EPS EOPES RFI Questions and Responses - 9182025.xlsx
XLSX spreadsheet 31 KB Posted
- Solicitation number
- 2025E-OPESATFRFI
About this file
This document is a Request for Information (RFI) for the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) Enterprise Optimization of EPS Systems (E-OPES) project. The RFI seeks market research for modernizing multiple firearms-related systems, including eTrace, eForms, Firearms Licensing System (FLS), and other enterprise platforms. Key technical requirements include cloud migration to AWS GovCloud or Azure GCC High, containerization, modernization of legacy Java 8 and .NET applications, implementing Agile Scrum methodologies, and developing integrated licensing and tracing systems with advanced capabilities like OCR, geomapping, and AI/ML form recognition.
The RFI requests 25-page responses detailing vendor capabilities, past performance, staffing estimates, and technical approach, with a focus on modernizing ATF's technology infrastructure. Contractors must possess at least a Secret security clearance, with a preference for Top Secret Facility Clearance, and be prepared to support both remote and on-site work in Martinsburg, WV. The government is seeking innovative solutions for consolidating multiple legacy systems into a unified platform, with an emphasis on DevSecOps, cloud-native architectures, and advanced technology integration. The solicitation is a new requirement, not a recompete, and the final acquisition strategy, including potential small business set-asides, will be determined through this RFI process.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| EOPES RFI 09162025.pdf | ||
| EOPES RFI 09042025.pdf | ||
| EOPES RFI 09042025.pdf | ||
| PWS - EPS Portfolio Mordernization v20250903.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| EPS Modernization RFI Questions and Government Responses | Government Respsonse |
| Industry Question | |
| Is there an estimated award date so as to better answer the staffing estimate and ability to bring qualified staff to the solution? | This RFI process will determine all critical acquisition timelines |
| For staffing estimates, should responses assume a dedicated on-site presence in Washington, D.C. or Martinsburg, WV, or will remote staffing be acceptable for most roles? | Remote staff is acceptable, however the contractor should be prepared to provide on-site support at Martinsburg, WV. |
| How many concurrent Agile teams are anticipated (e.g., one for licensing, one for tracing)? | One for licensing, one for tracing, one for backlog, one for O&M support (e.g., 4). Unless these functions can be adequately incorporated into two (2) teams. |
| How much flexibility is allowed in proposing alternative or innovative technologies beyond those explicitly listed (e.g., Angular v17 vs. legacy Angular 11.2.14, OpenShift, AWS GovCloud)? | The government requirement is AWS GovCloud or MS Azure. The government is open to alternate/innovative application technologies(i.e., Angular/OpenShift) beyond the current stack/platform |
| We understand that AWS is a key part of your technology stack. Do you have a preference for MuleSoft or AWS for the API technology? | The government is open to alternate/innovative technologies beyond the current stack/platform |
| Does the Government anticipate a phased migration away from legacy applications (e.g., Case360) to new platforms, and if so, will incumbents maintain O&M during transition? | Yes, a phased migration is expected during which the current vendor would maintain O&M support. |
| For containerization, is OpenShift a firm requirement, or will equivalent Kubernetes-based solutions be considered? | The government is open to alternate/innovative technologies beyond the current stack/platform |
| Will contractors be permitted to propose alternative API integration approaches if they demonstrate better interoperability or cost-efficiency? | The government is open to alternate/innovative technologies beyond the current stack/platform |
| For testing and CI/CD, should responses assume 100% automation is the goal, or is a hybrid approach acceptable? | Correct, full automation is preferred. |
| Is this a new requirement? Is there an incumbent contractor and contract? If so, please provide the contract number. | This is a new requirement. |
| Is there any set-aside planned for this acquisition? | This RFI process will determine acquisition strategy to include any potential set-asides or contract vehicles |
| Is there a contract vehicle planned for this acquisition? | This RFI process will determine acquisition strategy to include any potential set-asides or contract vehicles |
| What is the anticipated timeline for solicitation release and contract award? | This RFI process will determine all critical acquisition timelines |
| Can you please confirm that the only key position is the Program Manager? Is there a clearance requirement for the key position or other positions? | The Program Manager is not the only key position. The contractor should recommend additional key roles as required to ensure the success of the project. The clearance requirements outlined in the solicitation apply to all contractors. |
| Is the Government planning any industry day or reverse industry day for this procurement? | No |
| Is this solicitation a recompete of an existing contract? If so, could you please confirm the incumbent contractor(s)? | It is not |
| What is the estimated contract value associated with this work? | The government requests that the contractor provide a level of estimate/estimated price as part of their response to this RFI |
| Past performance needs to be federal alone or commercial past performance will be accepted? Does the scope and size needs to match the scope of this solicitation. | All recent and relevant past performance is acceptable |
| Could you please provide the current or prior contract number associated with this requirement? | This is a new effort |
| How has the incumbent performed on the current contract, particularly with regard to meeting performance objectives, deliverables, and timelines? | Performance has been acceptable |
| Would the Government consider granting an extension to the proposal submission deadline? | No |
| Are the cover page and table of contents excluded from the overall page count limit? | Yes |
| May we include additional pages for abbreviations and references, and will those be excluded from the stated page limit? | Yes |
| Can any portion of the scope of services be performed offshore, or is the work required to be fully performed onshore (within the U.S.)? | No. All work and all contractors must be within the U.S. |
| Will ATF give priority weighting to experience with its specific technology stack (Angular 17, .NET 8.0, SQL Server 2019, OpenShift, etc.), or is equivalent experience with comparable technologies acceptable? | The government will review and weigh each response based on the technical direction/strategy/plan proposed. |
| Does ATF anticipate a phased modernization (Licensing first, then Tracing/eTrace), or will both portfolios be modernized in parallel? | While a phased approach is preferred, the contractor should be prepared to work both portfolions in parallel. |
| For eForms modernization, does ATF have a prioritized list of forms (existing vs. new), or should all listed forms be considered equal priority? | Yes, a prioritized list was included in the RFI attachment. |
| Will ATF provide access to existing database schemas and APIs during proposal phase, or only post-award? | No |
| For OCR/form recognition, can ATF clarify whether there are preferred technologies/vendors, or if contractors are expected to propose solutions? | Contractors are expected to propose solutions that meet the business requirement. |
| How does ATF envision handling integration with external partners (e.g., manufacturers, FFLs, foreign agencies)? Through existing API gateways, or new integration layers? | Although existing API gateways exist, the Government is open to redevelopment/modernization of these and future api gateways. |
| Is ATF expecting offerors to propose a fixed staffing model (e.g., specific labor categories/levels) for the RFI response, or just provide estimates of team size and structure? | Yes, the contractor should prepare for a fixed staffing model along with recommended/estimates team sizes. |
| Can ATF clarify if there will be on-site staffing requirements at Martinsburg, WV or DC beyond initial transition/kickoff, or will the majority of work remain remote? | Remote staff is acceptable, however the contractor should be prepared to provide on-site support at Martinsburg, WV. |
| Will ATF provide access to its Accelerated ATO process documentation, or should responses assume standard DOJ ATO timelines? | Standard ATO timelines should be assumed. |
| Are there specific NIST/FIPS controls that ATF has historically emphasized for EPS systems (e.g., encryption, identity, logging), or should respondents address full compliance across all NIST 800-53 Rev 5 controls? | The contractor should address full compliance across all NIST 800-53 Rev 5 controls |
| For quarterly Technology Innovation White Papers, does ATF expect these to focus on ATF-specific innovations (e.g., tracing efficiency, licensing automation) or broader IT trends with potential relevance? | Quarterly Technology Innovation White Papers should focus on both focus on ATF-specific innovations (e.g., tracing efficiency, licensing automation) and broader IT trends with potential relevance. |
| Will ATF provide standard templates for deliverables (e.g., PM Plans, Security Docs, Training Guides), or should contractors propose their own? | ATF will provide standard templates |
| The PWS identifies several attachments that are not included and do not appear to be publicly available. Some of these documents are required to provide an accurate response. When will the referenced attachments be made available? | Yes, the additional referenced documents will be provided. |
tc={C49DE962-F419-420D-9964-BD227D1A9C55}: [Threaded comment]
Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924
Comment:
Do we have a timeline for when this will be provided?
| Can the government clarify what agencies have reciprocity for security clearances with the ATF? | The ATF Security Team will determine reciprocity on a case by case basis. |
| What are the certification requirements for non-key personnel? | Certification requirements should align to the required skillset (i.e., Project Manager - PMP Certification) |
| The government has asked for a response to 55 individual questions with a page count limit of 15 pages. Would the government be open expanding the page count or establishing one-on-one sessions with vendors? | No |
| Instruction reads: The respondent shall include information addressing all the above sections within the 15-page limitation not including diagrams or images, consisting of single-sided, 8.5 x 11, Times New Roman or similar, and an 11-font size minimum. industry recommends an Appendix be allowed with all the diagrams and images. Question: Does ATF concur? | Concur, an appendix is acceptable |
| Would the government please clarify "ITIL Level 4 practices"? Is this referring to practices as organized in the ITIL 4 framework? | Yes, this is referring to practices as organized in the ITIL 4 framework. |
| One of the Program Manager requirements is an "ITIL V4 Level 1 Certification." Could the government please clarify whether this is the ITIL 4 Foundation certification or a different intended certification level? | ITIL 4 Foundation certification |
| Questions 5 and 6 under the Security and Compliance task more closely align to Operations and Maintenance activities. Can the government confirm these should be addressed as full IT service management practices rather than focused on the security facets? | Yes, these should be addressed as full IT service management practices |
| Please confirm the level of detail requested for the following statement: "Please provide a staffing estimate based on (labor categories and expertise levels) for the team capable of performing each of the stated Task(s)." |
| Is the requested information only the labor categories and skill levels required to perform the 18 tasks? | At minimum the contractor should provide the labor categories and skill levels required to perform all tasks |
| Quality responses addressing the 54 questions/prompts in Section 2 Experience and Capabilities for the six functional areas, detailing company experience with the 25 technologies listed, responding to the prompt for Place Of Performance, and the three items identified in Section 3 Responding to the RFI are unlikely to be achieved within the 25-page limitation. |
| Would the government consider restructuring components to distinct volumes with limitations for each, or excluding specific items from the 25-page limitation? | No | |
| The solicitation specifies a 25-page limitation for the response. Can the Government please clarify whether items such as the cover page, table of contents, list of acronyms, and past performance are included within the page count limitation? | Cover pages, table of contents, glossary, appendix, and lists of acronyms are not included in the page count | |
| The solicitation specifies an 11-font size minimum. Can the Government please confirm if this applies to headers, footers, tables, and figures as well? | Applies to the entire document | |
| In reference to the question, "Please describe your company’s experience developing applications that interconnect with advanced Geo-mapping applications, and how Geo-mapping may enhance application performance deliverables." Is the government using any specific solutions for Geo-mapping in the current environment and plans to keep long term? | Yes, ESRI ARCGIS | |
| The PWS references an ATF specific Agile methodology based on Agile Scrum with industry standard development principles. Can the Government elaborate and describe more in detail what its current state is? | The government currently utilizes Agile Scrum Methodologies and best practices for all project efforts. This includes the assignment/utilization of standard roles like product owner and scrum master, the segmenting/deconstruction of work into increments (e.g., sprints), adequately sized sprint teams (i.e., 5-7ppl), constant/regular releases (i.e., biweekly or adhoc). | |
| The PWS references a single Product Owner being the decision maker as far as new functionality going to Production and later also mentiones the Scaled Agile Framework (SAFe). Have the Government personnel who are Product Owners been trained in Agile and SAFe best practices? How many Product Owners will be made available during the course of the Program? Will there be a Product Management layer? A portfolio layer? Are those deemed to be on the Product Team allocated solely to this Program or do they have other roles they fill? | All government personnel have the necessary Agile training. The contractor should recommend additional key roles as required to ensure the success of the project. | |
| Related to the use of Agile, Scrum, SAFe, and CI/CD (DevOps), does the Government have an existing backlog of prioritized work items or Agile Requirements. What is the Agile Requirements heirarchy that the Government is familiar with and expects the contractor to utilize? | Yes, there is currently a backlog. Requirements are set by Executive Leadership in conjunction with Product Owners/ Subject Matter Experts who works with the Project Manager to ensure priorities are met. | |
| Can the Government differentiate between Weekly Status Reports and the various Agile Reports mentioned in the PWS (e.g., Sprint Progess and Release Reports)? | The various Agile Reports should be included in Weekly Status Reports. | |
| Deliverable T3-D1 – Sprint Cadence and Initial Product Roadmap: Does the Government anticipate the Contractor driving the iteration, increment, and release schedule? | Yes | |
| What is the relationship between Government Product and System Owners? Are they on the same Team? Do they reside within the same Organizational Structure? | System Owners are responsible for ensuring enterprise support, and ensuring the application meets/addressess business requirements; Product Owners are responsible for managing application features and functions as they relate to industry needs. They do not reside in the same organizational structure. | |
| Is the ATF IT Governance Framework aligned with Scaled Agile (SAFe) or just Scrum? Is the IT Governance Framework something that is known and accepted by all working and supporting the Program? Are all personnel supporting the Program within a single Organization or are requirements, budget, technology, and business separate? | It is aligned to Agile Scrum and is accepted by the organization. All supporting personnel are not within the same organizational unit. | |
| Are there any expectations of Agile training, coaching, or Agile/Agile-at-Scale transformation activities? | Yes, as needed to ensure team effectiveness and cohesion. | |
| If the Government adheres or desires the Contractor to adhere to an Agile-at-Scale methodology or Framework, is the Government available and willing to attend, participate, and provide guidance during at minimum quarterly big-room planning events? Will the Government include travel for Planning events in acceptable ODCs? | Yes the government will participate and include funding for approved travel in an ODC CLIN. | |
| Is the Government amenable to any Value Stream Mapping workshops or exercises which may assist with streamlining the overall delivery of value? This is inclusive of both Development and Business processes. | Yes | |
| Between CI/CD, Security, ITIL, and Agile - is there an integrated end to end process well defined and understood at ATF that can be shared with the Contractor upon on-boarding? | The government will share any relevant policies as they relate to CI/CD, Security, ITIL, and Agile | |
| The question reads as follows, "Please respond with applications your development team will use to develop, deploy and sustain the deliverable." Is ATF looking for a COTS solution versus a custom developed application? | The government is open to alternate/innovative technologies beyond the current stack/platform | |
| In Section 14.0 Performance Metrics, it mentions standards for IaaS, PaaS, SaaS, and VMaaS. Does ATF have a preference for SaaS-based solutions which would alleviate the extra burden of the IaaS, PaaS and VMaaS options? | The government is open to alternate/innovative technologies beyond the current stack/platform | |
| In Section 14.0 Performance Metrics, it mentions standards for IaaS, PaaS, SaaS, and VMaaS. The PWS mentions "FISMA compliance with services provided to ATF". What FISMA level is ATF seeking? | FISMA High | |
| In Section 14.0 Performance Metrics, it mentions standards for IaaS, PaaS, SaaS, and VMaaS. Does ATF have a preference for SaaS-based solutions which already have FedRAMP High certification? | FEDRAMP High | |
| In Section 14.0 Performance Metrics, it mentions standards for IaaS, PaaS, SaaS, and VMaaS. How would ATF handle SaaS or PaaS based solutions that do not already have FedRAMP certification? | All solutions should be FEDRAMP certified, government sponsorship to attain FEDRAMP certification may not be available. | |
| There are multiple references for the key personnel to possess demonstrated experience with programs of similar in size, scope, and complexity. Can the government provide examples of metrics to indicate the size of this task order? | The contractor should assess the scale and magniture of the portfolio based on the RFI attachments | |
| The requirements states the contractor shall possess a Top-Secret facility Clearance to fully perform this task order. Can the government provide information about the contractor staff clearance requirements? Specifically, are all assigned contractor staff required to possess a TS level clearance? | All contractors are required to possess (at minimum) SECRET eligibility. | |
| Please provide any related incumbent contract numbers associated with this requirement. | This is a new effort | |
| RFI states page limit of 25 pages, not including diagrams or images. How will the Government evaluate the 25-page limit if diagrams/images are interspersed with text? Which of the following methods would be acceptable or preferred to the Government? a. Interleave text and diagrams for maximum contextual relevance, b. Group diagrams/images into separate graphics-only pages, which are interspersed with text pages as closely to the relevant context as feasible, or c. Extract all diagrams/images into appendices that follow the text pages. | The contractors responses should align to the specified requirements. | |
| Are cover page and/or table of contents included or not included in the 25-page limit? | Cover pages, table of contents, glossary, appendix, and lists of acronyms are not included in the page count | |
| May appendices be added and not count to toward the 25 pages, or is all text content included, whether part of the core response or appendices? | Cover pages, table of contents, glossary, appendix, and lists of acronyms are not included in the page count | |
| Will the E-OPES development team be making changes to ATF applications, whether in the FIT or FTA portfolios, at the same time other ATF government and/or contractor teams will be making changes to the same source code? If so, who will have primary responsibility for managing source code control and branching strategies within the CI/CD environment? | The government expects segmented environments will exist to prevent impacts to existing systems/applications while the development of new systems/application occurs. However, the contractor should utilize active communication/collaboration in conjunction with expert judgement to maintain/manage development and source code repositories. | |
| We assume that datacenter support services, including operation of ATF’s CI/CD environment, are provided by an incumbent contractor through the ESA-V contract. At the same time, the PWS makes multiple references to managing infrastructure. What level of access to the AWS infrastructure services and CI/CD environment tools will E-OPES teams be provided to configure relevant deployment pipelines and triage Production issues? | The contractor should expect full access to the AWS infrastructure services and all CI/CD environment tools | |
| PWS Section 5.1 says that the E-OPES team, after transition-in, will be responsible “for fully supporting” the firearms licensing and tracing applications. Section 5.5.1 says that the Contractor shall provide application DevOps/DevSecOps support including application development, enhancements, and operational defect/issue resolution. Similarly, PWS Section 14 lists performance metrics, including uptime, monitoring, and incident response requirements, and in several places references maintaining application infrastructure. However, the PWS does not include explicit tasks for managing the AWS infrastructure (such as compute, storage, and/or networks), support infrastructure (such as the OpenShift environment), operating systems (RHEL / Windows), or databases (SQL Server / PostGres). Would the E-OPES contractor be responsible for full-stack maintenance, or only for maintenance of the application tier? | The contractor would be responsible for maintenance of the application tier unless the approved development strategy introduces new architecture. If so the contractor would be responsible for full-stack maintenance. | |
| If the E-OPES contractor is responsible for full-stack maintenance, will those tasks be added to the PWS? | Yes | |
| If the E-OPES contractor is only responsible for the application tier, how would the Government determine compliance with the stated availability metrics, when the E-OPES contractor would not have access to the majority of infrastructure which drives them? | Access to relevant infrastructure systems would be provided. | |
| According to the Description section of the SAM.gov notice, respondents are given a "25-page limitation" for responses. However, in Section 3 of the RFI document (EOPES+RFI+09042025), respondents are limited to 15 pages. Please may the Government clarify which is accurate? | 25 page limitation | |
| Section 3 of the RFI document (EOPES+RFI+09042025) states that respondents should provide a "staffing estimate" with no mention of pricing. However, the SAM.gov notice asks for "an estimated price for the work." Please may the Government clarify the discrepancy between the PDF document and RFI notice? | At minimum the contractor should provide the labor categories and skill levels required to perform all tasks. The government requests that the contractor provide a level of estimate/cost as part of their response to this RFI | |
| PWS Page 5: "The Firearm Tracing (eTrace) application architecture shall remain compliant with ATF’s overall application architecture framework." Can the Government provide details around its "overall application architecture framework", (e.g. required system integrations, network diagrams, or cost-saving enterprise service offerings)? | Yes | |
| What progress has ATF made with respect to public cloud migration (e.g. enterprise cloud team, security team, or center of excellence)? | This question is not relevant to this RFI response and will not be answered. | |
| Can the Government please provide an organizational chart depicting how the National Firearms Act Division (NAFD), the Firearms & Explosives Services Division (FESD), and the National Tracing Center (NTC) are organized/structured under the Office of Regulatory Operations? | Yes | |
| Can the Government please provide clarification regarding the current state of this effort by confirming the name of the incumbent contractor currently performing this work and their associated contract or task order number under which the work is being performed? | This RFI is for a new requirement | |
| Can the Government please provide the contract type it is anticipating for this work (i.e., T&M, FFP, CP, Hybrid)? | Contract type has not been determined at this time | |
| Does the Government have specific contract vehicles in mind it would like to issue the solicitation under? | This RFI process will determine acquisition strategy to include any potential set-asides or contract vehicles | |
| Is it acceptable to use font smaller than 11 point for tables and graphics as long as it is legible? | No | |
| Section 3, Responding to the RFI states a "15 page limit", however Sam.gov posting states "25 page limit", please confirm page limit of response. | 25 page limitation | |
| In Section 2 Experience and Capabilities, RFI states "The Request for Information (RFI) shall include your company’s capabilities, past performance to include contract numbers along with the work that is similar in scope, experience in providing the listed services, incumbent capture, staffing, benefits, North American Classification System (NAICS) codes, socio-economic certifications, and contract vehicles. This request is for market research only and not to be considered an official Request for Proposal (RFP)." Can the government please provide clarification or confirm the benefits referred to in this Section are employee benefits provided by prime vendors to their personnel? | Yes, employee benefits provided by prime vendors to their personnel | |
| Will the contractor or the government provide the retinal tracking capability described in PWS Section 5.14 or a third party vendor? Please provide additional context as to how this capability will be provided. | Third party vendor | |
| Would ATF please share the name of the current incumbent contractor(s) supporting these systems? | This RFI is for a new requirement | |
| The PWS mentions potential on-site work at both ATF Headquarters in Washington, DC and the National Tracing Center in Martinsburg, WV. Would ATF please clarify which specific roles or functions would be primarily associated with each location when on-site work is required? | Remote staff is acceptable, however the contractor should be prepared to provide on-site support at Martinsburg, WV. | |
| The PWS mentions that NTC traced more than 623,000 firearms in FY 2022. Would the ATF please provide similar transaction volumes for the other in-scope systems? | As needed | |
| Is this a new opportunity or a recompete? If it is a recompete, which firm is the incumbent and can a contract number be provided? | New opportunity | |
| What is the estimated budget or level of effort for this requirement? | The government requests that the contractor provide a level of estimate/cost as part of their response to this RFI | |
| The RFI/PWS states the requirement of Top Secret Facilities Clearence. Does the government require that the prime possess a top secret facility clearance PRIOR to award? Would the government accept if a teaming partner (non-prime) have a TS-FCL instead? Would the government be open to the contractor to obtain the TS-FCL after award? | Utilizing a teaming partners facility is acceptable as long as it meets the requirement. The requirement for a TS-FCL is inflexible. | |
| Would the government consider a set-aside for the requirement (SBA 8(a), etc.)? | This RFI process will determine acquisition strategy to include any potential set-asides or contract vehicles | |
| Would the government be able to provide the technical stack intended to be use for the current and modernized platform (e.g. eTrace platform/code-base, website language, authentication/sso, cybersecurity tools, user story management (GitLab, Jira), etc.)? | Yes | |
| Which specific forms are in scope for OCR and form recognition? Will AI/ML-based OCR solutions be acceptable for automation? | Approved AI/ML OCR solutions are acceptable. The contractor should assume all forms are in scope. | |
| Can ATF provide examples of the types of enhancements or additional capabilities anticipated under Optional Tasks? | The government cannot anticipate the enhancements or additional capabilities required to meet changes in regulation/policy/statutes/laws or the needs of industry. | |
| Will Licensing and Tracing portfolios be managed under separate backlogs and product owners, or as an integrated team approach? | Seperately | |
| Case360 is identified as 'to be replaced'—does ATF have a preferred replacement platform? | Not at this time | |
| Will workloads be transitioned into GovCloud, Azure GCC High, or other cloud-native environments? Which environments are authorized for production? | Either AWS GovCloud and/or Azure GCC High environments | |
| Accelerated ATO is required—will ATF provide a standard playbook/process, or should the contractor propose one? | The contractor should expect standard ATO processing timelines | |
| Should the Program Management Plan cover all portfolios in a single plan, or will ATF require portfolio-specific PMPs? | All efforts | |
| Can ATF clarify the intended audience and content expectations for the PMO Online Newsletter? | Audience would include all internal stakeholders | |
| For Agile Documentation and API Standards deliverables, does ATF expect integration into ATF repositories/tools (e.g., GitLab, Digital.AI) or standalone delivery? | Integration into ATF repositories/tools | |
| Does the Top-Secret Facility Clearance requirement apply to all contractor staff, or only key positions? | All contractor staff working at a contractor facility | |
| Will personnel without full clearance be permitted to work in sandbox environments during adjudication? | Personnel without fully adjudicated clearances may be provided interim clearance by the ATF Security Team on a case by case basis. | |
| Is ATF requiring full PKI/PIV integration at the application level, or will ATF provide identity management services? | Application level | |
| Can ATF provide projected transaction volumes (applications, licenses, trace requests) to help size surge staffing requirements? | No | |
| Will ATF require dedicated licensing and tracing teams, or may staff be cross-utilized between portfolios? | The contractor should plan for fixed teams | |
| Will this be awarded as a single award contract or potentially as a multi-award BPA/IDIQ? | This RFI process will determine acquisition strategy to include any potential set-asides or contract vehicles | |
| Does ATF anticipate this requirement being set aside for SDVOSB or small business concerns? | This RFI process will determine acquisition strategy to include any potential set-asides or contract vehicles | |
| Is there an incumbent contractor currently performing these services, and if so, will ATF share lessons learned or transition challenges? | This is a new requirement | |
| Background: “Although the eTrace application has been incrementally updated over the years, the last major version release was deployed in 2009 when Spanish language translation services were added.” Please clarify if this RFI is a “new” modernization effort (i.e., new incremental deployments, security validation and testing, and more) or an inherited, existing modernization effort. Should the bidder include experience for the technical/technology transition (i.e., discovery, identify existing technical debt, and more) of workloads from the existing team? For example, Draft PWS states under 5.9 (Task 9), “Application integration within portfolio consists of both internal and external interfaces with both up and downstream integration points …” | This is a new requirement | |
| “The respondent shall include information addressing all the above sections within the 25-page limitation not including diagrams or images…” Please confirm that front matter, such as a cover page and table of contents, is excluded from the 25-page response limitation. | Cover pages, table of contents, glossary, appendix, and lists of acronyms are not included in the page count | |
| Section 3.2: “If your company would likely bid, please provide a written response identifying the company’s capabilities and qualified personnel available to perform the task(s) as well as related corporate experience.” Please clarify/confirm that bidders should respond to the prompts given under RFI Section 2, rather than responding to the tasks listed in the PWS. For example, Task 1 (Draft PWS 5.1) is Transition-In, but none of the Program Management prompts under RFI Section 2 address contract transition. Additionally, transition-in and out are not typically addressed in RFI responses. | Bidders should respond to the prompts given under RFI Section 2 | |
| Is there an incumbent, if so, who is the incumbent and what is the current contract number? | This is a new requirement | |
| Are there any components of FLS, eForms, or FEIS that will remain untouched or off-limits for modernization? | Unknown at this time | |
| Is there a mandate for full data integration between licensing and tracing systems, or can they remain separate platforms? | There is not a mandate | |
| Any external firearm manufacturers, customs, or OEMs be required? Are there defined API standards for these? | API standared exist. Additional integrations may be required | |
| Who manages hosting costs and infrastructure of AWS GovCloud? | ATF | |
| Will each module (e.g., eTrace, eForms) need its own isolated environment in cloud (Dev/Test/UAT/PROD)? | Yes | |
| How many projects (line of source code) and database are currently in use and in scope this RFI modernization? | There are currently over 500 databases | |
| What is the total number of anticipated users accounts for the new system? | This portfolio is utilized by 1-10Mil users | |
| Can ATF confirm which systems (eForms, FLS, FEIS, eTrace, NSOT, NFRTR, OBRs) contain legacy data that must be migrated into the new platform? | The contractor should assume all systems contain legacy data that will require migration | |
| Are attachments or document files (e.g., scanned forms) part of the migration? If yes, how are they stored today (file system, database blob, ECM), and what's the total storage footprint? | The contractor should assume the requirement to upload, capture, store attachments is part of the requirement. At present these files are stored in an enterprise content management system. | |
| Does ATF have data dictionaries or schemas for each legacy system ? | Yes | |
| Is ATF planning to consolidate all legacy systems into a single unified database instance, or will multiple databases remain for licensing, tracing, and import systems? | The government expects the eventual modernization of these systems into a single integrated licensing and tracing system with submodules. | |
| Can ATF provide the number of production deployments (version releases) completed in the last two quarters, and the average level of effort per release (e.g., total story points or estimated hours)? | At least 10 releases | |
| What Agile methodology is in use at ATF? What is the sprint cycle? | Biweekly | |
| Who provides sustainment support to the current eTrace system? How many changes are released to this system in a year? | ESA V/Leidos - More than 20 releases | |
| How is this scope different from current services? | Redevelopment and consolidation of existing systems possibly utilizing a new tech stack | |
| How many releases are deployed for all the current application modules? Can the Government share any metrics? | More than 20 releases; the cannot share any metrics |
tc={B3C4D0FC-12E6-4D75-9B53-B096E0EB27F9}: [Threaded comment]
Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924
Comment:
We cannot share? Rather than “the cannot share”
| Can the Government provide the current Level of Effort with labor categories supported? | The government requests that the contractor provide a level of estimate/estimated price as part of their response to this RFI |
| The RFI requests staffing estimates but does not specify expected labor categories or skill level mix (e.g., Senior DevSecOps, Cloud Architect, Security Engineer). Will ATF provide target labor categories and levels of effort in the forthcoming RFP, or should respondents propose their own staffing mix? | At minimum the contractor should provide the labor categories and skill levels required to perform all tasks. The government requests that the contractor provide a level of estimate/cost as part of their response to this RFI |
| The RFI lists AI tool integration from other government agencies as a requirement. Can ATF clarify whether AI/ML models will be government-furnished, contractor-developed, or hybrid? If furnished, what formats/interfaces (e.g., APIs, containers) will be provided? | Approved AI/ML OCR solutions are acceptable |
| The requirement references SQL Server Integration Services (SSIS) for data migration. Can ATF confirm whether SSIS is the mandated ETL tool, or if equivalent commercial/government-off-the-shelf ETL platforms are acceptable (e.g., Informatica, AWS Glue)? | SSIS is not the mandated toolset, COTS solutions are acceptable |
| The requirement references OpenShift deployments but does not specify version (e.g., ROSA on AWS GovCloud vs. on-premise). Can ATF confirm the expected hosting environment for containerized workloads? | AWS GovCloud |
| The requirement calls for Okta and Login.gov MFA integration. Can ATF clarify if one is mandated as the authoritative enterprise MFA solution, or if multiple authentication providers must be supported concurrently? | Current mandate specifies MFA |
| The PWS references ATF’s Agile Project Management Tool (currently Digital.ai). Does ATF require Digital.ai exclusively, or will equivalent enterprise Agile tools (Jira, Rally) be accepted? | Digital.Ai |
| The PWS requires form recognition of scanned ATF applications with privacy safeguards. Can ATF clarify whether Optical Character Recognition (OCR) technology is government-furnished, or if contractors must provide a solution (e.g., AWS Textract, IBM Datacap)? | Existing OCR tools/applicatione exist. The government is open to alternate/innovative technologies beyond the current stack/platform |
| The PWS describes VMaaS and SaaS offerings but does not specify if ATF expects the contractor to provide hosting within ATF-controlled GovCloud accounts or via contractor-managed environments. Can ATF clarify hosting ownership and authority boundaries? | The contractor would be responsible for maintenance of the application tier unless the approved development strategy introduces new architecture. If so the contractor would be responsible for full-stack maintenance. |
| The PWS references multi-factor authentication with FIPS 140-2 encryption but does not define the required Identity Assurance Level (IAL/NIST 800-63-3). Can ATF confirm whether IAL2 or IAL3 is required for portfolio applications? | IAL2 |
| The PWS states the contractor must hold a Top-Secret Facility Clearance, but Section 2.1 of the RFI references work at Martinsburg, WV and Washington, D.C. facilities. Can ATF clarify whether all contractor staff must maintain TS clearance, or if mixed clearance levels (e.g., Secret, Public Trust) will be permitted by labor category? | Remote staff is acceptable, however the contractor should be prepared to provide on-site support at Martinsburg, WV. Personnel without fully adjudicated clearances may be provided interim clearance by the ATF Security Team on a case by case basis. All contractors are required to possess (at minimum) SECRET eligibility. |
| The RFI references remote vs. onsite work tradeoffs, but the PWS Sec. 9 specifies Government Furnished Facilities in D.C. and Martinsburg. Can ATF clarify the percentage of remote vs. onsite work anticipated in the RFP? | Remote staff is acceptable, however the contractor should be prepared to provide on-site support at Martinsburg, WV. The percentage of work will be decided after contract award. |
| The PWS references Attachment 1: ATF IT Governance Manual describing the ATF Agile Methodology and CI/CD environment, including references to both Agile Scrum and the Scaled Agile Framework (SAFe). However, Attachment 1 was not included in the RFI materials. Could the Government provide this attachment or additional detail so that respondents may address our capabilities relating to the Agile and CI/CD methodologies preferred by OST within the RFI response? | The government will provide this document |
| The PWS references Attachment 3: ATF Enterprise Standard Technologies describing ATF approved tools. Can the government provide this attachment so that respondents may address our capabilities towards these tools within the RFI response? | This information is detailed in the RFI attachment |
| Task 1 refers to a transition plan from an incumbent. Can the government provide the name of the incumbent vendor for the eTrace system, FIT Licensing Portfolio or any other work that the contractor on E-OPES can expect to transition from? | This is a new requirement |
| The PWS details that both the FIT Licensing Portfolio of System and eTrace use Java 8 however the RFI requests vendor's capabilities in ASP.NET version 8 and C# version 8. Could the government clarify if vendors should submit capabilities for ASP.NET version 8 or Java 8 as well as which system is expected to be developed with ASP.NET? | Vendors should submit capabilities for both ASP.NET version 8 and Java 8 |
| Does the government expect the FLS and FEIS systems to require a full modernization similarly to eTrace as implied by shall statement #8 within the scope section? If so, does the government expect the modernization to combine the three systems into a single integrated licensing and tracing system with submodules, or will these remain seperate systems? | The government expects the eventual modernization of these systems into a single integrated licensing and tracing system with submodules. |
| If the government is unable to provide attachment 1, can the list of CI/CD tools please be listed for consideration and planning by vendors? | The government will provide this document |
| If the government is unable to provide attachment 1, can the ATF Agile Methodology please be summarized for to compare vendor qualifications to the project management requirements? | The government will provide this document |
| The PWS notes the contractor may recommend Agile teams to implement requirements. How many Agile teams does ATF anticipate needing simultaneously (Licensing, Tracing, eForms)? | The government requests that the contractor provide a staffing plan to include labor categories and skill levels required to perform all tasks. |
| Will ATF provide a notional deployment schedule (e.g., number of sprints/releases per quarter) to help contractors plan resources? | No, the contractor is expected to provide an estimated deployment schedule which will be reviewed and modified, or approved, by the Government |
Do we have a timeline for when this will be provided?
We cannot share? Rather than “the cannot share”
File details come from the government source that posted it. Updated .