Attachment 02_PREA Solicitation QandA.pdf

Solicitation Questions (15PBJA23Q00000004)

1) With regard to Task Area 6:

a) Is there a current system for storage of the information collected from the Governor’s Certification process?

Answer: Governors (or their designees) submit PREA certifications and assurances, and related/supporting documentation, to the Department of Justice (DOJ) electronically via email.

The Bureau of Justice Assistance (BJA)/PREA Management Office (PMO) then stores this information securely in electronic files in the Office of Justice Programs’ (OJP) information technology security system/infrastructure. The selected contractor will have access to these files to carry out the requirements related to Task Area 6.

b) Is the contractor expected to use that system or to build one?

Answer: Applicants may propose to use and expand the existing files that are described in response to the question above. Alternatively, applicants may propose to use the PREA Online Audit System to store certifications and assurances, and related/supporting documentation, that are submitted by governors to DOJ annually.

c) If built by the contractor, is it considered a Covered Information System as defined in the solicitation?

Answer: The selected contractor is not expected to build a separate system to store certifications and assurances, and related/supporting documentation, that are submitted annually to DOJ by the nation’s governors.

d) Is the contractor expected to migrate all past data to the new storage system or just retain the information going forward? If the expectation is to migrate documents, please describe and provide an estimation of the quantity of documents that will require migration.

Answer: As stated in the answer above, the selected contractor is not expected to build a new storage system to store certifications/assurances, and related/supporting documentation, that are submitted by governors to DOJ annually.

e) Are there any additional areas for which the contractor is expected to use government-owned or managed systems?

Answer: No. As noted above the selected contractor will have access to the electronic files that PMO/BJA uses to store certifications and assurance, and related/supporting documentation, that are submitted annually to DOJ by the nation’s governor.

f) What is meant by “review” for Task 6, p. 34? What other activities besides examination of compliance with standards 401 and 403 are expected to be done as part of “review,” and what other sources or documents would you expect the contractor to examine?

Answer: Under Task Area 6 on page 34, the solicitation describes the following sub-task:

“Receive, manage, and review the certifications and assurances submitted to DOJ by the nation’s governors, and the information governors are required to include in their submissions.

This includes examining certifications to be sure that states/territories are in compliance with PREA Standards 115.401(a), 115.401(b), and 115.403(f).”

The selected contractor will play a primary role, under direction from BJA/PMO and the COR, in examining whether each certification of full compliance with the PREA standards that is submitted in a given year to DOJ is consistent with the PREA auditing requirements defined in PREA Standards 115.401(a), 115.401(b), and 115.403(f). For example, as noted in footnote 27 on page 34 of the solicitation, PREA Standard 115.403(f) states: “The agency shall ensure that the auditor’s final report is published on the agency’s website if it has one, or is otherwise made readily available to the public.” Based on this standard, for each certification that is submitted to DOJ in a given year, the selected contractor will be expected to check/determine if all PREA audit reports for the agencies/confinement facilities covered by the certification are posted on the agency’s website, or otherwise made readily available to the public. If the agency is not in compliance with this requirement, the selected contractor will work under the direction of BJA/PMO and the COR to follow up with the agency to attempt to resolve this issue.

g) To what extent will DOJ officials continue to engage in outreach to state officials and participate in review of materials and determinations about individual states’ compliance?

Answer: PMO/BJA officials expect to work collaboratively with the selected contractor to conduct outreach to governors and other state-level officials regarding governors’ requirements related to submitting certifications and assurances to DOJ annually.

As described above with the example pertaining to PREA Standard 115.43(f), the selected contractor will play a primary role, under direction from BJA/PMO and the COR, to review annual PREA submissions from the nation’s governors.

2) For the mentors envisioned in C.3.1.1 and elsewhere in the solicitation, is it acceptable for the assigned mentor to change over the life cycle of the auditor’s training and certification?

Answer: Yes. Mentor/Mentee assignments may change over time.

3) Would you please provide the names of the individuals anticipated to be the CO and COR for this contract?

Answer: This information will be provided to the awardee at the time of award.

4) If the contractor determines that one or more of the listed task areas should be broken in two parts for effective management, is it acceptable to divide a task area and name separate task managers for distinct parts of a single task area?

Answer: Yes. Applicants may propose strategies to carry out the Tasks required in the solicitation as efficiently and effectively as possible.

5) Under Deliverable 3.1.4, C v. it states the following: "Auditors who are being recertified for the third time or more take this exam as a diagnostic exam (i.e., they do not need to receive a certain score to be recertified)." Under the current process, approved by PMO, auditors take the "second round recertification exam" now as their "first round recertification exam" and are therefore now expected to take a diagnostic exam during their second round of recertification.

The current class of auditor trainees (the 2023 cohort) and future cohorts are only expected to take diagnostic exams from here on out (i.e., there will be no pass/fail recert for them going forward). For this contract, will the contractor be expected to follow the currently agreed-upon process or a different process where auditors will be required to take two rounds of recertification exams that are pass/fail before they take the diagnostic exam (i.e., during the third round)? (The approach that is described in the solicitation would require development of additional new examinations, so it has cost implications.)

Answer: The selected contractor will be expected to follow the current, agreed-upon process.

The statement from the solicitation referenced above (i.e., “Auditors who are being recertified for a third time or more take this exam as a diagnostic exam…”) is a part of this current, agreed-upon process.

6) Under Task Area 7, Deliverable C.3.7.5, the contractor is expected to “Work collaboratively with the PREA Resource Center to deliver technical assistance” to facilities/agencies found out of compliance, and “Ensure that the auditors are involved in and guide the delivery of technical assistance to the confinement facilities/agencies.” The current conflict of interest rules prohibit auditors from providing technical assistance to facilities/agencies that they audit, and the role of the auditor during corrective action is limited to input regarding the facility's plans for coming into compliance and then verifying that compliance. Is the expectation that auditors in this role will be allowed to violate the conflict of interest rules in order to fulfill the responsibility described under this task? If this is not considered to be a conflict of interest under these circumstances, would you please explain how it differs from other such arrangements that are prohibited?

Answer: The expectation of auditors quoted in this question – and included in the solicitation – is consistent with the requirements in Chapter 18. Phase Four: Corrective Action and Final Report of the PREA Auditor Handbook. Relevant excerpts from this chapter (from pages 84-85 of the handbook) are included below in italicized text with emphasis in bold added. The selected contractor is expected to support auditors who are involved in carrying out Task Area 7 to uphold the expectations defined in the handbook, including those included in the following excerpt from the handbook:

Noncompliance and corrective action are normal and expected parts of the PREA audit.

Recognizing there are several hundred specific requirements in the PREA Standards, it is expected that very few confinement facilities will be in full compliance with all the PREA standards without undergoing some corrective action. For this reason, the auditor’s role goes beyond identifying deficiencies in policy, procedure, and practice and includes recommending corrective actions and serving as a guide to facilities and agencies as they make the changes necessary to become fully PREA compliant.

Noncompliance and Corrective Action Issuance of the interim report to the audited facility triggers a corrective action period, which may last up to 180 days. Standard 115.404 details the following auditor’s requirements during this stage of the audit:

• 115.404(b) – “The auditor and the agency shall jointly develop a corrective action plan to achieve compliance.”

• 115.404(c) – “The auditor shall take necessary and appropriate steps to verify implementation of the corrective action plan, such as reviewing updated policies and procedures or re-inspecting portions of a facility.”

• 115.404(d) – “After the 180-day corrective action period ends, the auditor shall issue a final determination as to whether the facility has achieved compliance with those standards requiring corrective action.”

While it is the responsibility of the audited agency and/or facility to implement new policies and practices, the auditor is a collaborator in that process by consulting with staff and administrators, providing information and guidance, https://www.prearesourcecenter.org/resource/prea-auditor-handbook and directing administrators to seek additional information and technical assistance available from the PREA Resource Center, where necessary.

In particular, the auditor should help the facility develop a corrective action plan that includes:

• All deficiencies and recommended corrective action steps identified in the auditor’s interim report

• A list of required deliverables and changes the auditor must verify to determine that the facility is in compliance with all PREA Standards

• A proposed methodology for how the auditor will verify compliance

• An agreed upon timeline for implementing all the required actions

Facilities have up to 180 days to undertake the agreed upon corrective actions;

provide the evidence the auditor requires to verify that the facility has fully addressed all deficiencies identified in the interim report; and is in compliance with all PREA Standards. Depending on the nature and extent of the deficiencies, auditors may have to employ a range of strategies to verify compliance. Remember that a change in policy often impacts the day-to-day practices within a facility and may require curriculum development and training to fully implement it; thus, even seemingly minor changes to a policy may require more extensive verification methods. When corrective action verification methods include a site review or interviews with staff, auditors are encouraged to use the guidelines for conducting components of the onsite audit remotely, as described in chapter 16, to determine whether, and to what extent, it is appropriate to conduct these verification methods remotely. Remember, auditors are not permitted to conduct virtual interviews, either by phone or by video, with persons confined in the facility in order to verify corrective action.

During the corrective action phase, the auditor must revisit the process outlined in the Systematic Review of Evidence section and ensure that the evidence provided by the facility addresses areas of noncompliance and the institutionalization of the specific steps and actions to achieve and maintain compliance. At the conclusion of the corrective action period, the audited facility should have taken all the steps agreed upon with the auditor, and the auditor should have conducted all the necessary verification procedures.

7) For this contract, could you please explain the categories of information that will be considered DOJ Information?

Answer: “DOJ information” is all data and information related to the PREA Audit Function, which includes, but is not limited to, the information collected via – and stored in – the PREA Online Audit System, the PREA Audit Assignment System, and the learning management system used to train PREA auditor candidates and DOJ-certified PREA auditors.

Is there any information maintained for this project that would not be considered sensitive information?

Answer: No.

Please explain whether each of the following are considered DOJ information and provide any other illustrative examples:

• lists of trainees and their scores on training examinations DOJ Information

• emails between contractor employees

• emails to and from contractor employees

• task planning documents for managing PRC work

• trainee evaluations of trainings and faculty/trainers

Answer: Consistent with a previous answer, the information listed above should be considered DOJ information.

8) Will the following systems require either an ATO or Fedramp?

• Salesforce

• Email

• File storage

• LearnUpon

• Survey or data collection tools

Answer: BJA/PMO does not at this time anticipate that any of the systems listed above will require an Authorization to Operate (ATO) issued by the Office of the Chief Information Officer (OCIO) at OJP. After the contract is awarded, the selected contractor will work with BJA/PMO, the COR, and OCIO to determine if any of the systems listed above require FedRAMP Authorization or an OJP issued ATO.

9) If an ATO is required for services that do not currently have a Fedramp option, what do you anticipate as an approach for maintaining operations while an ATO is pending? May the contractor propose alternative cloud applications that have Fedramp certification?

Answer: See the response above related to ATOs of the systems listed. Applicants may propose any alternatives that they determine will enhance their ability to carry out the Tasks defined in the solicitation.

Continued operation of a service without a FedRAMP Authorization or OJP-issued ATO, but in pursuit of a FedRAMP Authorization or an OJP-issued ATO, puts OJP leadership in the unfortunate position of having to decide whether or not to issue a risk-based decision to continue operation of the service, without a good understanding of the current security posture.

While possible, this is not desirable. The best path is to obtain the required security authorizations as part of the development process or prior to operating the systems in production.

10) Does work under this contract require that staff use computers that are not used for other purposes? If so, will OJP provide laptops for contractor employees for use of and access to Covered Information or expect the contractor to supply them? Are there any functions for which OJP authorizes use of a contractor’s non-dedicated networks, IT, or other equipment?

Answer: Yes. Contractor employees will be issued OJP laptops and granted access to relevant DOJ/OJP networks and systems they need for them to carry out the Tasks defined in the solicitation. Contractor employees’ use of OJP laptops and access to DOJ/OJP networks and consistent will be consistent with all relevant DOJ/OJP information technology security requirements.

After the contract is awarded, the selected contractor will work with BJA/PMO, COR, and OJP’s OCIO to identify if and under what circumstances contractor employees may use non-dedicated networks and equipment.

11) What functions or types of information currently processed by the PREA Resource Center or contemplated under this contract does OJP define as “maintaining a system of records on behalf of DOJ” as defined under the Privacy Act?

Answer: The PREA Online Audit System is currently undergoing a Privacy Impact Assessment, with input from the OJP’s OCIO and OJP’s Office of the General Counsel. After the contract is awarded, the selected contractor will work with BJA/PMO, the COR, OJP’s OCIO, and OJP’s OGC to evaluate the implications of the Privacy Act on the information collected under this contract and the related systems.

12) Under Task Area 1, Deliverable C.3.1.2, B, it states the following: “Support auditors who initiate one or more audits while on probationary status. If an auditor with probationary status initiates one or more audits, the contractor will work with the auditor to apply what they learned and the skills they developed/enhanced during the certification process to the audit(s).”

This language is different from the requirement in the PREA Auditor Handbook (Version 2.1), Chapter 10. Probationary Certification Status, Probationary Certification Requirements (p. 26), which reads: “Topics may also be tailored to meet the individual needs of the auditor or to reflect changes to auditor requirements. For example, if an auditor initiates one or more audits while on probationary certification status, PREA Resource Center staff will work with the auditor to integrate discussion of their audit work into the coaching components of the probationary coursework.” Is OJP requiring that any probationary auditor who initiates an audit must engage in support work, in addition to completing the minimum 8 hours of probationary education described under C.3.1.2, A? If this is a new requirement of probationary certification, what is expected in terms of the curriculum content, the number of hours, or the length of the term of engagement, and the responsibilities of probationary auditors who will initiate an audit?

Answer: The requirements related to Probationary Certification Status defined in the PREA Auditor Handbook are not changing under this contract.

13) Will contractor be permitted to vary from the stated hours of 7 am to 7 pm Eastern for employees’ standard work hours in order to accommodate work by staff in other time zones?

Answer: Yes. On an as-needed, case-by-case basis, the selected contractor may work with BJA/PMO and the COR to adjust the hours stated in the solicitation.

14) For staff working remotely in their homes and also in contractor offices, please specify any security measures beyond computer security that are expected for those locations.

Answer: Contracting employees will go through the relevant OJP/DOJ clearance and security processes in order to access the OJP/DOJ systems needed to carry out their work under this contract. Once the contract is awarded, the selected contractor will work with BJA/PMO, the COR, and OJP’s OCIO to specify any additional security measures that are expected for contractor employees who are working remotely from their homes.

15) Given that Impact Justice has been the primary entity responsible for many of the services described in this solicitation, delivered through a cooperative agreement, is it appropriate to seek a past performance evaluation from staff in the PREA Management Office? If not, how can our relevant past performance under this cooperative agreement be evaluated and reflected appropriately in our response materials?

Answer: Yes, it is appropriate to seek past performance information from the PREA Management Office.

16) For “3.3.6 Task AREA 6: Managing the process for governors to submit certifications and assurances to DOJ,” will the contractor be responsible for managing any of the activities for the current governors’ certification/assurance cycle (i.e., Audit Year 1 of Cycle 4: August 20, 2022 –

August 19, 2023) during the base year of the contract, as the process will be underway and governors' submissions are due October 15, 2023? For example, will the contractor be responsible for sub-task “C. Receive, manage, and review the certifications and assurances submitted to DOJ by the nation’s governors, and the information governors are required to include in their submissions”? Would you please identify any and all activities that the contractor will be expected to undertake for the certifications due October 1, 2023?

Answer: Given the timeline related to making an award under this solicitation and the next annual deadline (October 15, 2023) for governors to submit certifications and assurances to DOJ, the selected contractor will be expected to review, under direction from PMO/BJA and the COR, certifications and assurances that are submitted by governors starting next year on October 15, 2024. Put another way, given timing considerations, the selected contractor is not expected to review certifications and assurances that are submitted by governors to DOJ on October 15, 2023.

17) C.3.7.4. It states: C. Observe the work of the auditors to collect information about how they comply with the methodological and other requirements in the PREA Auditor Handbook throughout all phases of the audit (i.e., pre-onsite, onsite, evidence review and interim report, corrective action and final report, and post-audit). Note: Neither the contractor, the COR, nor the contractor will be involved in making compliance determinations. Such determinations are the sole responsibility of the assigned auditors.

Our question is whether employees of the contractor who are themselves DOJ-certified PREA auditors may serve as the auditors for the consortium audits, or whether contractor employees are only permitted to serve as observers.

Answer: To prevent any actual/real or perceived conflicts-of-interest, the DOJ-certified PREA auditors who are selected to conduct audits under Task Area 7 cannot be contractor employees.