QA_3_-_RFTOP_00001_Questions.docx

NPIN - Task Order #0001 Technical Questions

8. Task 1.1.1 (The CDC NPIN Websites) states that “All domains … will be made available to the contractor, including the password-protected extranet for CDC NPIN project management and reporting.” In addition to the domains, will the site databases, code, and content transition as well? On what technologies are the websites and the password-protected extranet built? What third-party tools and services are integrated within the NPIN websites and databases? Where are all of the current systems hosted (including primary and secondary/failover locations)? What are the hardware/software requirements for hosting? Are hosting facilities for either the primary or “non-Atlanta locations” provided by CDC or the contractor? What is the security level and current Certification and Accreditation status for each system?

Q) In addition to the domains, will the site databases, code, and content transition as well?

A) Yes, all aspects of the NPIN platform to include servers, databases, reporting, and applications both for protected and publicly available assets are currently being moved to the CDC network. By the initiation of this contract all assets for production, staging, and testing will be within the CDC domain. At this point a final decision has not been made on where the development environment will reside but wherever technically feasible, it is the preference of CDC that the contractor host in their environment. CDC understands that for the Drupal WCMS this may not be feasible and we will review options for maintenance post award.

Q) On what technologies are the websites and the password-protected extranet built?

A) The sites are built on a combination on Microsoft.Net, Drupal, ColdFusion, SQL Server, and SQL Reporting services. See response to next question for additional details on software tools and possible versions.

Q) What third-party tools and services are integrated within the NPIN websites and databases?

A) Once all NPIN assets are on the CDC network the following versions will apply:

· SQL 2008 or SQL 2012

· .Net Framework 2.x or greater

· Windows 2008 or 2012

· Microsoft Visual Studio

· SQL Server Enterprise Manager

· SQL Server reporting services

· ColdFusion

· NTIP 3.0 will use Drupal with the following:

· Red Hat Linux Enterprise

· Drupal 7.15

· PHP 5.3

· Apache HTTPD 2.2.x

· Apache SOLR

· MYSQL 5.1.x

· SMS capability is also available via a third party SMS gateway on a separate contract

Q) Where are all of the current systems hosted (including primary and secondary/failover locations)?

A) Currently systems are hosted at an external facility in VA (Dataprise). However, by the award of this contract production, staging, and testing assets will have been transitioned to CDC infrastructure. As much as reasonable and possible CDC would prefer that development assets remain at the contractor’s facility.

Q) What are the hardware/software requirements for hosting?

A) Hosting infrastructure will be comprised of Windows platform for NTIP 2.x and Linux for NTIP 3.x.

Q) Are hosting facilities for either the primary or “non-Atlanta locations” provided by CDC or the contractor?

A) CDC will provide hosting facility for the production, staging, and testing environments. . As much as reasonable and possible CDC would prefer that development assets remain at the contractor’s facility. Currently, all assets operate without failover capabilities but will have recovery capabilities. Technical support from the CDC Application Hosting Branch will only be available M-F, 8-5.

Q) What is the security level and current Certification and Accreditation status for each system?

A) The majority of systems are rated low, low, low. The administration components will have a higher level of security possibly requiring 2 factor authentication once the application completes migration to the CDC infrastructure.

Access to modify content will be available through a management web-site that will not require CDC credentialing. The only contracting staff that will require CDC badging with respect to the support of the NPIN platform are software engineering staff and quality assurance staff.

The Technical Specification documents have been added to the solicitation. Please see attachments J.8 and J.9.

Yes, NPIN currently maintains a contract with GovDelivery.

Less than 75 webcast will be support annually.

This will be an appendix that will not count against the page limit.

7)

Attachment J.6, Task 1.3 Special Products, page 11

Sections "Access to Government Property," "Rules of Behavior and Responsibilities," and "Analysis of Security or Privacy Issues" don't seem to belong here. Would the government consider moving these sections to the Information Security Area?

This is removed in amendment 00002.

8)

Attachment J6, Task 1.1.2 Electronic Mailing Lists (listservs) and Other Customized Information Dissemination Features, page 6

Does the technology used for the email lists need to abide by Federal government information security requirements?

No

9)

Attachment J6, Task 1.1.2 Electronic Mailing Lists (listservs) and Other Customized Information Dissemination Features, page 6

Does this system need to meet Section 508 requirements for universal access?

Yes

10)

Attachment J6, Task 1.1.2 Electronic Mailing Lists (listservs) and Other Customized Information Dissemination Features, page 6

Does the KPI requirement include the need to track all message clicks and open as is common in email messaging systems?

Yes

11)

Attachment J6, Section C.9 Delivery Schedule for Specified Products, Deliverable Table page 20

The second item 1.2 in the Table says Database Mgmt Plan Quantity 12 but due 90 days after award. Can the government clarify if this is a one-time deliverable or monthly?

Yearly requirement—PWS has been updated to reflect yearly requirement.

12)

Attachment J6, Section C.4, Task 1.2 Database, Development, Analysis, and Maintenance, page 8 (at top)

RFP states the Database Management Plan should include information in all five databases, but only four databases are listed on page 6. Can the government confirm which databases should be covered by the Plan?

The PWS has been updated to reflect the four databases. The plan should state how vendors plan to manage all four databases.

13)

Attachment J6, Section C.4, Task 1.1.1, The CDC NPIN Websites, page 4

First paragraph references J5 as the Government Property list, but J5 is the QASP. Please identify where technical specifications can be located.

The Technical Specification document and NPIN Software and Subscriptions list have been added to the solicitation. Please see attachments J.8 and J.9.

14)

Attachment J6, Section C.4, Task 1.1.1, The CDC NPIN Websites, page 3

Paragraph 1 mentions an Attachment titled Technical Specifications for Current NPIN Products and Services but the attachment is missing. Please identify where technical specifications can be located.

The Technical Specification document and NPIN Software and Subscriptions list have been added to the solicitation. Please see attachments J.8 and J.9.

15)

Section C.3 Task Order Technical Requirements, page 6; and Attachment J.6 Section C.3 Scope of Work, page 2

The Table in C3, Domain 1 has four focus areas (1.1, 1.2, 1.3, 1.4), but J6 in C3: Scope of Work does not include 1.4, nor is there any text following 1.3? Is 1.4 a subtask?

This task order does not include services related to Web Content Management Systems (WCMS), so it was not included. Future task orders may include this focus area.

The RFTOP mentions four web domains: page 3: "Technical infrastructure/ specifications for the four associated websites to include Web content management systems..." page 4: "The Contractor shall recommend appropriate and incremental enhancements, redesigns in conjunction with refreshed content for all the four web domains throughout the life of the contract." Only three domains are listed: cdcnpin.org, hivtest.cdc.gov, findtbresources.org. - Is there a fourth web domain?

The PWS has been update to reflect the three web domains.

In the bulletized list on page 5, the RFP shows: "Maintenance of NPIN servers, storage area networks (SAN), and backup infrastructures at the non-Atlanta locations" and also " Management of virtualized hosting environments." Question: Does this mean the Contractor is responsible for hosting and managing the NPIN hosting infrastructure?

The NPIN platform is currently being migrated into the CDC infrastructure. The hosting and management of the NPIN hosting will be paid internally. The only costs vendors may have are software cost related to accessing the NPIN environment within CDC firewall.

Does reporting need to be available real-time and online?

Online reporting is acceptable.

Based on the structure of RFTOP 1 and RFTOP 2, there appear to be clear distinction between IT/technology and Communication/content. However, there are overlaps in requirements. Please clarify the Government's requirements/intentions so proposals and pricing can be structured accordingly.

Domain 1 focuses on the communication technology which supports the communication and education tools that are provided in Domain 2. There could be some overlap but the government will address those concerns after the contract is awarded.

In essence, Domain 1 is intended to provide the operational infrastructure for the NPIN enterprise. Largely digital in nature, this domain seeks to provide leverage websites, databases, social media, API (and other assets) to meet the needs of NPIN partners. Domain 2 seeks to leverage the aforementioned operational assets to support, communicate with and engage NPIN partners.

Please provide further detail on which RFTOP covers the costs associated with conducting webcasts (1 or 2). How many webcasts should be included in the budget?

Less than75 webcast per year. The costs associated with this task should be budgeted for within task order 2.

The RFP states the Contractor must report all problems in accordance with the CDC-approved Standard Operating Procedures (SOP). The SOP is not listed in the deliverables. Please clarify.

The deliverable table has been updated in the PWS.

RFP states a requirement for a second site to serve in a disaster recovery capacity. Please clarify if the Contractor is to provide this site or whether the disaster recovery site will be contained in a CDC-provided facility.

Attachment J.6, Section C.4, Task 1.2, Database Development, Analysis, and Maintenance, page 8

The RFP states the preparation of the OMB package (assuming for data collection). The requirement is not listed in the deliverables. Please confirm.

CDC will provide the disaster recovery site if one is deemed necessary. The OMB package has been added to the deliverable table within the PWS

The RFP states a requirement for needs assessment. How often and how many efforts? Define the output of this assessment? Recommendations Report? If so, please confirm if this is a deliverable.

As part of the database management plan the government is asking for a “Status of NPIN Databases” report. This database plan is a deliverable.

Please clarify if the Contractor awarded RFTOP 1 is responsible for content in the databases or just the systems management of the databases.

The contractor will be responsible for both content management and the system management of all four databases.

This requirement alludes to the development of data products. To perform that task, the Government must provide defined business requirements. For pricing purposes, please clarify the number (quantity per year or per contract)/extent of development/defined purpose so that the effort can be priced in this proposal.

No more than 30 products per year. Please refer to the deliverable table.

Within this requirement, there is a training component. Please provide the number of trainings required.

Training is no longer a requirement. The PWS has been updated to reflect change.

The RFP requires a draft copy of the Systems Security Plan. However, this plan is not listed in the Deliverables schedule. Please confirm the deliverable status of this plan.

This plan has been added as a deliverable. The PWS has been updated.

The SOW states that "the Contractor's support for the CDC NPIN websites shall include the following: Maintenance and enhancement for websites redesigns when needed." Specifically, what NPIN websites would need a redesign on an annual basis and what requirements are included for that redesign?

Currently the CDC websites do not need to be redesigned. IF/When this requirement is needed the government will provide requirements at that time.

Support for www.findtbresources.org shall include maintenance of a database application, which supports the website and the monthly design and distribution of an electronic newsletter. While the SOW specifies that Government staff are responsible for the content of the newsletter and website, what specific tasks is the Contractor expected to provide?

The contractor will maintain the databases, the websites and design/layout and distribute the monthly electronic newsletter. The content for the newsletter will be provided by the government.

Webcasts and similar technology - How many webcasts should the Contractor provide per year? What is the size of the audience, etc.?

Budget for less than 75 webcast per year. The size of each webcast will vary but vendors can budget for less than 300 participants per webcast.

Campaign Resource Database - "NPIN staff will collect examples of successful campaign initiatives..." Please define "NPIN staff" as the Government or Contractor.

This refers to the contractor.

The deliverables tables currently state that two semi-annual reports are due for each task order.

Shouldn't the number be 1 semi-annual report for each task order as the deliverables table also calls for an annual report?

The deliverables table has been updated within the PWS.

The Technical Specification document and NPIN Software and Subscriptions List have been added to the solicitation. Please see attachments J.8 and J.9.

0. How do the requirements of the RFTOPs differ from the requirements of the base contract?

0. Will the two RFTOPs be awarded? If yes, will they be awarded separately?

a. The base contract describes the general scope of services that may be ordered under the awarded contracts. The RFTOPs are the specific requirements for the first two task orders.

b. Yes, the two task orders are expected to be awarded as two separate task orders.

1. Attachment J.6, Page 3, Section 1.1.1, end of 1st paragraph refers to Attachment: Technical Specifications for Current NPIN Products and Services. The attachment is not provided. Attachment J4 contains a list of government owned equipment, but no technical specifications.

Question (a): Will the Government please provide the attachment with the technical specifications?

The Technical Specification document and NPIN Software and Subscriptions list have been added to the solicitation. Please see attachments J.8 and J.9.

…”the contractor shall also shall answer requests for information that are received through the mail. The CDC NPIN post office box number shall be included in all marketing materials. Requests received by mail should be answered within 2 business days…”

· Question (a): Will the contractor be responsible for retrieving mail from NPIN’s post office box? If so, please state the location of the box.

The PWS has been updated to reflect there will not be a NPIN P.O. Box.

“For content translated in alternative languages and multiple formats, the contractor shall design and develop the appropriate content management process…”

· Question (a): Will the contractor be responsible for translating website content into other languages?

· Question (b): If the contractor will be responsible for translating website content into other languages, please provide the languages that will be required for translation.

a. Yes, in Spanish.

b. Yes, in Spanish.

“Contractor will provide a mechanism to access SMS texting services to help CDC reach audiences with important health information or emergency notifications….”

And the first bullet states:

0. “Specific tasks include:

0. Supporting 10,000 messages per month” 0.

· Question (a): Is the contractor responsible for contracting with a vendor to provide the SMS texting services?

Yes.

“The contractor shall provide a full-time project director….”

· Question (a): Is the project director a billable position?

Yes, the project director position is a billable rate.

In Task Order 0001, Task 1.1.1, one of the requirements is to identify, collect, or locate new materials and obtain clearances for their use. In order to enable the government to conduct an “apples-to-apples” comparison of costs, could you please indicate how many such materials contractors should expect to identify, collect, or locate per contract year?

The requirement will be specified when new materials are identified/obtained. On average there will be less than 100 materials, collected or identified in a contract period.

In Task Order 0001, Task 1.1.1/Marketing will include subscriptions to electronic mailing lists. What is the cost per year offerors should assume they will have to pay for those subscriptions?

The government is asking vendors to provide the best cost efficient solutions.

(Attachment J.6, C.4, Task 1.1.1) Please share the historical volume of requests for information received by channel - through web, by email, using social media, and via U.S. mail.

NPIN replies to customer e-mails received via info@cdcnpin.org, and NPIN-Requests@cdcnpin.org On average NPIN receives less than 100 patron e-mails per month. Emails address other miscellaneous topics, such as NPIN webinars, funding/grants, the Organizations Database, and subscriptions. Social media is harder to average since each social media activity varies greatly.

On p. 5 of Task Order 0001, there is mention of foreign language web content; however, it is unclear whether the contractor will be required to actually translate the content from English into other languages. Is foreign language translation part of the scope of work? If so, what is the estimated number of words to be translated per year and into which languages in addition to Spanish, if any, will the content need to be translated?

Yes, translation to Spanish is a part of the PWS. The word count will vary depending upon the products.

(Attachment J.6, C.4, Task 1.1.1) Technical Specifications for Current NPIN Products and Services was not provided as an attachment. Please provide.

The Technical Specification document and NPIN Software and Subscriptions list have been added to the solicitation. Please see attachments J.8 and J.9.

RFTOP #0001, Task 1.1.3 states “the contractor shall provide webcasting capabilities (e.g., technical assistance seminars, meetings with grantees, etc.) for access by CDC target audiences.” Will CDC’s existing webcasting backbone be used, or should offerors include the cost of using their own webcasting tools and infrastructure? Also, for budgeting purposes, how many webcasts should offerors assume will be required each contract year?

1) Yes 2) Vendor should budget for fewer than 75 webcast per year.

Will the contractor be expected to supply the hosting infrastructure, content delivery network and/or other infrastructure components, including software and database licensing?

The NPIN platform is currently being migrated into the CDC infrastructure. The hosting and management of the NPIN hosting will be paid internally. The only costs vendors may have are software cost to access the NPIN environment within CDC firewall.

(Attachment J.6, C.4, Task 1.1.1) In Task 1, there is reference to the conversion of documents and materials into web-appropriate formats. Approximately how many documents and materials will need to be converted the first year? How many in subsequent years?

Less than 50 documents and materials will be converted within the first year. Subsequent years will depend upon need.

(Attachment J.6, C.4, Task 1.1) What current technologies are used to identify, collect, and analyze social media data? Are you using any additional 3rd parties to identify, collect, and analyze social media data? If so, who would this be?

The government is currently using Radian6 to analyze social media data. This is the only tool currently being used.

69)

Attachment J6, Domain 1 Question:

(Attachment J.6 Task 1.2) What are the anticipated hours of system administration support?

The government is asking vendors to propose the most cost effective way to manage all four databases.

Task 3 under Domain 1 (RFP p. 7) states that the “Contractor shall leverage and optimize the use of the existing and future NPIN partner database . . . ” Is there a new partner database now under development? If so, what are the full technical specifications for the new database and how will its functionality differ from that of the current database?

No, there isn’t a new partner database under development.

Attachment J.6 Task 1.3.1 states “Additionally, the contractor will be required to create special subsets of the Resources and Services Database to meet NCHHSTP programmatic needs to include maintenance, developments and enhancements to existing and new RESTFUL APIs (that provides machine-readable responses), campaign widgets, and special data feeds.” Are maintenance and development of the RESTFUL APIs, campaign widgets and special data feeds part of the contractor responsibilities, or will the contract only include the work to create the special subsets?

The creation, maintenance and development of all new technologies created for this contract will be the contractors’ responsibilities.

Attachment J.6 Task 1.3.2 states “Contractor will provide a mechanism to access SMS texting services to help CDC reach audiences with important health information or emergency notifications using the KNOWIT (566948) short code via wireless carriers”

0. Does this include the ability to broadcast information?

0. How do consumers share their phone numbers?

0. Could these messages contain personal information (PII/PHI)? E.g. phone number/zip code are tied to HIV Testing locations.

0. If so, what are the targeted NIST security categories for these messages?

A. The government does not broadcast any additional information back to recipients.

B. Phone numbers are not shared.

C. The SMS service only pushes testing information out to recipients when recipients text KNOWIT and enter their zip code. The government does not collect PII information.

D. The NIST security level currently is moderate.

Attachment J.6 Task 1.3.2 states “Contractor will support the eventual migration of the KNOWIT code if/when a new vendor successfully completes the CDC Certification and Accreditation (C&A) process.”

a. Does the contract include creating (or updating) the NPIN server-side functionality to create the responses to incoming messages, or only integrating the existing functionality with SMS gateway (or similar capability)?

b. Is the contractor responsible for finding a new vendor?

c. Does the contractor pay for the cost of the SMS vendor?

A. The code to respond to SMS messages already existence.

B. The contractor will be responsible to maintain the relationship with the current vendor that provides this service or establish a new relationship with a vendor that can provide the same level of service.

C. Cost for this service should be budgeted as a contract cost.

Attachment J.6 Task 1.3.2 states “The KNOWIT code will be supported for up to 10,000 texts per month.” Once 10,000 requests are received in a single month, is the intention that the service becomes unresponsive? What is the expected peak message volume?

The KNOWIT CODE has not exceeded its peak usage during the life of this code. If the code needs additional messages per month the government will increase the current message plan.

Customer service with NPIN partners (internal and external) may generally be described as responsiveness and technical expertise.

Application management refers to ensuring the network applications/software/hardware is always working property.

a. Do offerors need to propose a 24x7 staffing, monitoring and break/fix approach as part of their proposal response?

b. Do offerors need to provide a second site disaster recovery location that complies with all of the CDC requirements for such as site? If so, what are these requirements?

a. The system recovery expectation is 8 business hours 5 days a week support

b. CDC will provide disaster recovery location if a location is deemed necessary. PWS has been updated to reflect changes.

c. Is there currently funding to upgrade the current databases to “take advantage of the latest technology and methodology for website design and search strategy/information retrieval”?

d. Have there been any COTS or GOTS products considered and evaluated for the purpose of upgrading to emerging technologies and best practices?

c. Yes.

d. No.

No.

The Technical Specification document and NPIN Software and Subscriptions list have been added to the solicitation. Please see attachments J.8 and J.9. Less than 300 concurrent users at any given time.

The government is open to hear all technical approaches for the needs stated within the PWS.

The current evaluation tools used for the websites/social media are: Google Analytics, Sitecatalyst and Radian6. Collection, analysis and use of these tools should be included in the offerors proposals.

The Technical Specification document and NPIN Software and Subscriptions list have been added to the solicitation. Please see attachments J.8 and J.9.

Yes, Vendors should budget for software costs whereas hardware cost will be paid for by CDC internally.

Task 1.1.2 is the technology that supports the creation of the mailing lists. Task 2.2.1 is the actual mailing list that must be maintained.

Has the government performed all required site security and load testing to ensure proper operation of the CDC NPIN websites?

Yes.

Will additional site security and load testing be required as the CDC NPIN websites are enhanced and/or expanded?

Yes.

Has the government performed usability studies on the existing CDC NPIN websites? If so, when were these studies last performed?

Yes, the government has performed usability study on the existing NPIN websites. The study was conducted in 2013.

Has the government conducted research on audience/consumer perceptions, expectations, preferences, needs, etc., with regard to the information presented on the CDC NPIN websites? If not, will the government require the contractor(s) to do so?

Yes, please see question 94.

Has the government conducted research to understand if the products and services included on the CDC NPIN websites are wanted or needed by the target audiences?

Yes, please see question 94.

Who will be responsible for developing the “topical” content placed on the CDC NPIN websites?

The government, in concert with the vendor, will create content. All content must be cleared by the government before any information is posted on the NPIN websites.

Who will be responsible for monitoring content posted by external audiences to the CDC NPIN websites?

All content posted on the CDC NPIN websites must be cleared by the government before information is posted.

Will the contract holder(s) need to provide resources (content developers/coordinators with internal SMEs) to support the collaborative elements of the CDC NPIN websites?

The government will serve as the SME for all content, but the vendor will serve as the community manager over the CDC NPIN websites to ensure collaboration is is being conducted on the websites. In this capacity, contractors should be prepared to actively observe, monitor and support collaborative activities.

.How does the government characterize/define Web 3.0 technologies and applications? Can you provide specific examples that would apply to the CDC NPIN websites?

Web 3.0: Is about the Web becoming smarter, getting to know your users better from your browsing history (and all you've contributed to it during Web 2.0) and automatically delivering content that’s relevant to our partner needs.

Which web browsers does the government require for viewing CDC NPIN websites?

The Government has no preference.

Does the government intend to assign “owners” of content on the CDC NPIN websites (e.g., owners of community groups)? If so, will the contractor(s) be responsible for managing the administrative rights?

Yes, the government will have SMEs that will serve as owners of content. Yes, the vendor will be responsible for managing the content, posting the content and overall administrative rights over the website.

Attachment J.6, Sample Task 1, Page 3, states cdcnpin.org is going to be migrated to a .gov site. Is there a timeframe (i.e., start date, end date) for the migration to happen?

The NPIN platform is currently being migrated into the CDC infrastructure. The .gov migration will be done before the new contract is awarded.

Attachment J.6, Sample Task 1, Page 4, states four web domains, but lists only three. Please confirm the correct number of web domains. The domains listed in the RFP are http://www.cdcnpin.org, http://hivtest.cdc.gov, and www.findtbresources.org.” What is the fourth domain?

The PWS has been updated to reflect only three web domains.

Attachment J.6., Task 1.2, Page 8: Please confirm whether there are four or five databases. RFP states “The Plan, due within 90 days of award, shall be comprehensive and shall assure the currency, completeness, and relevancy to customer needs of the information contained in each of the five databases listed above.” However, only four databases are listed (i.e., Resources and Services Database, CDC NPIN Downloadable Materials Database, Funding Database, Campaign Resource Database).

The PWS has been updated to reflect only 4 databases.

Attachment, J.6, Task 1.3.2, page 11. Does the texting health campaign include message development?

No.

The RFP (Attachment J.6: Domain 1: Information and Communication Technology) references Attachment: J.5 as the “Technical Specification for current NPIN Products and Services” (page 8), but Attachment J.5 is the Quality Assurance Surveillance Plan (QASP). In order to have sufficient time to review this additional material and address any potential questions, can the Government please provide as soon as possible the “Technical Specifications for Current NPIN Products and Services” as referenced in the RFP?

The Technical Specification document and NPIN Software and Subscriptions list have been added to the solicitation. Please see attachments J.8 and J.9.