RFQ 2032H321Q00058 - TRIP Modeling Q and A (Amend 0001).pdf

Question Number Reference Question Answer

1 Attachment 3 – Price Submission Worksheet The pricing table references the PWS sections however they do not seem to align properly with the RFQ and Attachment 1- TRIP Modeling PWS. Attachment 3 "Price Submission Worksheet" has been updated

2 Attachment 1 – TRIP Modeling PWS, Section III.A.11, Page 4: Optional CLIN

According to the Attachment 1 – TRIP Modeling PWS, Section III.A.11, Page 4: Optional CLIN develop model in a US Treasury IT environment, to be accessed via Treasury IT systems. Are vendors to provide pricing for this optional CLIN? Attachment 3 "Price Submission Worksheet" has been updated

3 Attachment 3 – Price Submission Worksheet Please confirm that that row 8 (Terrorism Risk Insurance Model – Annual Maintenance (PWS section 3.3)) is a duplicate of row 6. Attachment 3 "Price Submission Worksheet" has been updated

RFQ 2032H321Q00058 – Terms and Conditions Section 7.5.A, Page 5 and Attachment 1 – TRIP Modeling PWS, Attachment 1, Section VII.A, Page 16 references SA&A.

PWS references Technical Exhibit 2 for SA&A requirements which was not provided. Could a copy be provided? If COTS or COTS solution with some customization/modification, is the SA&A still required?

See https://csrc.nist.gov/publications/detail/sp/800-53a/rev-4/final for SA&A requirements. The PWS has been updated to replace the reference to Technical Exhibit 2 with this link.

5 Attachment 1 – TRIP Modeling PWS, Section VII.A, Page 16

Will the SA&A be performed prior to the start of the contract? No work on any work contained in this solicitation will commence prior to the award of the contract.

6 Attachment 1 – TRIP Modeling PWS Section X, Page 22 Non-Disclosure Agreements state

That a copy of the NDA is included as Attachment 1. No attachment 1 NDA was posted. The NDA has been attached to the PWS (last two pages)

Attachment 1 – TRIP Modeling PWS In Section VII Security Requirements Sections B and C, Pages 18-21

It states that “the Requirements in Section I Do Not Apply…” what document is Section I in as there is no Section I under the Security Requirements.

The PWS has been updated. The language now reads as follows: "Security Categorization (For Custom Build Models Only – The Requirements in this Section Section I Do Not Apply to Commercial Off the Shelf (COTS) Solutions):"

8 Attachment 1 – TRIP Modeling PWS May a vendor propose pricing for both a customized model and a COTS model? Yes. If proposing multiple solutions, vendors are encouraged to submit separate proposals for each alternative solution for ease of understanding and evaluation.

9 Attachment 1 – TRIP Modeling PWS What cyber data would we be provided to work with for affirmative cyber property and work comp? (NB: For property – specific cyber cover grants would be required to properly do the modeling of cyber-specific scenarios.

FIO/TRIP can provide nationwide level take-up rate percentages for standalone and/or package cyber insurance, but at no further level of detail.

10 Attachment 1 – TRIP Modeling PWS Would the members who have bought into TRIA be delineated?

FIO/TRIP/ does not understand the question and is unable to provide an answer. However, if the vendor is asking whether FIO/TRIP will identify policyholders who have acquired TRI eligible lines coverage, the answer is no. Treasury will provide available general (state level) take up rate percentages, which may be modified by locality after consultation/consent of FIO/TRIP.

11 Attachment 1 – TRIP Modeling PWS, Section VII. Security Requirements, Pages 16-21

Please confirm if contractor staff will be required to obtain personnel clearance or complete background investigation before supporting the resulting contract.

Any vendor employees who require access to Treasury IT systems will be required to undergo a background investigation and obtain a security clearance.

Attachment 1 – TRIP Modeling PWS, Section VII. Security Requirements, B. and C., Pages 18-

Please clarify “The Requirements in Section I Do Not Apply to Commercial Off the Shelf (COTS) Solutions.” What are the requirements that do not apply to COTS solutions?

The PWS has been updated. The language now reads as follows: "Security Categorization (For Custom Build Models Only – The Requirements in this Section Section I Do Not Apply to Commercial Off the Shelf (COTS) Solutions):"

13 Attachment 1 – TRIP Modeling PWS, Section VII. Security requirements, C.11., Page 19

If this contract is for commercial items as stated on RFQ Terms and Conditions, Part 1 – Schedule, Section 1, would FAR Subpart 44.4 apply and not FAR Subpart 44.2? Correct. PWS has been updated

14 Attachment 1 – TRIP Modeling PWS The RFP requests loss output at a location level detail. That information is not readily available in the industry and would be a massive database. Is the use of zip code level aggregated data for the analyses and actuarial methods to refine the loss output acceptable?

FIO/TRIP is unable to determine if the proposed approach is sufficient without further information.

Vendors are encouraged to review the solicitation for the requirements for any solution(s) and respond via proposal with all required information.

15 Attachment 1 – TRIP Modeling PWS Financial terms of loss: Given there is limited data available for modeling, it won’t be known which insurer’s will participate in a given loss and therefore the “correct/exact” TRIA deductible will not be applied but instead will have to be estimated using actuarial methods. Is this acceptable?

FIO/TRIP is unable to determine if the proposed approach is sufficient without further information.

Vendors are encouraged to review the solicitation for the requirements for any solution(s) and respond via proposal with all required information. FIO/TRIP/ expects loss estimates to be generated based upon attacks at a street address or on a GPS coordinate basis. FIO/TRIP/TRIP takes notice that calculating TRIP-related exposure will most likely be based on actuarial analysis considering other factors, including available take-up rates.

16 Attachment 1 – TRIP Modeling PWS Will FIO produce the report on losses, take up rates, etc. and the vendors role would be to review and offer suggestions on said report?

The solicitation contemplates that the vendor will generate the report. Currently, FIO/TRIP does not contemplate providing any specific information to the vendor. However, FIO/TRIP may provide any relevant information obtained via its data calls should it become available.

AMENDMENT 0001 Q&A

17 PWS Part A12a

PWS Part A12a, discusses data that will be provided. Will the data for Property, Workers Compensation and Cyber exclusively come from the TRIP Sec. 111 annual data collections? We would like to request a sample of the types of data that the contractor will be requested to model and/or is being obtained in the aggregate currently via TRIP Sec 111 reporting. In addition, if any additional custom modeling may be requested of the contractor based on data that differs from TRIP Section 111 reporting – can a sample be provided. Sample totals could be arbitrary but should represent all the same data fields and granularity of actual data available.

The data referenced in the relevant paragraph relates solely to take-up rate information, and does not involve any other model inputs, which the vendor is responsible for sourcing. Take-up rate information will be made available for Property (take-up rate is 100% for WC) on an aggregated (all relevant property lines) basis as a percentage for any state jurisdiction (e.g., Property take-up in NJ is 77%). As per the PWS, the proposal contemplates that if the vendor has ideas or proposals for incorporating more granular rates (e.g., for a particular metropolitan area) on some basis, Treasury is open to using modified take up rates, upon the contractor consulting with and obtaining FIO/TRIP’s consent. The most recent (CY 2020) applicable property take up rates based upon Section 111 data collection (2021 Data Call) are found at Appendix 2 to FIO/TRIP’s recent TRIP Small Insurer Report, which can be found at the following link:

https://home.treasury.gov/system/files/311/2021TRIPSmallInsurerReportJune2021.pdf.

Cyber take up rates are also available in the Small Insurer Report found at the above link, but only on a nationwide basis considering the nature of the TRIP Data Call.

18 PWS III Scope #2 Will the modeled deterministic loss scenarios at “specified locations in the U.S.” be based on a) specified and designated targets within the model, b) custom specified by latitude/longitude designation by FIO and/or, c) defined by the largest data accumulations themselves (e.g. automated accumulation cluster approach)?

Vendors should review Section III, Paragraph A and Paragraph A (2), which specifies the requirements for any model proposed. According to the section, “The model shall be capable of generating loss estimates (as described further below) derived from the geocoded property and employment data used within the model based upon identified attack modes taking place at any specified location in the United States as identified through queries made by FIO/TRIP. For each location, the model shall provide data output estimating the loss that would result from the attack mode taking place at a specified location, both at that specified location and emanating from the specified location given the nature of the attack.”

How any proposed model complies with the above requirement and other requirements in the PWS is for the vendor to propose. Should the proposed model be capable of providing additional information to FIO/TRIP, the vendor should include the additional capabilities of the model in its proposal.

19 PWS III Scope #4

Will the Financial impacts of TRIP (e.g. recoupment, US Treasury Shares) for each model output requested need to be modeled within the contracted model itself - or can any such calculations performed outside such model? PWS III Scope #12a - Will FIO allow for supplemental and industry data exposure accessible by the vendor to be able to disaggregated based on any lower resolution non-location level geocoded data currently available to FIO?

According to Section III, Paragraph A:

"The model shall be capable of generating loss estimates (as described further below) derived from the geocoded property and employment data used within the model based upon identified attack modes taking place at any specified location in the United States as identified through queries made by FIO/TRIP. For each location, the model shall provide data output estimating the loss that would result from the attack mode taking place at a specified location, both at that specified location and emanating from the specified location given the nature of the attack."

Any calculations regarding recoupment, US Treasury Shares, etc., may be calculated outside of the model, so long as the methodology and calculations are shared with FIO/TRIP. FIO/TRIP may share available information from FIO/TRIP with the vendor. However, the vendor should expect to supply all information on which it may rely in its analysis.

20 PWS section III.A.12.e

According to PWS section III.A.12.e (The Terrorism Risk Insurance Model shall only include loss calculations associated with property insurance and workers’ compensation insurance subject to TRIP. The model shall not seek to model losses potentially subject to liability insurance within the scope of TRIP (within the exception of cyber liability insurance, as indicated in connection with the Terrorism Risk Insurance Model – Cyber Component, as discussed in Section III.B).), and section III.B.2 (Estimates the portion of total property and casualty insurance losses sustained by policyholders that elected to obtain terrorism risk coverage, based on the attack modes listed in III.B.1. These estimates shall be made available by line of insurance.), the cyber component seems to encompasses losses arising from both affirmative cyber insurance policies and non-cyber lines' policies. Can Treasury / FIO please clarify and elaborate?

FIO/TRIP will consider all cyber modeling solutions proposed and select the solution that provides the best value to the Government. FIO/TRIP expects proposals to fully explain the functionality and capabilities of any solution proposed (i.e., whether the solution can estimate losses arising from both affirmative cyber insurance polies and non-cyber lines policies.)

21 PWS Section III.A.

According to Section III.A. (Terrorism Risk Insurance Model [Base Year]) In reference to the available traditional P&C terrorism data “…The model shall be capable of generating loss estimates (as described further below) derived from the geocoded property and employment data used within the model based upon identified attack modes taking place at any specified location in the United States as identified through queries made by FIO.” The document does not explicitly outline what data will be collected or referenced for the cyber modeling component (Section III.B). Can you please clarify and elaborate?

FIO/TRIP does take notice that cyber related losses do not model based on physical location. FIO/TRIP expects that the vendor will use its expertise in proposing and providing a model that assesses potential cyber loss events based upon whatever assumptions the vendor believes to be appropriate.

22 PWS Section III.B.1.a-c

Under Section III.B.1.a-c (Terrorism Risk Insurance Model – Cyber Component (Option Year 1), the document asks participants to “evaluate potential losses arising from cyber-attacks.” Can you please confirm whether the modeled scenarios require terrorist motivation (as opposed to cyber crimes as a result for financial gains, etc.) and if so how that would be determined?

The model should assume that the cyber-attacks modeled will be subject to TRIP and consider the relevant financial exposure, as opposed to whether a cyber-attack will be covered under TRIP. Just as the accidental detonation of a truckload of explosives at a site might not be covered under TRIP, even though it could have precisely the same effect as the same truckload of explosives detonated by a terrorist.

23 PWS Part I. 3 In Part I. 3 (Deliverables Table) The section outlining Option Year 1 references ‘date of award’ and ‘exercise of option year 1.’

Can you please describe when during the Base Year, the option year 1 will be discussed, and confirm the ‘date of award’ referenced in Option Year 1 section refers to the parties agreeing to enter Option Year 1.

“Date of award” refers to the date on any SF-30 (modification) issued by the Contracting Officer exercising an option on any resulting contract. Only the warranted Contracting Officer may bind the Government and obligate funding on this contract; any discussions between the parties are non-binding until memorialized in a modification (SF-30). Option years are normally exercised within one month of the current contract period of performance expiring.

24 PWS Please confirm that all Cyber modeling that will be requested in this PWS will be Deterministic (and not Probabilistic) All cyber modeling requirements in this PWS are deterministic and not probabilistic.

25 Options Regarding the timeline, when will the contractor(s) be advised know if FIO wants to proceed with each of the four one-year options?

Contractors will be notified in accordance with FAR 52.217-9 – Option to Extend the Term of the Contract found on page 21 of RFQ 2032H321Q00058

26 PWS Please provide additional information if available and elaborate on the security requirements included on page 5-6 of the Terms & Conditions document (also 16-17 of PWS)

Please see the PWS for security requirements. Without a specific request for information regarding the security requirements, FIO/TRIP is unable to provide further information.

27 PWS section III.H

PWS section III.H (OPTIONAL CLIN: Migration of TRIP Terrorism Risk Model) states ““FIO may require the Contractor to migrate any data and/or system comprising the TRIP Terrorism Risk Model" There are multiple requirements here, from data transfer and testing and including site surveys, preparing site facilities, etc. Can FIO provide additional information on the potential migration? For example, to what sort of system? Operated by whom? On-premises or in the cloud ?

The TRIP Risk Insurance Model is anticipated to reside in a Treasury AWS Cloud where the system would be jointly maintained by the contractor and Treasury IT; the contractor would provide maintenance and enhancements for the system by delivering the updated code for deployment into the Treasury AWS Cloud by Treasury personnel. If a commercially available off the shelf (COTS) product is selected, FIO/TRIP anticipates purchasing the modeling software and deploying it to the Treasury AWS Cloud to be placed in production. If a custom-built solution is selected, the contractor would be expected to build the system in a development environment in the contractor’s IT environment and then deliver the system to Treasury to enter into an Authority to Operate process. Upon completing an ATO process, the system would be deployed into production into the Treasury Cloud.

28 PWS Section III A.9

PWS Section III A.9 states “The Contractor shall provide FIO with access to the Terrorism Risk Insurance Model through a web- or cloud-based interactive application, or an application that provides similar functionality to FIO". Can FIO identify any limitations or preferences with regards the hosted IT configuration, for example whether public cloud services (e.g., Azure, AWS) are acceptable or whether installation on a Government/Treasury system is preferred over a private, vendor-hosted environment? We understand that the environment must meet the identified requirements, but it would be useful to understand existing constraints, if any

FIO/TRIP anticipates that any solution will reside in the Treasury AWS Cloud.

29 PWS Section XII

PWS Section XII “Data Rights” Can FIO clarify the scope of the Data Rights provision? Specifically does this include an exception for pre-existing IP developed outside of this project but deployed as part of this effort? The phrase “All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose.” is quite broad.

For any COTS solution, FIO/TRIP understands that it would not have any data rights in the underlying source code and would be purchasing a license and subject to the licensing agreement negotiated.

FIO/TRIP would most likely reserve rights in any data entered into any COTS system or any resulting data generated by any COTS system. For any custom-built solution, FIO/TRIP would expect to have ownership of any intellectual property developed as a part of the solution.

RFQ Part II Section 2.2 DTAR 1052.232-39 - Unenforceability of Unauthorized Obligations.

(Deviation 00002) (Apr 2018) Paragraphs (b) and (c), Page 24

In place of an offeror’s standard CSA indemnity provisions prohibited by DTAR 1052.232-39(b), will the agency amend the solicitation per DTAR 1052.232-39(c) – “indemnification or any other payment by the Government that is expressly authorized by statute and specifically authorized under applicable agency regulations and procedures” – to include FAR 52.250-1 and to define third-party use of the awardee’s model(s) as unusually hazardous?

The Government will include FAR 52.250-1 as part of the included clauses, however, the Government will not define third-party use of the awardee's model as "Unusually Hazardous"

RFQ Part II Section 2.2 DTAR 1052.232-39 - Unenforceability of Unauthorized Obligations.

(Deviation 00002) (Apr 2018) Paragraphs (b) and (c), Page 24

In place of an offeror’s standard CSA indemnity provisions, will the agency amend the solicitation to include a special contractual provision that the agency agrees, if asked after award by the awardee, to request Department of Homeland Security (DHS) designation of the awardee’s model(s) as Qualified Anti-Terrorism Technologies (QATTs)?

No, the Government will not seek a DHS designation of the awardee's model as Qualified Anti- Terrorism Technologies.

RFQ Part II Section 2.2 DTAR 1052.232-39 - Unenforceability of Unauthorized Obligations.

(Deviation 00002) (Apr 2018) Paragraphs (b) and (c), Page 24

Will the agency request from the Department of Homeland Security a SAFETY Act pre-qualification designation notice for the technology to be acquired under this solicitation and, if one is granted by DHS, will the agency amend the RFQ to include FAR 52.250-4?

No, the Government will not request from the Department of Homeland Security a SAFETY Act pre-qualification designation notice for the technology to be acquired under this solicitation.

RFQ Part II Section 2.2 DTAR 1052.232-39 - Unenforceability of Unauthorized Obligations.

(Deviation 00002) (Apr 2018) Paragraphs (b) and (c), Page 24

Will a condition in an offeror’s proposal – that the proposal is made contingent upon a contract provision described in Q1 through Q3, above – automatically disqualify that proposal from consideration, or might such a proposal still be considered by the agency, in its discretion, to be conforming with DTAR 1052.232-39(c)?

The added condition will not automatically disqualify a proposal from consideration, however, the Government does not intend to award a contract with the specified conditions as listed.

34 PWS, Section III.A.8 SCOPE – Terrorism Risk Insurance Model (Base Year) Paragraph 1, Page 4

The PWS specifies that geocoded property and employment information needs to be provided. Is there any requirement about the resolution of this data? Can it be derived by disaggregating exposure data to smaller geographic areas provided those can be utilized by the model to quantify the risk?

The PWS requirement is that a contractor will supply and use commercially available geocoded property and employment data. Vendors are free to propose any commercially available geocoded property and employment data that complies with the requirements in the PWS.

35 PWS Section III.A.2 SCOPE – Terrorism Risk Insurance Model (Base Year) Paragraph 1, Page 3

The PWS notes that estimates shall be made by line of insurance. To clarify, is the specific breakdown that will be necessary the split between the following two lines only: property insurance (as a whole) and workers’ compensation insurance?

The contemplated breakdown is between Property insurance lines (as a whole) and Workers’ Compensation insurance.

PWS Section III.A.12.a SCOPE – Terrorism Risk Insurance Model (Base Year) Paragraph 1, When will the Treasury FIO supply terrorism risk insurance take-up rate assumptions? If the exposure data being supplied by the Contractor is required by the 75-day period following contract award, then sufficient lead time will be necessary to produce the data in the appropriate format.

Current percentages are contained in the FIO/TRIP Small Insurer Report, which can be found at the following link: https://home.treasury.gov/system/files/311/2021TRIPSmallInsurerReportJune2021.pdf.

PWS Section III.B.1 SCOPE – Terrorism Risk Insurance Model – Cyber Component (Option Year 1) Paragraph 1, Page 5

With the inclusion of liability insurance for the cyber risk analysis, will treasury specify any specific sub-lines needed to be modeled or is it expected that the Contractor will communicate the extent to which liability insurance sub-lines are incorporated into the model?

FIO/TRIP expects that the Contractor will communicate the extent to which liability insurance sub-lines are incorporated into the model.

PWS Section III.B.1.b SCOPE – Terrorism Risk Insurance Model – Cyber Component (Option Year 1) Paragraph 1, Page 6

In modeling attacks to vulnerability in commonly used computer operating system applications such as Microsoft Windows and Mac OS, can the Treasury FIO specify whether the main concern to be modeled is data theft or some other consequence? A subsequent scenario deals with ransomware attacks which suggests this attack using OS vulnerabilities might be meant to reflect some other consequence beside ransomware.

FIO/TRIP will consider all solutions/approaches proposed by vendors and select the solution that represents the best value to the Government. FIO/TRIP expects the vendors to structure any solution to have outputs that reflect the vendor’s assessment of the principal risks presented. Any overlaps should be explained in the vendor’s response to this solicitation.

PWS Section III.B.3 SCOPE – Terrorism Risk Insurance Model – Cyber Component (Option Year 1) Paragraph 1, Page 6

For the purposes of estimating the financial impact of TRIP for cyber-attack scenarios, should the contractor assume the same structural application of the TRIP program to assess recoupment and Treasury’s share of insurance losses?

Yes, the vendor should assume the same structural application of the TRIP program to assess recoupment and Treasury’s share of insurance losses.

PWS Section III.B.4 SCOPE – Terrorism Risk Insurance Model – Cyber Component (Option Year 1) Paragraph 1, Page 6

The PWS notes that the same modeling assumptions used for terrorism take-up rates should be used for cyber. These will not only be based on a different, but relevant, set of exposures, but should apply take-up rates appropriate to cyber risk. Can the Contractor (or will the FIO) make different take-up rate assumptions between terrorism and cyber?

Treasury will provide take-up rate information for terrorism risk generally (in the Property lines) and separately for cyber coverage.

PWS Section III.C.3 SCOPE – Terrorism Risk Insurance Model – Annual Maintenance (Option Years 1 - 4) Paragraph 1, Page 7

Should any upgrades to a terrorism COTS solution result in a significantly different modeling application, would it be required or necessary to conduct additional training?

The strategy for procuring any additional required training outside of the scope of the PWS will be determined by the Contracting Officer.

PWS Section III.D SCOPE – Terrorism Risk Insurance Model – Cyber Component – Annual Maintenance (Option Years 2 - 4) Paragraph 1, Should any upgrades to a cyber COTS solution result in a significantly different modeling application, would it be required or necessary to conduct additional training?

The strategy for procuring any additional required training outside of the scope of the PWS will be determined by the Contracting Officer.

PWS Section III.E SCOPE – Report to FIO – Annual Data Collection for the Terrorism Risk Insurance Program (Option Year 1) Paragraph 1, Pages 7-8

Will FIO staff be made available to the Contractor to provide information and data related to current data collection processes that will be necessary to analyze and make recommendations?

Data related to current data collection processes will be made available to the contractor after award. In addition, FIO/TRIP staff will be reasonably available to provide information to the contractor regarding the data and data collection process.

44 PWS Section VIII, Section 508 Compliance Paragraph 1, Page 21 For COTS products which are not 508 compliant, does that exclude them from submitting a response?

For any solution proposed, Section 508 information must be included, including whether the solution is 508 compliant. Should a solution not be 508 compliant, FIO/TRIP will reasonably support a waiver for 508 compliance.

45 PWS Section XII, Data Rights Paragraph 1, Page

For COTS and/or licensed based solutions, will the government remove this request? Data and software provided or produced using Vendor solutions is typically not owned by the Government, but instead licensed for specific use.

For any COTS solution, FIO/TRIP understands that it would not have any data rights in the underlying source code and would be purchasing a license and subject to the licensing agreement negotiated.

FIO/TRIP would most likely reserve rights in any data entered into any COTS system or any resulting data generated by any COTS system. For any custom-built solution, FIO/TRIP would expect to have ownership of any intellectual property developed as a part of the solution.

46 RFQ Part 4 Section 4.2, Format for Quote Submission Paragraphs (5), Page 31

This paragraph excludes the cover page from the page count. Are Key Resumes and letters of commitment excluded from the page count for the Factor 1 - Technical Approach volume?

Yes, Key Resumes and Letters of Commitment are EXCLUDED from the page count for Factor 1 - Technical Approach

RFQ Part 4 Section 4.5, Quote Preparation Instructions Factor 3 – Relevant Experience Paragraphs (1), Page 33

Will you permit subcontractor past performance (Factor 2) and/or relevant experience (Factor 3) projects in addition to Prime Contractor to qualify in the case of COTS solutions?

Subcontractor past performance may be submitted in addition to Prime Contractor for Factor 2. Prime Contractor relevant experience is required for Factor 3

Sheet1