Questions and Answers - 15BFA022R00000004.pdf

Questions and Answers

1. Question: Is the expectation that the provider will have an Authority to Operate (ATO) prior to contract commencement? If so, which agency provides the ATO?

Response: All covered contracts are governed by security clause defined in PGD 15-03 which requires contractors to be compliant with FISMA, FedRAMP, NIST, DOJ and OMB guidelines.

Contractors need an ATO. A Covered Contract is any contract, order or other commitment under which the contractor, or a subcontractor at any tier, including a cloud service provider, may access, collect, store, process, maintain, use, share, retrieve, disseminate, transmit, or dispose of DOJ Information.

The Bureau of Prisons would be responsible. The contact is Mohammed Alvi and can be reached via email: malvi@bop.gov or at 202.305.0630.

Does the use of Office 365 require an ATO, or does it only apply to other applications?

Yes, there is an ATO version of Microsoft 365 on the FedRamp Market Place webpage found at The Federal Risk And Management Program Dashboard (fedramp.gov).

2. The section states “In accordance with FAR 52.219-9, the offeror agrees to submit the Individual Subcontracting Report (ISR), formerly the SF-294, and Summary Subcontracting Report (SSR), formerly the SF-295, as applicable.”

Question: Are network medical providers considered subcontractors for purposes of ISRs, subcontracting plan, MBE/WBE, FAR flow-down, etc.?

Response: Yes.

https://marketplace.fedramp.gov/#!/products?sort=productName