The file's text, extracted by GovTribe without its formatting.
Q&A
| # |
| Question |
| Response |
| Change to RFQ? |
| Description of Change |
| Is there a page limit or any other document specs the government has for the response? |
| Yes |
| Yes |
| A Content of Proposal section has been added to ADDENDUM TO FAR 52.212-1 Instructions to Offerors-Commercial Items (June 2020). |
| It seems Treasury is moving to USAStaffing; is the OCC following that migration? It mentions Monster in the solicitation. If so, what is the timing for the migration? |
| Yes. OCC is in the process of migrating to USA Staffing. The full migration will occur in January 2022. |
| No |
| 3 |
| Page 10, item 10; it states the total test time is 4 hours, including breaks; 30 minutes is needed to check-in and check-out applicants – would that be part of the 4 hours or added on top of the 4-hour test session? |
| The Knowledge Test is 60 minutes in length, and the estimated times for the writing and analytical test would be 60 minutes each as well. Roughly 3 hours of testing, and the remaining time would include check-in, breaks and check-out. In the event there is a reasonable accommodation request for additional testing time, we would like to be cognizant of an 8-hour testing day to ensure the test takers have sufficient time to complete the tests. |
| No |
| 4 |
| Section E, page 21, if the solution is not cloud based, is this requirement not invoked: Annual 3PAO Security Assessment Report and Package Review? |
| Yes, that correct. The Annual 3PAO Security Assessment Report and Package Review is not invoked if the solution is not cloud based, however we would require the SOC 2. |
| No |
| 5 |
| When does the government expect to go live with this possible new solution? |
| We would go live this Fall 2021 campaign, which starts the first week in September. |
| No |
| 6 |
| Is FedRamp authorization mandatory? |
Is SOC 2 mandatory and is there a short-term approach that is acceptable if SOC 2 is not currently available?
| The FedRAMP security and privacy assessment package or the SOC 2, Type 2 would be required. The OCC is willing to accept a 3PAO Security Assessment Report in lieu of the SOC 2 report. |
| No |
| 7 |
| Does the government plan to provide proposal preparation instructions (page limits, font, graphics)? |
| Yes. See response to Question 1. |
| Yes |
| 8 |
| Does the government have a preferred format for the subcontracting plan? |
| No. However, the subcontracting plan must be in accordance with FAR 19.704 and expound on how the offeror plans to meet the subcontracting goal of 15% of total contract value. |
| No |
| 9 |
| Would the government consider subcontractor past performance if the subcontractor was a prime for that work? |
| No, the past performance records must be from the prime contractor of this effort. |
| No |
| 10 |
| Does the government have a past performance questionnaire format they would like bidders to use should CPARS not be available? |
| No, the government does not have a past performance questionnaire that is required for vendors to use. However, the past performance references should include the requirements within the ADDENDUM TO FAR 52.212-1 Instructions to Offerors-Commercial Items (June 2020). |
| No |
| 12 |
| For a system that has completed a FedRAMP 3PAO audit but is not yet in the FedRAMP marketplace, would the government be willing to accept a FedRAMP security and privacy assessment package, results of the most recent 3PAO security and privacy assessment, and a FedRAMP Security Assessment Report (all within 5 days of contract award) in place of the Statement on Standards for Attestation Engagements (SSAE) 18 SOC Type II report? |
| Yes, we are willing to accept a FedRAMP security and privacy assessment package in place of a Statement on Standards for Attestation Engagements (SSAE) 18 SOC Type II report. |
| No |
| 13 |
| For the SOC2, which of the Trust Service Categories (TSCs) need to be included? |
| A SOC 2 Type 2 Report which covers the AICPA’s Trust Services Principles and Criteria for Security, Availability, Confidentiality, and Privacy. |
| No |
| 14 |
| In Section F, page 22, Data Separation, does data that is logically segregated meet the government’s expectation or is this clause stating the need for physically segregated data? |
| Logical separation, in the form of Database-level separation, meets the government’s expectation for this solution. |
| No |
