Bidders Questions - RFQ 2026-R-007 Hair Care Point-of-Sale System Responses 3.24.26.pdf

Question Number

Question Response

Technical & Security Authorization Boundary: Does the proposed system require a full FedRAMP Moderate Authorization to Operate (ATO), or will the SAA accept a solution hosted on a FedRAMP-authorized infrastructure (e.g., AWS GovCloud) with an Agency-level ATO?

FedRAMP authorization is viewed favorably, however, it is not a mandatory requirement for this procurement. Greater consideration will be given to the vendor’s ability to satisfy applicable data residency requirements and the protections required under 2 U.S.C. 6628. In addition, any vendor under consideration must successfully complete the applicable risk and privacy assessment processes prior to award.

Technical & Security Section 208 Compliance: For proprietary hardware components, is a signed OEM Statement of Compliance mandatory at the time of quote submission, or can it be provided upon award during the implementation phase?

The signed Section 208 Compliance document may be provided up to one week after the submission deadline. Please note that this documentation must be received within that timeframe in order to remain under consideration.

Technical & Security Data Residency: Requirement #144 states data must reside in the continental U.S.

Does this restriction apply to technical support logs and metadata, and must all remote support personnel be U.S. Citizens?

All Senate data, as defined in 2 U.S.C. 6628, must remain within the United States.

Because the application will store Senate data, U.S. data residency is a mandatory requirement. In nearly all cases, this expectation also applies to related metadata, logs, and similar technical records.

With respect to remote support personnel, U.S.-based support is not stated as an absolute requirement in all cases. Vendors may be able to propose non-U.S.-based support arrangements if reasonable safeguards are in place, such as limiting what data is shared, restricting access, or allowing support information to be reviewed and scrubbed before transmission. The controls surrounding access to Senate data will be closely evaluated. However, arrangements that permit non- U.S.-based support personnel routine or readily available access to the system or Senate data would not be acceptable.

Technical & Security MFA Integration: Is the POS required to integrate with Senate-issued PIV/CAC cards for employee authentication, or is standard commercial multi-factor authentication (MFA) acceptable?

Integration with Senate-issued PIV/CAC cards is not required in all cases.

Standard commercial multi-factor authentication may be acceptable, subject to evaluation. The proposed authentication method will be reviewed as part of the risk assessment process, including consideration of the type and sensitivity of the data maintained within the system.

Technical & Security Offline Mode: Are there specific locations within the Senate hair care facilities where Wi-Fi or cellular signals are restricted, necessitating a robust "offline mode" for transaction processing?

The Senate’s on-campus Wi-Fi and cellular repeater coverage are expected to provide connectivity throughout the hair care facilities, and no specific signal-restricted locations have been identified at this time. However, in the event of a network or service outage, offline transaction capability would be considered a desirable feature. Vendors are encouraged to propose the approach they believe best supports operational continuity and system reliability.

Financial & Data Migration CAS Gateway: Can the government provide API documentation or technical specifications for the Bureau of the Fiscal Service Card Acquiring Service (CAS) to ensure the proposed payment gateway is compatible?

Technical specifications can be found at the following web link:

https://tfx.treasury.gov/tfm/volume1/part5/chapter-7000-credit-and-debit-card-collection-transactions

Financial & Data Migration QuickBooks Sync: Requirement #116 mentions QuickBooks integration. Does the SAA require a real-time API sync, or is a daily/weekly manual batch export in .IFF or .CSV format sufficient?

A daily export in .IFF format is sufficient to meet this requirement.

Financial & Data Migration Legacy Data Schema: To better estimate costs for Line Item 0002 (Data Migration), can the SAA provide the database schema or file formats currently used by the legacy system?

For purposes of data migration planning, a .fdb file from the legacy system can be provided. This file contains the system’s data, including customer information, specialist information, and related records.

Financial & Data Migration Commission Splits: Does the system need the capability to automatically split and route payments between individual concessionaires and the SAA at the point of transaction?

The system is not required to automatically split and route payments between individual concessionaires and the SAA at the point of transaction. However, the system should be capable of recording the name of the individual concessionaire associated with each transaction. Vendors are welcome to describe any related functionality their solution may provide.

Operational & Staffing Background Checks: What is the estimated timeline for United States Capitol Police (USCP) background clearances for contractor personnel required for on-site implementation and migration?

Required background clearance materials must be submitted to the United States Capitol Police at least two weeks prior to assigning contractor personnel to work under the contract. Contractor personnel may not begin work until the required background check has been completed and approved. Accordingly, vendors should plan to submit clearance materials no later than two weeks in advance, while recognizing that final approval timing may vary.

Operational & Staffing On-Site Response: Does the four-hour on-site service response time (Requirement #149) apply exclusively to hardware failure, or is physical presence required for software-only troubleshooting?

For terminal maintenance, the four-hour on-site service response time is required. This requirement applies specifically to terminal-related maintenance needs. Vendors may describe their proposed approach for software-only troubleshooting, however, physical on-site response is expected where terminal maintenance is involved.

Operational & Staffing Historical Volume: Can the SAA provide the average annual transaction volume or "peak day" traffic figures to ensure the proposed system is scaled for the appropriate throughput?

For planning purposes, approximately 8,600 transactions were processed during calendar year 2025. Vendors may use this figure as a general reference in sizing and scaling their proposed solution.

Past Performance Evaluation Authorization Boundary: Does the proposed system require a full FedRAMP Moderate Authorization to Operate (ATO), or will the SAA accept a solution hosted on a FedRAMP-authorized infrastructure (e.g., AWS GovCloud) with an Agency-level ATO?

Please refer to the response to Question 1.