (b) classical statistical or machine-learning methods and rules-based analytics are acceptable as the AI system?

Answer: (a) Yes. (b) Yes.

2. Does the restriction prohibit open-weight LLMs (for example, Llama or Mistral) even when fully isolated and offline? Answer: No. Or does it prohibit only public or hosted LLM services? Answer: Yes. Is a locally hosted open-weight model acceptable? Answer: Yes.

3. Please define the term 'closed-gap AI.' Must models or weights be proprietary and closed-source? Is a generative LLM mandatory? Answer: A generative Large Language Model (LLM) is not mandatory. Contractors may propose any AI or analytical approach that best satisfies the functional and performance requirements. Solutions may include deterministic rules-based methods, traditional machine learning, statistical models, anomaly detection, or generative AI, provided the proposed approach effectively identifies potential overpayments and meets all applicable security, privacy, and performance requirements.

Answer: It must be isolated and not connected to the internet.

4. Would deterministic analytics such as Python, pandas, or Structured Query Language (SQL) satisfy the closed-gap AI requirement if no external AI services are used?

Answer: Yes.

5. Please confirm that if no LLM is provided under the contract, the Department of Justice (DOJ) Form DOJ-09(d) disclosure requirement is not triggered. What is the required scope and format?

Answer: If you are not going to using an LLM the contractor would only be required to propose any AI or analytical approach that best satisfies the functional and performance requirements. Solutions may include deterministic rules-based methods, traditional machine learning, statistical models, anomaly detection, or generative AI, provided the proposed approach effectively identifies potential overpayments and meets all applicable security, privacy, and performance requirements.

6. Would a contractor-hosted AI model using Federal Information Processing Standard (FIPS) Publication 140-2 encrypted infrastructure satisfy closed-gap requirements when no BOP data is transmitted externally? Which provision governs if Section 2.0 or Section 6.0 conflicts with Request for Quotations (RFQ) Section 1.5?

Answer: FIPS 140-2 would not satisfy closed-gap requirements.

7. Please confirm that a deterministic rules-based system combined with statistical machine-learning models operating on contractor-controlled, non-networked hardware with no external data transmission satisfies the closed-gap AI system requirement.

Answer: Yes.

8. AI architecture: Does the requirement permit locally hosted inference in an isolated environment? Answer: No. Would Amazon Web Services (AWS) Government Cloud or AWS Bedrock be permissible when configured for zero-data-retention and no vendor training, or must all inference occur only on contractor-controlled local models?

9. Answer: No.

10. SOW §2.0 requires a 'closed-gap' AI system and states that 'no public or otherwise open LLM shall be used.' Does this prohibit only publicly-hosted models or also self-hosted open-weights models in an isolated contractor environment?

Answer: No. Closed-gap here is referring to where the inference occurs, not whether model weights are publicly published. External is not permissible, whereas internal (local-hosted) is acceptable.

11. Open-weight vs. closed-source AI models. Section 6.0 prohibits public or open LLMs.

Does this mean open-weight models are prohibited even when hosted locally, or only public/hosted LLM services?

Answer: Only public/hosted LLM services are prohibited.

B. Analysis Environment, Remote Work, Information Technology Development Division (ITDD) Requirements, and Authority to Operate (ATO)

12. Please clarify whether a formal ATO is required for an air-gapped contractor-owned analytical environment that is fully offline and not connected to any DOJ network.

Answer: No, the BOP will issue an authority to use (ATU) which requires vendor to prove current industry certification such as ISO 27001 or compliance with HIPAA, NIST 800-53, and complete a security questionnaire illustrating the security controls in place to protect BOP data. Additionally, the vendor will be required to sign an Information Exchange Agreement (IEA) as recommended by NIST 800-47 Rev 1.

13. Does BOP intend for processing to occur on BOP-issued equipment within its authorization boundary, or on contractor-owned systems requiring a separate ATO? If an ATO is required, when does the sixty-day performance period begin?

Answer: No, the BOP will issue an authority to use (ATU) which requires vendor to prove current industry certification such as ISO 27001 or compliance with HIPAA, NIST 800-53, and complete a security questionnaire illustrating the security controls in place to protect BOP data. Additionally, the vendor will be required to sign an Information Exchange Agreement (IEA) as recommended by NIST 800-47 Rev 1.

14. Please clarify the intended performance model given DOJ policies requiring Government Furnished Equipment (GFE) and ATO versus solicitation sections permitting remote work using contractor-provided commercial AI tools.

Answer: The BOP will issue an authority to use (ATU) which requires vendor to prove current industry certification such as ISO 27001 or compliance with HIPAA, NIST 800-53, and complete a security questionnaire illustrating the security controls in place to protect BOP data. Additionally, the vendor will be required to sign an Information Exchange Agreement (IEA) as recommended by NIST 800-47 Rev 1.

15. Please confirm whether full BOP ATO is required, or whether a National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 compliance attestation or Federal Risk and Authorization Management Program (FedRAMP) documentation is sufficient.

No, the BOP will issue an authority to use (ATU) which requires vendor to prove current industry certification such as ISO 27001 or compliance with HIPAA, NIST 800-53, and complete a security questionnaire illustrating the security controls in place to protect BOP data. Additionally, the vendor will be required to sign an Information Exchange Agreement (IEA) as recommended by NIST 800-47 Rev 1.

16. Please confirm that the entire effort may be performed remotely without access to the BOP network.

Answer: Yes.

17. Security standards applicability: Do Statement of Work (SOW) Section 14.0 and Appendix A requirements apply to contractor-hosted offline analysis? If not, which security standards apply, including FIPS 140-2 encryption and data destruction?

Answer: Yes, data at rest must be cryptographically secured and destroyed upon completion of the contract. The use of FIPS 140-3 validated cryptographic modules reduces the risk of unauthorized disclosure by ensuring that encryption protecting government information has been independently validated in accordance with federal cryptographic security standards.

18. For a one-time sixty-day analysis performed on a contractor workstation that is offline and not connected to the BOP network, will the full ATO or Authority to Test (ATT) process apply? How should this be sequenced against the sixty-day performance period?

Answer: No, a full ATO will not be required. The BOP will issue an authority to use (ATU) which requires vendor to prove current industry certification such as ISO 27001 or compliance with HIPAA, NIST 800-53, and complete a security questionnaire illustrating the security controls in place to protect BOP data. Additionally, the vendor will be required to sign an Information Exchange Agreement (IEA) as recommended by NIST 800-47 Rev 1.

19. Operating model: Will the claims comma-separated values (CSV) file be processed on GFE or transferred to a contractor workstation? How will the Government transfer the dataset and receive deliverables?

Answer: Justice Enterprise File Sharing (JEFS) system will be used to transfer the csv file to the vendor for analysis on vendor equipment. Deliverables can be returned utilizing the same system.

20. Will BOP provide an authorized computing environment for contractor analysis?

Answer: No.

21. If contractor-hosted processing is required, please identify required ATO controls, FedRAMP levels, FIPS requirements, independent assessment requirements, data-transfer mechanisms, and Information System Security Officer (ISSO) support across all project stages.

Answer: It will not be required because the BOP will be issuing an ATU.

22. Must the firm-fixed price include establishment of a new ATO and independent assessment, or may the contractor inherit controls from a BOP-provided environment?

Answer: The system will be hosted outside of the BOP and will be issued an authority to use (ATU) which requires vendor to prove current industry certification such as ISO 27001 or compliance with HIPAA, NIST 800-53, and complete a security questionnaire illustrating the security controls in place to protect BOP data. Additionally, the vendor will be required to sign an Information Exchange Agreement (IEA) as recommended by NIST 800-47 Rev 1.

23. Security posture: For off-site, de-identified analysis with no egress and full purge, does full A&A / ATO / FISMA / FedRAMP apply, or is the operative bar the C-SCRM self-assessment and AI disclosure?

Answer: BOP will submit SCRM assessment request to DOJ for review and approval.

Additionally, AI use case will be submitted to DOJ for review and approval.

24. GovCloud/FedRAMP applicability: Please confirm whether Section 14.0 applies only to systems deployed in BOP cloud environments or also to contractor-hosted systems with no interconnection.

Answer: The system will be hosted outside of the BOP and will be issued an authority to use (ATU) which requires vendor to prove current industry certification such as ISO 27001 or compliance with HIPAA, NIST 800-53, and complete a security questionnaire illustrating the security controls in place to protect BOP data. Additionally, the vendor will be required to sign an Information Exchange Agreement (IEA) as recommended by NIST 800-47 Rev 1.

25. Are there any minimum infrastructure certification requirements (e.g., FedRAMP) applicable to contractor-owned, non-interconnected AI/analytical infrastructure used solely to process Government-furnished data off-site, consistent with Section 5.0 of the

SOW?

Answer: The system will be hosted outside of the BOP and will be issued an authority to use (ATU) which requires vendor to prove current industry certification such as ISO 27001 or compliance with HIPAA, NIST 800-53, and complete a security questionnaire illustrating the security controls in place to protect BOP data. Additionally, the vendor will be required to sign an Information Exchange Agreement (IEA) as recommended by NIST 800-47 Rev 1.

26. Permissible AI system. SOW §2.0 requires a “closed-gap” AI system and states that “no public or otherwise open LLM shall be used.” Does the Government intend this to prohibit only publicly-hosted or externally-accessible models, or also self-hosted open-weights models operated entirely within the Contractor’s isolated, no-egress environment?

Answer: Only self-hosted, open-weights models operating entirely within an isolated, contractor-controlled environment with no external connectivity or data egress would be permitted.

27. We would appreciate confirmation on whether the SOW's prohibition on "public or otherwise open" LLMs is intended to:

(a) prohibit models that are open-source/open-weight (e.g., publicly released model architectures and weights, regardless of hosting method), even when self-hosted in a fully isolated, non-internet-connected environment with no data transmitted externally; or

(b) prohibit only models accessed via public/hosted third-party services (e.g., commercial cloud AI APIs), regardless of whether the underlying model is open-weight or closed-weight.

Answer: Only self-hosted, open-weights models operating entirely within an isolated, contractor-controlled environment with no external connectivity or data egress would be permitted.

28. GovCloud/FedRAMP applicability to contractor-hosted infrastructure.

Section 14.0 (Technical Standards for Acquisition of BOP IT Systems and Peripherals) specifies that applications intended for deployment in the BOP's cloud environment shall be hosted in AWS GovCloud (East or West), and references FedRAMP authorization and Authority to Operate (ATO) requirements for systems connecting to BOPNet.

Answer: The system will be hosted outside of the BOP and will be issued an authority to use (ATU) which requires vendor to prove current industry certification such as ISO 27001 or compliance with HIPAA, NIST 800-53, and complete a security questionnaire illustrating the security controls in place to protect BOP data. Additionally, the vendor will be required to sign an Information Exchange Agreement (IEA) as recommended by NIST 800-47 Rev 1.

29. Does the GovCloud/FedRAMP/ATO requirement in Section 14.0 apply to a contractor-hosted analytical system that does not connect to or interconnect with any BOP network or information system, or does it apply specifically to systems intended for deployment within or connection to the BOP's own cloud/network environment?

Answer: The system will be hosted outside of the BOP and will be issued an authority to use (ATU) which requires vendor to prove current industry certification such as ISO 27001 or compliance with HIPAA, NIST 800-53, and complete a security questionnaire illustrating the security controls in place to protect BOP data. Additionally, the vendor will be required to sign an Information Exchange Agreement (IEA) as recommended by NIST 800-47 Rev 1.

30. For this engagement: (a) will performance occur entirely within the contractor's environment, and will the resulting order specifically authorize contractor networks; (b) for the Authority to Operate required for the contractor's environment, what assessment and authorization process and timeline does the Bureau anticipate relative to award and the 60-day period of performance?

Answer a: Yes Answer b: The system will be hosted outside of the BOP and will be issued an authority to use (ATU) which requires vendor to prove current industry certification such as ISO 27001 or compliance with HIPAA, NIST 800-53, and complete a security questionnaire illustrating the security controls in place to protect BOP data. Additionally, the vendor will be required to sign an Information Exchange Agreement (IEA) as recommended by NIST 800-47 Rev 1.

31. Please confirm that commercial, closed-source models served through hosted model services on FedRAMP-authorized cloud service providers (e.g., AWS Bedrock, Google Cloud Vertex AI) are acceptable under this requirement, where BOP data remains within the contractor's environment on a FedRAMP-authorized cloud service provider and is not retained by, disclosed to, or used to train models by the model developer or the cloud provider. Separately, where a proposed model is a commercial product, will the developer's and cloud provider's published model and system cards satisfy the corresponding DOJ-09 disclosure items, with the contractor supplying the system-level artifacts (architecture, data workflows, governance)?

Answer: No

32. DOJ-05 Section V requires a C-SCRM Plan prepared per NIST SP 800-161, Appendix E, with a self-assessment. Should the C-SCRM Plan be submitted with the quote, or as a post-award deliverable in connection with the C-SCRM review and authorization process?

Answer: Yes, BOP will submit a SCRM request to DOJ for review and approval.

33. Clause DOJ-03 provides that contractor employees will occupy Public Trust Positions, with risk category and investigation tier determined by the Security Programs Manager.

Given that performance is anticipated entirely within the contractor's environment on a Government-furnished dataset, with no access to BOP networks, systems, or facilities: (a) are Public Trust investigations, PIV credentialing, and Government-furnished equipment required for contractor personnel, and if so at what position risk level and investigation tier and for how many personnel; (b) will the Bureau accept reciprocity for personnel holding a current, favorably adjudicated Federal investigation that meets or exceeds the required tier;

and (c) what adjudication timeline is anticipated relative to the 60-day period of performance, and may performance begin under a pre-employment waiver where permitted with investigations proceeding in parallel?

Answer: This is not required if the entirety of the work is performed at contractor’s facility.

Also, the BOP and will be issued an authority to use (ATU) which requires vendor to prove current industry certification such as ISO 27001 or compliance with HIPAA, NIST 800-53, and complete a security questionnaire illustrating the security controls in place to protect BOP data. Additionally, the vendor will be required to sign an Information Exchange Agreement (IEA) as recommended by NIST 800-47 Rev 1.

34. Authorization to Operate. If a contractor-operated environment is authorized, does that environment require a DOJ Authorization to Operate or Authorization to Test before the claims data may be processed? If so, what impact level does the Government anticipate, and would the security assessment be a contractor self-assessment or require an independent third-party assessor?

Answer: The system will be hosted outside of the BOP and will be issued an authority to use (ATU) which requires vendor to prove current industry certification such as ISO 27001 or compliance with HIPAA, NIST 800-53, and complete a security questionnaire illustrating the security controls in place to protect BOP data. Additionally, the vendor will be required to sign an Information Exchange Agreement (IEA) as recommended by NIST 800-47 Rev 1.

35. Would an AI model hosted within a FedRAMP High authorized government community cloud environment, where the model runs entirely inside the contractor's authorization boundary, no data is transmitted to the model provider, and no data is used for model training or improvement, satisfy the closed-gap requirement? Or does the Government intend this term to require self-hosted models on contractor-dedicated infrastructure only?

Answer: The system will be hosted outside of the BOP and will be issued an authority to use (ATU) which requires vendor to prove current industry certification such as ISO 27001 or compliance with HIPAA, NIST 800-53, and complete a security questionnaire illustrating the security controls in place to protect BOP data. Additionally, the vendor will be required to sign an Information Exchange Agreement (IEA) as recommended by NIST 800-47 Rev 1.

Only self-hosted, open-weights models operating entirely within an isolated, contractor-controlled environment with no external connectivity or data egress would be permitted.

36. a. Does a FedRAMP High, zero-retention, VPC-isolated deployment qualify?

b. Would the Government consider the closed-gap requirement satisfied by a commercial large language model accessed within a FedRAMP High-authorized, single-tenant government cloud boundary (for example, AWS GovCloud) under a Zero Data Retention configuration and VPC-scoped networking, such that Government data never traverses the public internet, no data is retained or used for training by the provider, and the environment is dedicated to this effort? If not, please confirm the Government requires a fully self-hosted, air-gapped model on contractor-controlled infrastructure.

Answer a: If it is for the exclusive use for this purpose meaning it is not a multi purpose environment and only isolated by VPC.

Answer b: Yes, this is acceptable.

37. Requirement the SOW requires disclosure of any commercial AI or analytical tools proposed. Answer: Yes. Does this disclosure requirement extend to subcontractors and their analytical tools, and if so, must subcontractor information be included in the Volume I technical quotation or submitted separately after award?

Answer: Yes.

38. If an ATO is required, please clarify how its timeline reconciles with the 60-day period of performance.

Answer: n/a

C. Personnel Security Requirements

39. Please identify the required personnel security investigation tier level. Will a short-term United States (U.S.) citizen pre-employment waiver apply?

Answer: All people working on this contract must be US Citizens and reside in the United States.

40. May a lawful permanent resident (LPR) serve as Project Manager (PM) subject to DOJ waiver procedures, provided a qualified U.S. citizen alternate is designated?

Answer: All people working on this contract must be US Citizens and reside in the United States.

41. Please confirm personnel security processing, Personal Identity Verification (PIV) card issuance, and GFE provisioning occur before the sixty-day period begins. Will reciprocity be accepted?

Answer: GFE and PIV will not be required because the contractor’s personnel will not be employed by the government.

42. Will personnel security checks occur after award? Does the sixty-day period begin at award or upon dataset receipt?

Answer: Contractor's personnel will not be employed by the government.

43. Will PIV cards, GFE, or BOP network access be required for an off-network analysis?

Answer: Contractor's personnel will not be employed by the government.

44. What security clearance levels are required? Must personnel undergo a BOP background investigation or suitability determination?

Answer: Contractor’s personnel will not be employed by the government.

45. Will work be performed on-site, remotely, or hybrid? If on-site, at what location?

Answer: Remotely.

46. What Public Trust risk tier and background investigation requirements apply to contractor personnel for fully off-site performance, and may analytical work begin while those investigations are in process?

Answer: Contractor’s personnel will not be employed by the government.

47. If proposed personnel have current or prior BOP/Public Trust suitability approval or prior BOP-approved access, may the quoter identify that personnel-readiness status in Volume I? If so, should the quoter provide named personnel, role descriptions only, or a brief table identifying proposed personnel and security-readiness status, subject to Government verification?

Answer: Although contractor’s employees will not be employed by the government if you have employees that have public trust yes, you can provide in a table.

48. Does the Government require, prefer, or discourage named personnel or resumes in Volume I? Answer: No. If personnel are named, will that create any key-personnel approval or substitution requirement after award? Answer: No.

49. Are NCCI edits, medical necessity reviews, or coding audits required?

Answer: Coding audits – none planned but reserve the right to perform one.

50. Is clinical coding validation expected? Will coding findings need to be validated by certified coding professionals? Answer: See all requirements outlined in the SOW.

D. Data Provision, Dataset Characteristics, Protected Information Status

51. When does the Government anticipate providing the dataset following award?

Answer: As soon as required security clearances are granted, and a Justice Enterprise File Sharing system account is provisioned.

52. Please confirm that the sixty-day period begins only after receipt of the complete dataset and required access provisions.

Answer: Yes.

53. Will the dataset include paid or allowed amounts, claim status, and adjustment or replacement indicators?

Answer: No. The claims data is exactly of the format in the sample attached to the solicitation.

54. Will production data include personally identifiable information (PII) fields present in the sample workbook, or will it be de-identified?

Answer: The PII fields will be redacted as they were in the sample provided.

55. Please confirm whether the patient identifier is stable across the full dataset.

Answer: Yes, it will be.

56. What is the approximate dataset volume and date range?

Answer: 666,000 rows in a csv file covering a date range from 1/1/2021 to 12/31/2025.

57. Will the dataset contain protected health information (PHI) or PII?

Answer: No, it will be redacted.

58. Does the Health Insurance Portability and Accountability Act (HIPAA) compliance plan requirement apply if the dataset is de-identified?

Answer: Under HIPAA, data is no longer considered protected health insurance (PHI) if it has bene properly de-identified in accordance with approved HIPAA methods (e.g. Safe Harbor, Expert Determination Method, etc.)

59. Which PII or PHI fields will be included, removed, redacted, or tokenized?

Answer: Redacted or tokenized.

60. What information categorization designation will apply (such as controlled unclassified information (CUI) or law-enforcement sensitive information (LESI))? Answer: The AI solution is expected to process Controlled Unclassified Information (CUI) associated with health-related resource utilization and financial transactions used to identify potential overpayments. If the solution processes identifiable health information, applicable privacy and security requirements for Protected Health Information (PHI), in addition to CUI safeguarding requirements, shall apply. Law Enforcement Sensitive Information (LESI) is not anticipated unless the solution is specifically used to support active law enforcement or fraud investigations.

61. Security posture. The Statement of Work describes a one-time analysis of a de-identified (no-PII) historical dataset, performed on the Contractor’s own closed, self-contained system, with all Government-furnished data purged upon completion (SOW §1.5, §2.0–3.0). At the same time, SOW §14 and clause DOJ-05 reference the full Assessment & Authorization (ATO), FISMA, and FedRAMP requirements typically applied to systems deployed on, or connected to, the BOP network. For an engagement performed off-site, containing no PII, with no third-party data egress and all data purged at completion, does the Government intend the full A&A / ATO / FISMA / FedRAMP apparatus to apply, or is the operative security bar the C-SCRM self-assessment identified in DOJ-05 (Section V) together with the AI-model disclosure and data-handling controls set forth in

SOW §1.5?

Answer: The system will be issued an authority to use (ATU) which requires vendor to prove current industry certification such as ISO 27001 or compliance with HIPAA, NIST 800-53, and complete a security questionnaire illustrating the security controls in place to protect BOP data. Additionally, the vendor will be required to sign an Information Exchange Agreement (IEA) as recommended by NIST 800-47 Rev 1.

62. The requirement was previously described in the RFI as approximately 2 million claims, and the sample record is dated January 2020. Please confirm that 666,000 rows represents the complete dataset and that the production window is January 1, 2021 through December 31, 2025.

Answer: Between the RFI & RFQ the dataset was reviewed and duplicates were removed.

The dataset is ~666,000 rows covering 5 years from 2021-2025.

63. Does the Government have preferred definitions for a "duplicate" claim and for provider "outlier" and "over-use" determinations, or should the contractor propose and document its methodology for Government approval?

Answer: There is no preferred definition at this time. The contractor should propose and document the methodology.

64. Are estimated overpayments required? Are validated overpayments required?

Answer: yes & yes

E. Medicare Benchmarking Requirements

65. Will BOP provide Medicare benchmark tables or must the contractor obtain them?

Answer: Contractor obtained.

66. What Centers for Medicare and Medicaid Services (CMS) geographic fee schedule year and locality should be used?

Answer: The fee schedule and locality used should match the service date and location within the unique row of claims data.

67. Will the Government furnish Medicare fee schedules, coding references, reimbursement methodologies, or licensed datasets? If not, please identify required versions and periods.

Answer: Vendor obtained Medicare fee schedules from 2021-2025.

68. For the Medicare rate comparison, is there a specific fee schedule and year you'd like billed charges compared against (e.g., the CMS Physician Fee Schedule / OPPS for a given year)?

Answer: The fee schedule should match the date of the claim. Claims data are from 2021- 2025 exclusively.

69. Medicare reference basis. For the Medicare Rate Comparison Report, which Medicare fee schedule and year should billed amounts be compared against, national or locality-adjusted (GPCI) rates, and facility or non-facility rates? Should the comparison use each claim's service-date year, or a single reference year across 2021 to 2025?

Answer: Locality adjusted rates should be used. The payor, address, zip field which is the zip code of the facility housing the patient can be utilized. Prefer comparison uses the service date year.

70. To align our benchmarking precisely with the Bureau's expectations, please confirm the Medicare payment systems, localities, and annual fee schedules to be used, and whether the Bureau will furnish the CPT and HCPCS reference data and licensing for use on this effort.

Answer: Locality adjusted rates should be used. The payor, address, zip field which is the zip code of the facility housing the patient can be utilized. Prefer comparison uses the service date year. Diagnostic codes and HCPSC modifiers are included but no licensing is provided.

F. Analysis Requirements, Methodology, and Deliverables

71. Will the Government specify definitions and thresholds for duplicate claims, diagnosis or procedure code validation, and provider outlier analysis?

Answer: The BOP will work with the vendor to define these terms and thresholds.

72. Please confirm how many correction cycles are required and how they fit within the sixty-day period. Answer: No set number of correction cycles are required.

73. Is data cleansing within contractor scope?

Answer: Yes. Data quality evaluation and cleansing as needed.

74. Will the contractor deliver a deployable software application or only analytical reports?

Answer: Analytical reports.

75. What deliverables are required, including any specified templates?

Answer: There are no specific templates. The analysis items required are listed within the

SOW.

76. Are there required analytical methodologies such as actuarial analysis or predictive modeling?

Answer: No.

77. Must the contractor provide recommendations or only deliver analysis outputs?

Answer: Analysis output reports at a minimum, recommendations can be provided.

78. Please confirm the number of formal Government review cycles and expected turnaround time. Answer: No set number of correction cycles are required.

79. Sections 13 and 14 of the SOW reference items like a kickoff meeting, weekly and monthly progress reporting, earned value management (ANSI/EIA-748), and cloud/ATO requirements. For a one-time 60-day analysis, do those sections apply here, or are they carryover language from a larger template?

Answer: The system will be hosted outside of the BOP and will be issued an authority to use (ATU) which requires vendor to prove current industry certification such as ISO 27001 or compliance with HIPAA, NIST 800-53, and complete a security questionnaire illustrating the security controls in place to protect BOP data. Additionally, the vendor will be required to sign an Information Exchange Agreement (IEA) as recommended by NIST 800-47 Rev 1.

80. To make full use of the Government's 15-workday review while staying within the 60-day period, we plan to deliver a consolidated draft early in the schedule so the review window falls inside the period of performance. Please confirm this approach works for the Bureau.

Answer: Yes.

81. The SOW requires 12 deliverables. Should all deliverables be submitted simultaneously at Day 60, or does the Government prefer interim submissions as each analysis is completed? Answer: Interim submissions are acceptable. Additionally, should deliverables be submitted via email to the COR, through a government portal, or by another method? Answer: Deliverables shall be submitted through the JEFS system.

82. What is the expected output? Executive summary – high level? Answer: Yes. Dynamic dashboard? Answer: No. Provider-level findings? Answer: Yes. Claim-level findings?

Answer: Yes. Detailed audit file? Answer: Yes

83. When does the 60-day performance period officially begin? Example: upon receipt of claims files? After data validation? After data mapping and vendor acceptance of the data?

Could BOP also provide information on how a 60-day performance period was decided?

Answer: At delivery of the data set.

G. Earned Value Management (EVM) Requirements

84. For a 60-day firm-fixed-price effort with milestone deliverables, would deliverable-based milestone status reporting satisfy the Government, or is a fully compliant ANSI/EIA- 748 EVM system required? This materially affects price.

Answer: No

H. Quote Format, Submission, Evaluation Criteria, and Question Deadlines

85. Are there page limits or format requirements for Volume I? Please confirm submission method and email address.

Answer: The technical quotation shall not exceed ten (10) pages and shall by emailed to kmfisher@bop.gov and jhamblin@bop.gov

86. Please confirm the deadline for submission of questions.

Answer: July 23, 2026 @ 11:00 AM, EST

87. Are there additional formatting requirements or evaluation criteria beyond what is stated?

Answer: No.

88. Are oral presentations or capability briefings anticipated?

Answer: An oral presentation (virtual) at the end of performance to describe the analysis and findings.

89. Please confirm the official email address or portal for submission and whether files must be separate portable document format (PDF) files.

Answer: email quote to kmfisher@bop.gov and Jhamblin@bop.gov

90. Should quotations be sent by email to you, and if so, are there any file format, file size, or subject line requirements?

Answer: Quotes should be emailed to kmfisher@bop.gov and jhamblin@bop.gov there is no specific subject line. File size should not exceed the 10-page maximum requirement.

91. Please confirm the 10-page technical limit counts only the Volume I technical narrative and excludes the cover letter, cover pages, resumes, and any model-disclosure appendices, and please confirm any required font, margin, and file-format conventions.

Answer: The 10-page limit if only for Volume 1 Technical Quotation. No required font, margin, or file-format.

mailto:kmfisher@bop.gov mailto:jhamblin@bop.gov mailto:kmfisher@bop.gov mailto:Jhamblin@bop.gov mailto:kmfisher@bop.gov mailto:jhamblin@bop.gov

92. Are there any formatting requirements for the quotation (e.g., font type, font size, margins, or line spacing) beyond those specified in the solicitation?

Answer: No

I. Data Transfer and Secure Transmission

93. What is the preferred secure method for transfer of the dataset and deliverable return?

Answer: Justice Enterprise File Sharing system which will be provisioned by BOP staff for the vendor.

94. Will dataset transfer occur via BOP network, secure file transfer protocol (SFTP), encrypted physical media, or contractor environment?

Answer: Justice Enterprise File Sharing system which will be provisioned by BOP staff for the vendor.

J. Artificial Intelligence Tool Disclosure and Vetting

95. Is there a required format or template for describing AI model architecture, training method, and data privacy assurances?

Answer: No

K. Invoicing and Contract Line Item Number (CLIN) Structure

96. Please confirm whether invoicing occurs only at completion or whether partial invoicing is permitted.

Answer: Invoicing will occur after completion of final analysis

97. Should Volume III include a single aggregate price, per-deliverable allocation, or separate prices?

Answer: All deliverables shall be included in the single CLIN.

98. Should the price volume include a per-deliverable price breakdown in addition to the single CLIN 0001 total?

Answer: All deliverables shall be included in the single CLIN.

L. Incumbent Contract and Prior Efforts

99. Is there an incumbent? If so, please provide contract number and value.

Answer: No, this is a new requirement

100. Is a transition anticipated? What duration?

Answer: N/A

101. Will the Government provide knowledge-transfer documentation?

Answer: N/A

M. Missing Statement of Work (SOW) and Attachments

102. Will the SOW be posted via amendment?

Answer: the SOW is attached to the RFQ. Pages 44-58

N. Additional Contract Scope and Structure Questions

103. Must contractor be a credentialed health actuary or may other analytical professionals qualify?

Answer: Other analytical professionals qualify.

104. Please clarify contract duration.

Answer: 60 days or sooner.

105. What is the required completion date?

Answer: 60 days after delivery of dataset to vendor.

106. Does the Government have an estimated level of effort?

Answer: No.

107. What contract type is anticipated (firm-fixed price, time-and-materials, or labor-hour)?

Answer: Firm-Fixed Price

108. Is an Independent Government Cost Estimate (IGCE) or budget ceiling available?

Answer: No.

109. Will the Government consider a quotation submitted by the closing date from an offeror whose SAM registration is in process, provided the registration is Active prior to award?

Answer: See FAR 52.204-7 If not, does the Government anticipate extending the closing date by amendment?

Answer: Not at this time.

110. Volume III requests one firm-fixed price for the complete requirement (CLIN 0001), while SOW Section 12.0 directs firm-fixed prices for each deliverable. Which format does the Bureau require?

Answer: All deliverables are firm-fixed price and included in CLIN 0001.

111. Will the Government evaluate relevant past performance performed by proposed subcontractors, consultants, or team members when those entities/personnel are expected to perform meaningful portions of the technical work?

Answer: See section 4.2.