EOPES RFI 09162025.pdf

E-OPES Request For Information (RFI) 16 September 2025

ATF FOR OFFICIAL USE ONLY Page 1 of 10

U.S. Department of Justice Bureau of Alcohol, Tobacco, Firearms and Explosives

Request For Information (RFI)

For:

Enterprise Optimization of EPS Systems (E-OPES)

ATF FOR OFFICIAL USE ONLY Page 2 of 10

TABLE OF CONTENTS

TABLE OF CONTENTS

SECTION 1. INTRODUCTION

Disclaimer Background Existing System

SECTION 2. EXPERIENCE AND CAPABILITIES

Program Management Application Code Development using Agile Methodologies UI/UX Design Security and Compliance Quality Assurance and Testing Operations and Maintenance Technologies

2.1. Place Of Performance

SECTION 3. RESPONDING TO THE RFI

3.1 RFI Response Submission

ATF FOR OFFICIAL USE ONLY Page 3 of 10

SECTION 1. INTRODUCTION

Disclaimer

THIS REQUEST FOR INFORMATION (RFI) IS FOR PLANNING PURPOSES ONLY. THIS IS NOT A

REQUEST FOR PROPOSAL (RFP) OR QUOTE (RFQ). IT DOES NOT CONSTITUTE A SOLICITATION AND

SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY

FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A

CONTRACT AS A RESULT OF THIS RFI. ANY INFORMATION SUBMITTED BY RESPONDENTS TO THIS

TECHNICAL DESCRIPTION IS STRICTLY VOLUNTARY. NOT RESPONDING TO THIS RFI DOES NOT

PRECLUDE PARTICIPATION IN ANY FUTURE RFP, IF ISSUED. ALL SUBMISSIONS BECOME

GOVERNMENT PROPERTY AND WILL NOT BE RETURNED.

Background ATF is tasked with maintaining a process to grant Federal Firearms Licenses, which governs the manufacture and dealing of firearms across the full firearms industry, grant Federal Explosives licenses, which governs the manufacture and dealing of firearms across the full explosives industry, regulate weapons imported into the United States, and maintain a registration record of all weapons governed by the National Firearms Act of 1934 (NFA).

The ATF has addressed these statutory responsibilities through distinct processes managed by the National Firearms Act Division (NFAD) and the Firearms and Explosives Services Division (FESD). NFAD is the only federal government entity authorized to manage the one and only one firearms registration database allowed by the Federal Court System.

NFAD is tasked with the management and maintenance of an eForms system (eForms) that will allow for the electronic submission of registration and transfer application for weapons that are governed by the NFA and the proper importation of firearms into The United States of America, the management and maintenance of the National Special Occupational Tax system (NSOT), as well as the maintenance of the National Firearms Registration and Transfer Record (NFRTR).

FESD is tasked with the management and maintenance of the Federal Licensing System (FLS), which is responsible for the issuance of new and renewal FFL and FEL licensure permits, the management and maintenance of the Firearms and Explosives Imports System (FEIS), which processes and tracks applications to import firearms into The United States of America.

Over recent years, the FIT Portfolio of Systems applications has undergone modernization efforts, however maintenance of these systems has become burdensome and cost inefficient.

ATF approaches firearms violence from two distinct fronts: industry regulation and criminal investigation. ATF regulates the manufacture, importation, and sale of firearms in the United States. ATF qualifies individuals who wish to engage in the firearms industry which includes licensing, importation, providing guidelines for operation, and recordkeeping for each acquisition and sale of a firearm. Through this regulatory framework, ATF establishes the tracing process that allows for the tracking of each firearm from its point of manufacture or importation to the point of first retail sale, a process known as “tracing.” By tracing recovered firearms, ATF is able to discern patterns of names, locations, and weapon types that provide invaluable leads that aid in the identification of persons engaged in the diversion of firearms into illegal commerce. ATF has sole regulatory authority over Federal Firearms Licensees (FFLs), and its National Tracing Center (NTC) is the only entity in the federal government authorized to perform the firearm tracing task which is specified in the Gun Control Act of 1968.

The mission of ATF’s National Tracing Center Division (NTC) is to accurately and efficiently conduct firearms tracing and associated programs and processes for international, federal, state, and local law enforcement agencies to provide investigative leads. A firearms trace is the systematic tracking of a firearm from its manufacturer or importer through the chain of distribution of wholesalers and retailers to the first retail purchaser. The NTC is only authorized to trace a firearm for a law enforcement agency involved in a bona fide criminal investigation.

A firearms trace is typically conducted when a law enforcement agency discovers a firearm at a crime scene and wishes to know the origin of that firearm in order to develop investigative leads to: (1) link a suspect to a firearm in a criminal investigation; (2) identify potential traffickers; and (3) when sufficiently comprehensive tracing is

ATF FOR OFFICIAL USE ONLY Page 4 of 10 undertaken in a given community, detect in-state, interstate and international patterns in the sources and kinds of crime guns.

The method used by the NTC to trace a firearm is complex and labor intensive. There is no federal firearm registry database that can simply be queried to determine who bought a particular firearm. Most firearms must be researched by directly contacting the manufacturer, importer, wholesaler, or retailer, to determine dispositions, except in cases where the FFL has gone out of business, where the gun had been previously reported lost or stolen by an FFL, or where it was part of a multiple sales transaction. In FY 2022, the NTC traced in excess of 623,000 firearms for more than 7,800 federal, state, local, tribal, and international law enforcement agencies. The NTC typically processes a routine trace request in 7-10 business days and an urgent trace request in under 24 hours.

In 2003, ATF deployed a web-based “front end” to the Firearms Tracing System (FTS) known as eTrace. The eTrace application provides for the electronic exchange of crime gun incident related data in a secure web-based environment. eTrace provides law enforcement representatives with the ability to electronically submit firearm trace requests, monitor the progress of traces, retrieve completed trace results, and to query firearm trace related data in a real-time environment. Although the eTrace application has been incrementally updated over the years, the last major version release was deployed in 2009 when Spanish language translation services were added. As of May 2023, more than 9,500 law enforcement agencies (including agencies from 50 foreign countries) and in excess of 81,000 individual users have been granted direct access to eTrace for use in their criminal investigations involving firearms.

Existing System The objective of this procurement is for the contractor to provide the necessary application and technical program expertise for the Enterprise Optimization of EPS Systems (E-OPES). To that end, this effort will consist of streamlining and consolidating all Licensing form submission, processing, validation, workflow, and reporting functions into one fully integrated web-enabled firearm licensing application for meeting the legal, regulatory, operational, capability, and functional requirements of the ATF, properly enhancing and maintaining the current capabilities and functions of the FIT Licensing Portfolio of Systems, and for the use of Law Enforcement (LE) purposes.

The result of this procurement will enable the full lifecycle of an ATF application which will go from the submission process and through the approval/disapproval process for the NFA controlled weapon, the registration of a Federal Firearms License or Federal Explosives License, as well as the process that governs the importation of firearms into the United States of America, governed by the National Firearms Act of 1934 or the Gun Control Act of 1968.

Deployments of enhanced functionality should be made to production as frequently as is practical, as determined by the Product Owner and in terms of any approved Deployment Automation Plan

The NTC Division requires major enhancements to the core Firearms Tracing System database and the eTrace user experience in order to streamline operations and consolidate all trace processing, validation, workflow, and reporting functions into one fully integrated web-enabled firearm tracing application. These enhancements will use the existing tracing applications as a starting point and will evolve these applications toward the desired state through small, frequent deployments of functional and architectural improvements. The implementation of a modernized firearms tracing application (eTrace) will significantly improve the operational proficiency of the NTC Division and build capacity to meet expectations in firearms tracing capabilities for federal, state, local and international law enforcement agencies.

The Firearm Tracing (eTrace) application architecture shall remain compliant with ATF’s overall application architecture framework.

Deployments of enhanced functionality should be made to production as frequently as is practical, as determined by the Product Owner and in terms of any approved Deployment Automation Plan.

ATF FOR OFFICIAL USE ONLY Page 5 of 10

SECTION 2. EXPERIENCE AND CAPABILITIES

The Request for Information (RFI) shall include your company’s capabilities, past performance to include contract numbers along with the work that is similar in scope, experience in providing the listed services, incumbent capture, staffing, benefits, North American Classification System (NAICS) codes, socio-economic certifications, and contract vehicles. This request is for market research only and not to be considered an official Request for Proposal

(RFP).

Program Management.

Please describe the company’s experience with the following:

1. How does the company handle communication and collaboration with clients throughout the development process?

2. What project management tools does the company use to track progress and milestones?

3. How does the company ensure project deadlines are met, and how does the company handle project changes?

4. Does the company have an established system for assessing project complexity? If yes, what is it? If not, what is used for assessing project complexity?

5. What method(s) are used to combat staff turnover?

6. What is the approach to distributing the workload between team members?

7. Please describe the size and experience levels of the team the company would recommend to successfully support the deliverable.

8. How does the company/project manager empower the team?

9. What is the company’s experience with project management approaches (such as Scrum or Kanban)?

10. What is the company’s experience with Agile software development methodology?

11. Does the company foster communication feedback loops between developers and users? List or provide examples of fostering communication.

12. How does the company manage project risks?

Application Code Development using Agile Methodologies.

What is the company’s experience with:

1. Please respond with applications your development team will use to develop, deploy and sustain the deliverable.

2. Please describe your company’s experience and level of expertise developing within a GovCloud Amazon Web Services (AWS) hosted environment.

3. Please describe your company’s experience and methodologies when working with application Stakeholders with competing priorities.

4. Document management (allow users to post, search, and download finished intelligence products? What are some examples of this capability?

ATF FOR OFFICIAL USE ONLY Page 6 of 10

5. Please describe your company’s experience with developing Application Programming Interfaces (API’s), and the benefits of using APIs to link systems and processes.

6. Building custom components that are not open source? What issues have the company encountered and how were they solved?

7. Please describe your company’s experience developing applications that interconnect with advanced dashboard applications and/or automated system application reporting.

8. Please describe your company’s experience developing applications that interconnect with advanced Geo-mapping applications, and how Geo-mapping may enhance application performance deliverables.

9. Please describe your company’s experience developing administrative and user level governance controlling application access supported within a Zero Trust multi-tenant environment.

10. Developing applications using search engines capability? Were there any trade offs for building a free text search? If yes, what were they? What capability did it give to its users?

11. Please describe which Service Level Agreements (SLA)s are most important to track performance and sustainment for application product improvement development and production delivery.

12. Understanding of development, testing, and training of applications within a cloud environment? How are multiple instances of the application handled across multiple environments (such as Dev, Test, Stage, Training, and Production)?

13. Versioning of multiple instances of the application across multiple environments? How far apart do these environments diverge and sync back up?

14. Deployment frequency? What is the lead time for changes in Production? What is the average change failure rate and time to restore? How quickly are changes able to be made and bounce back from any failures? Provide examples of addressing these issues.

15. CI/CD Principles? What is the company’s process for code releases?

16. Determining architecture patterns (such as microservices)? How are they derived? What alternatives are considered? How does the company determine the benefits outweigh the drawbacks of a particular pattern?

Provide the process of determination.

17. Integration of AI Tools developed by other government agencies? Provide experience incorporating software built by other parties.

18. Creating responsive applications that work across multiple platforms? Provide examples of creating working responsive designs.

19. Data migration with SQL Server Integration Services (SSIS)? When are the SSIS packages delivered?

Incrementally or when the data structure becomes stable at the end of development. What are the trade-offs based on either choice? What are the benefits? Provide examples of trade-offs and benefits of delivering the SSIS packages incrementally or at the end of development.

20. Deploying containerized applications to the OpenShift environment?

21. Working with the Federal Government and Law Enforcement?

UI/UX Design.

Please describe the company’s experience with the following:

ATF FOR OFFICIAL USE ONLY Page 7 of 10

1. Please describe your company’s experience, principles, and methodology used when developing User Interfaces (UI). Please provide an example(s).

Security and Compliance.

Please describe the company’s experience with the following:

1. Please describe your company’s experience and methodology with deploying and monitoring for unauthorized access, modification/change, and suspicious activity.

2. Please describe your company’s experience and methodologies when working with IT Security teams to obtain Authority to Test (ATT), and Authority to Operate (ATO) certifications.

3. Please describe your company’s experience developing applications and services that are compatible and compliant with Okta and Login.gov Multi-Factor Authentication (MFA).

4. Please describe your company’s vulnerability remediation experience and methodology used to mitigate active and non-active vulnerability exploits as identified by IT Security teams. Including how the team deploys the remediation.

5. Please describe your company’s user service request, incident, and security incident management experience and methodology to investigate, mitigate, and close tickets open tickets assigned from Agencies ticket management system.

6. Please describe your company’s understanding of change management and the key milestones that promote a successful change management program.

7. Please describe your company’s knowledge and familiarity with developing code/applications/services that meet or exceed NIST/FIPS Data at Rest and Data Encryption requirements.

8. Please describe your company’s knowledge and familiarity with developing code/applications/services that are compliant with National Institute of Standards and Technology (NIST)-Federal Information Processing Standards (FIPS) guidelines.

Quality Assurance and Testing.

What is the company’s experience with:

1. Automated testing. Has the company been able to implement 100% automated testing within the CI/CD pipeline or is it a combination of manual testing and automated testing? List the tools used and note any manual processes which required human interaction.

2. Implementing and testing Section 508 Compliance standards? Is the Section 508 testing conducted incrementally or at the end of development? What step is it conducted within the CI/CD pipeline? List the tools used.

3. Using CI/CD tools (i.e., Cucumber, Digital.Ai, GitLab, Jenkins, JMeter, Junit, Katalon, Maven, Mockito, Nexus, Node.Js, OpenShift, Postman, SonarQube, Selenium, TestNG, etc.)? Utilizing these and other tools for automated application development? Include tools, manual steps, decision points, and strategies to minimize downtime (for example: blue/green, automate rollbacks, etc.) in the response.

4. Using Continuous Integration/Continuous Delivery (CI/CD) tools (i.e., Cucumber, Digital.Ai, GitLab, Jenkins, JMeter, Junit, Katalon, Maven, Mockito, Nexus, Node.Js, OpenShift, Postman, SonarQube, Selenium, TestNG, etc.) for system integration tools and stress testing?

ATF FOR OFFICIAL USE ONLY Page 8 of 10

5. Unit testing and system integration testing within a CI/CD pipeline? What tools are used? Is it integrated into the CI/CD pipeline and run at each commit or manually executed? Is testing conducted iteratively or at the end and which environments (Dev, Test, Prod) do the tests run?

6. Regression testing. What tools are used? Is it integrated into the CI/CD pipeline and run at each commit or manually executed? Is testing conducted iteratively or at the end and which environments (Dev, Test, Prod) do the tests run?

7. Performance Testing. What tools are used? Is it integrated into the CI/CD pipeline and run at each commit or manually executed? Is testing conducted iteratively or at the end and which environments (Dev, Test, Prod) do the tests run?

8. Security Testing. What tools are used? Is it integrated into the CI/CD pipeline and run at each commit or manually executed?

9. Responsive design testing. What is the company’s approach to responsive design and testing? Did the responsive design work as intended? Is it tested against multiple product lines with different screen sizes (such as multiple iPhones and multiple brands and lines of Androids)? If yes, how? Are multiple lines of physical devices required for the tests or are sophisticated emulators (other than the desktop Chrome/Firefox built-in tools) used? Please provide specifics on responsive design test methods and tools.

10. All types of testing not listed above. What tools are used? Is it integrated into the CI/CD pipeline and run at each commit or manually executed? Is testing conducted iteratively or at the end and which environments (Dev, Test, Prod) do the tests run?

11. Quality Assurance. Explain the company’s quality assurance process, including testing strategies and defect management.

Operations and Maintenance.

Please describe the company’s experience with the following:

1. Please describe your company’s experience and understanding of IT lifecycle management process phases, with emphasis on project management, software development, service transition, and continual improvement.

Technologies.

Please describe your experience utilizing the technologies below:

Technologies Technology Details

Adobe XD Used for wireframe development Angular (Version 17) Front end SPA platform API Gateway Entry point for API requests ArcGIS Geospatial/mapping control service AWS S3 AWS object storage service AWS SNS Simple Notification Service AWS SQS Simple Que Service C# (Version 8.0) .NET programming language

ATF FOR OFFICIAL USE ONLY Page 9 of 10

Technologies Technology Details

Cypress Automated test scripting and test tool Digital.ai Project management tool GitLab DevOp tool; including source control Jenkins (Version 2.253) CI/CD pipeline server JMeter Performance & reliability tool MS Visio Microsoft diagramming program MS Windows Rights (Elevated) Microsoft Windows elevated rights to enable admin privileges Nexus Docker image repo .NET 8.0 Version of .NET platform NgRx Angular front-end to handle state management PrimeNg An open-source component library Okta Provides MFA OpenShift Container management service SQL Server 2019 SQL Server database management tool SonarQube Static code analysis tool.

Visual Studio Code Integrated development tool Visual Studio 2022 Professional Integrated development tool

2.1. Place Of Performance

The primary place of performance will be remote; however, the Government may require the contractor to work at either the Martinsburg, WV or Washington, DC ATF facilities. Describe the company’s place of performance and trade off decisions between remote work and in office work. Specify the decision made and the benefits brought to the project.

ATF FOR OFFICIAL USE ONLY Page 10 of 10

SECTION 3. RESPONDING TO THE RFI

PLEASE NOTE: Any document submitted that contains confidential/proprietary information must be marked on the outside as containing confidential information, and each page upon which confidential information appears must be marked as containing confidential information. The confidential information must be clearly identifiable to the reader wherever it appears.

The respondent shall include information addressing all the above sections within the 15-page limitation not including diagrams or images, consisting of single-sided, 8.5 x 11, Times New Roman or similar, and an 11-font size minimum.

Please reference the question numbers below in your response. The RFI whitepaper should provide the following information:

1. Company Information. Name, mailing address, phone number and e-mail of designated point of contact.

2. If your company would likely bid, please provide a written response identifying the company’s capabilities and qualified personnel available to perform the task(s) as well as related corporate experience.

3. Please provide an estimated price for the work to include a staffing estimate based on (labor categories and expertise levels) for the team capable of performing each of the stated Task(s).

3.1 RFI Response Submission

The response package must be submitted via email to the following:

• Amanda Boshears, Contracting Officer (CO), amanda.boshears@atf.gov

Additional Submission Information

• This notice is not a Request for Proposal (RFP); it is a market research tool being utilized to determine the availability of qualified sources prior to issuing an RFP.

• ATF is not seeking proposals at this time and will not accept unsolicited proposals.

• The Government is accepting questions in writing via email as part of this RFI process and shall be submitted NLT 4pm ET, Thursday, September 11, 2025.

• RFI responses are due NLT 4pm ET Thursday, September 25, 2025.

• No telephone calls will be accepted.

mailto:denise.young@usdoj.gov