1625DC-20-N-00004 Questions and Answers 5.1.pdf

Number Question Answer 1 Is this a new requirement or contract renewal? New requirement 2 If this is a renewal, what is the current contract number? Not applicable 3 When does the Government anticipated the RFP release and subsequent award? FY20?

Solicitation is anticipated in June and award is anticipated in September.

4 Does the core of the Consumer Expenditure Diary System currently reside on a cloud-based service such as Amazon Web Services (AWS) or Microsoft’s Azure or within a managed service located at BLS?

The Consumer Expenditure Diary System production system currenlty resides on a managed service located at Census and

BLS.

5 If the core system does reside within a managed service located at BLS, would BLS consider moving it to a cloud-based service, assuming that all relevant security and other confidentiality issues are correctly addressed?

BLS does not intend to move the core Consumer Expenditure Diary System in the near future.

6 If the core system does reside within a managed service located at BLS, would contractors be required to work onsite at BLS?

Contractors are not required to work onsite at BLS

7 Is BLS interested in receiving responses to this RFI that suggest alternate designs that are not based on a Web panel?

Yes

8 Question 6 of the Market Research Questions asks: “How would your entity design for a nationally representative sample, and what benchmarks would your entity control for?” Can you please clarify what is meant by “benchmarks”. Is this referencing the demographic composition of the sample?

Yes, what demographic populations would be controlled for when weighting up to the population.

9 For the in person CE Diary Survey that was conducted in 2019, can the BLS provide more details on how were respondents recruited to participate?

Sampled addresses are notified via an advance letter and a personal visit from a Census Field Representative. More details on the protocols can be found in the BLS Handbook of Methods: https://www.bls.gov/opub/hom/cex/data.htm

10 How were respondents contacted during the week to encourage the diary keeping task?

Census Field Representatives call the respondent on the 3rd and 8th day of the two week reporting period to encourage the diary keeping task.

11 What paradata, if any, would be made available on the in-person CE survey responses?

Paradata on the in-person interview survey is available on our public-use microdata through 2018 (https://www.bls.gov/cex/pumd.htm) We don't currently have any paradata publicly available for the CE in-person diary survey and we would not be able to provide it in advance of any proposal due to disclosure avoidance requirements.

12 The Bureau of Labor Statistics Online Diary RFI calls out a number of government compliance requirements for execution of this contract. One of the most stringent is compliance with FISMA and NIST SP 800-53 at the Moderate Baseline (Annex 2 Additional Information Security Requirements No.2) The SOW also states that a previously developed open-source online diary was developed and shall be modified (SOW – Background). Does this previous software come with a populated System Security Plan that describes the controls already in place, so that this can be modified instead of recreated? Does it come with a previously completed SP800-53A audit of compliance?

Per the SOW s Section X. Confidentiality and Security Requirements, the Contractor should implement the respective security controls catalogued in the National Institute of Standards and Technology (NIST) Special Publication 800-171, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations”. Please refer to provision #26 of the "BLS Confidentiality and Security Requirements" attachment for all requirements related to the protection of sensitive information while residing in nonfederal information systems.

BLS may be able to provide a redacted version of the system security plan and security assessment with respect to SP800- 53, but will have to obtain approval from the previous contractor.

13 How was this previous online diary hosted? Was it hosted in a contractor owned datacenter? A contractor owned cloud instance? A BLS datacenters?

A BLS cloud instance? Hosted by a contractor at a contractor datacenter.

For this new contract, can the online diary be hosted on a cloud solution such as AWS GovCloud?

Contractor use of a Cloud Service Provider (CSP) to service BLS confidential information must be through an authorized FedRAMP vendor and the vendor’s FedRAMP package must be reviewed and approved by BLS prior to use. Please refer to provision #25 of the "BLS Confidentiality and Security Requirements" attachment for all requirements related to cloud solutions.

If hosted on a cloud solution, does BLS have a preferred provider in the event that it is transitioned to full government control?

BLS does not have a preferred cloud service provider (CSP).

Contractor use of a CSP to service BLS confidential information must be through an authorized FedRAMP vendor and the vendor’s FedRAMP package must be reviewed and approved by BLS prior to use. Please refer to provision #25 of the "BLS Confidentiality and Security Requirements" attachment for all requirements related to cloud solutions.

16 If hosted by BLS, what are the infrastructure specifications? This will not be hosted by BLS.

17 The RFI indicates that Elasticsearch is being used, is this the data storage layer for the online diary? If not, what is the data storage layer? Elastisearch is the data storage layer for the online diary.

18 Is there a backend API that AngularJS is communicating with, or is it sending and retrieving data directly to and from an Elasticsearch server? If a backend API is being used, what language is the API written in? Unknown, but complete documentaiton will be provided.

A full FISMA compliance requirement brings with it corporate level policies and procedures (NIST SP 800-53 specifies Control 1 of a control family for this). The Paragraph 2 of the Annex 2 Additional Information Security Requirements states that “ These controls shall be subject to assessment and testing guidance provided in NIST Special Publication 800-53A.” when references against the system being developed. What type of audit is proposed? An audit of the deliverable? An onsite audit of the companies processes, documentation and systems? Would an ATO have to be initiated?

Per the SOW's Section X. Confidentiality and Security Requirements , the Contractor should implement the respective security controls catalogued in the National Institute of Standards and Technology (NIST) Special Publication 800-171, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations”. Please refer to provision #26 of the "BLS Confidentiality and Security Requirements" attachment for all requirements related to the protection of sensitive information while residing in nonfederal information systems which includes the right of BLS to request a system security plan and any associated plans of action for planned implementations or mitigations.

Additionally, provision #27 details how BLS reserves the right to review contractor compliance with confidentiality and security requirements. An Authority to Operate (ATO) is not relevant to NIST 800-171.

20 Has a system of records notice been published for the previous instance of this online diary? No.

Sheet1