IMIS RFP Questions Final.docx

Office of Inspector General Legal Services Corporation 3333 K Street, NW, 3rd Floor Washington, DC 20007-3558 202.295.1660 www.oig.lsc.gov

Software Development and Maintenance Q&A

1. The OIG estimates the annual total cost of this contract will be capped at $30,000. Does that mean that this solicitation will not pay more than $30,000 for the year?

Answer: After further consideration, the OIG will extend this cost and pay no more than $35,000 per year for this contract. The OIG estimates the level of effort for this project to be about 20 hours per month. Should the level of effort exceed the $35,000 cap, the OIG will work with the contractor to determine the best path forward.

2. The RFP document in section B. Price states that OIG estimates the annual total cost of this contract will be capped at $30,000. Can you please clarify how much support and website changes will be required weekly or daily? Do you have an automated process currently in place for application and database monitoring? How many people are currently supporting the application?

Answer: The OIG estimates the level of effort for this project to be about 20 hours per month. We do not currently have an automated process in place for application and database monitoring. Currently, this application is supported by one individual.

3. Can I use a subcontractor for this solicitation?

Answer: Yes, as long as the prime takes full responsibility for the work product.

4. Firstly, I would like to understand the financial parameters set forth in the RFP. Specifically, the statement indicating, "Price: The OIG estimates the annual total cost of this contract will be capped at $30,000" requires further explanation. Does this figure represent a legally mandated spending cap, an allocated budget for this contract, or is it reflective of a government stakeholder's desire to maintain costs at this level?

Answer: The OIG estimates that the level of effort for this project should not exceed $35,000 (an increase) at standard rates for the services requested. We estimate the level of effort to be about 20 hours per month. It is not a mandated spending cap, nor a desire to maintain costs, but a reasonable estimate based on our understanding of the level of effort required. Should the level of effort exceed the $35,000 cap, the OIG will work with the contractor to determine the best path forward.

5. In terms of the contracting model, I am interested in knowing if an hourly rate is the sole billing approach under consideration for this project.

Answer: Yes. An hourly rate is our preferred approach as while the number of hours per month is estimated to be 20, this number could fluctuate up or down from one month to the next.

6. Further, information regarding any incumbent contractor would be invaluable. Specifically, details such as the name or the Federal Procurement Data System (FPDS) ID of the award would greatly aid our preparation process.

Answer: The previous contractor is not listed in FPDS as we are not a federal agency, nor is the previous contract available to view. The previous contractor was only doing software updates, not security patches. Therefore, the current contract will be larger than the previous current contract, which was valued at $5,000 per year.

7. Lastly, I seek clarification on the statement: "Right to Reject: The OIG reserves the right to reject any and all proposals received in response to this RFP." I am keen to understand the rationale behind this clause, as it appears to grant broad discretion in the proposal evaluation process which can be a cause for concern from the point of view of industry, especially if you also retain the right to share our proposals with others.

Answer: This clause is typical in RFPs. We are not obligated to consider any and all bids, and we do have broad discretion. However, we strive to treat all bidders fairly and evaluate bids appropriately.

8. It states that the capped annual price for the contract is $30,000. I just want to confirm that is correct?

Answer: Correct (although now capped at $35,000). The OIG will pay no more than $35,000 per year for this contract. The OIG estimates the level of effort for this project to be about 20 hours per month. Should the level of effort exceed the $35,000 cap, the OIG will work with the contractor to determine the best path forward.

9. Is there an incumbent on this contract? If so, please provide the incumbent name, current contract number, Period of performance, value of the contract.

Answer: The previous contract has expired. The previous contractor is Clarks Consulting. The contract does not have a number. As the Legal Services Corporation is not a federal agency, OIG contracts are not available on federal websites. The previous contractor was only performing software updates, not security patches. Therefore, the current contract will be larger than the previous contract, which was valued at $5,000 per year.

10. Is this RFQ a new contract or an incumbent?

Answer: The previous contract has expired. However, the contractor was only performing software updates, not security patches. Therefore, the current contract will be larger than the previous contract, which was valued at $5,000 per year.

11. In case this RFQ is an incumbent, please share Name of the contractor and contract Number.

Answer: The previous contract, with Clarks Consulting, has expired. The contract does not have a number. As the Legal Services Corporation is not a federal agency, OIG contracts are not available on federal websites. The previous contractor was only performing software updates, not security patches. Therefore, the current contract will be larger than the previous contract, which was valued at $5,000 per year.

12. How does a single day at work in-house looked like for DB support personnel?

Answer: DB support was on an on call basis when an enhancement was requested. A single contractor would complete the DB work needed for the enhancement of the software. Few software enhancements were requested, totaling less than 20 hours per year in 2023. Going forward, the DB support will include monthly security checks, followed by patches as needed, in addition to software enhancements.

13. Do you need the candidate to possess any clearances, if so, what are those?

Answer: No clearances are needed.

14. Are the positions open only to citizens or non citizens on work visa can also become part of the project?

Answer: Non-citizens are acceptable.

15. Can you provide more details on the expected workload in terms of number of enhancement requests, bug fixes, support requests etc. that would need to be handled per month/year? This will help estimate the level of dedicated FTE needed.

Answer: While we do not have a number for specific enhancements, bug fixes, etc., the OIG estimates the level of effort for this project to be about 20 hours per month.

16. The RFP mentions the total annual cost is estimated around $30,000 but does not provide exact details on the expected labor hours. Can you provide an estimate of the number of hours per year you expect for software development/maintenance, DBA work, security auditing, technical support etc.? Is this need based work, if yes, than how many hours per week or month?

Answer: The OIG estimates the level of effort for this project to be about 20 hours per month. The majority of the work will relate to software maintenance and security patches.

17. For tasks like application monitoring, optimization, vulnerability assessments - what is the expected frequency and effort level needed? Is this an occasional annual review or monthly checks?

Answer: Work will be performed on a monthly basis. Software and Security reports will be initiated monthly, and findings will need to be addressed. Findings from security reports will set the level of effort, currently estimated at about 20 hours per month.

18. What are the currently used development methodologies and SDLC processes? Are there expectations to follow specific agile frameworks or waterfall models?

Answer: The OIG currently does not use any development methodologies or SDLC processes. The contractor may use any framework that they are comfortable with that works for their staff. We have no expectations for development models or frameworks.

19. Is all the development and maintenance work expected to be done remotely or is there an expectation to be onsite at times?

Answer: We anticipate all work to be done remotely. Previously, all work was completed remotely.

20. Can you describe the team on the client side that would collaborate with vendor's team on requirements planning, managing backlogs, testing etc.? What is the expected working relationship?

Answer: The OIG team will include one IT staff member, his supervisor, and occasionally one or two members of the end-user unit, which is a unit of seven.

21. How many environments does the application have like dev, test, QA, prod? Would maintenance/support be needed for all environments?

Answer: The application has one production environment. It has no development, test, or QA environments.

22. Is there flexibility in contract duration or mechanism for easy extensions if needed? A multi-year contract would help retain staff long term.

Answer: Yes. The contract can be extended if the OIG and contractor agree, and it meets our needs.

23. Are there any expectations regarding knowledge transfer to client staff or specific documentation to be maintained?

Answer: We request documentation of monthly findings and the remediations undertaken. We also request documentation of any software maintenance done. Should the contractor have recommendations for improvements to software maintenance, we would request they document the recommendation and share them with the OIG.

24. Dedicated PM is required for the scope of work? How many FTEs expected Answer: A dedicated PM is not required. The OIG estimates the level of effort for this project to be about 20 hours per month, so less than one FTE will be required.

25. On pg. 4, it says the cost of the contract will be capped at $30,000. Is this number accurate?

Answer: Yes. The OIG will extend this cost and pay no more than $35,000 per year for this contract. The OIG estimates the level of effort for this project to be about 20 hours per month. Should the level of effort exceed the $35,000 cap, the OIG will work with the contractor to determine the best path forward.

26. Since this solicitation is full and open, would you consider requiring a small business utilization component?

Answer: No. The OIG welcomes proposals from all types of businesses and will consider small businesses, but we will not require a small business.

27. Could you provide further details about the estimated number of hours expected annually for the support and maintenance services outlined in the RFP? This information will help us better structure our proposal in terms of pricing and resource allocation.

Answer: The OIG estimates the level of effort for this project to be about 20 hours per month.

28. In section IV.B of the RFP, it mentions that the estimated annual total cost of the contract will be capped at $30,000. Does this cap encompass the entirety of the support and maintenance services, or are there additional budgetary allocations for specific aspects of the project?

Answer: This cap (increased to $35,000) encompasses the entirety of the work. The only other work anticipated would be infrequent meetings to update the OIG on the status of work.

29. Regarding the technical qualifications required, could you provide more insight into the weighting of criteria for evaluation, specifically for the past performance, staff qualifications, and project plan and approach sections?

Answer: We anticipate criteria to be weighted at about 35% for past performance, 35% for staff qualifications, and 30% for project plan and approach.

30. Are you open to rewriting the entire program with all existing features, and additional features requested as well, in a more modern and newer front end tech stack using .NET/C# instead of ColdFusion?

Answer: No.

31. Please provide the names of the Incumbent vendors for this contract?

Answer: The previous contractor was Clarks Consulting.

32. Can you please provide incumbent bid tabulation and/or pricing contract?

Answer: The previous contractor’s contract is a T&M contract with a cap of $5,000.

33. How many active contractors are working on this contract currently?

Answer: One contractor is working on this contract.

34. Do you intend to move incumbent contractors to new vendors, if the incumbents are not awarded again?

Answer: We will not move incumbent contractors. The new contractor would need to provide their own staff.

35. Can you please provide a copy of the proposals for the incumbents from the current contract?

Answer: We cannot provide incumbent proposals.

36. What is the new budget per year for this bid?

Answer: The new budget is estimated at $35,000 per year.

37. Do you have an estimate on how many resources will be placed each year?

Answer: We estimate less than one FTE for a total of 20 hours per month.

38. How many vendors do you intend to award?

Answer: We plan to award to one vendor.

39. When do you anticipate this contract to start?

Answer: We anticipate the contract will begin by April 15.

40. When do you anticipate this contract to start requesting resources?

Answer: We anticipate this contract will start requesting resources April 15.

41. Please confirm that cover letters, title pages, table of contents, and table of figures are exempt from page count.

Answer: Cover letter, title pages, table of contents, table of figures are not included in the page count, nor are appendices or resumes.

42. Would the government allow a price proposal to be submitted in a separate volume outside of the existing 6-page allotment?

Answer: Yes.

43. Is there a page limit to the pricing proposal?

Answer: No.

44. Is there a file type (excel sheet, PDF) restriction for the pricing proposal or any appendix to the pricing proposal?

45. Answer: No, though Excel, Word, or PDF are preferred.

46. Please confirm that resumes are included outside of page count of technical volume Answer: Resumes are not included in the page count.

47. Would the government allow past performance references to be submitted outside of page count?

Answer: Yes. Past performance may be excluded from the page count.

48. Who is the incumbent contractor?

Answer: Clarks Consulting

49. What are the current Service Level Agreements (SLAs) for response times, issue resolution, and other critical metrics to which the Incumbent contractor performs as a part of the current contract?

Answer: There are no current SLA’s for the software. Generally, the past Contractor responded to the OIG and began work to resolve functional technical issue (not enhancements) within one business day of a technical support request. We anticipate response times, issue resolutions, and other critical metrics to be identified as a part of the new contract.

50. "The Offeror’s proposal should be no more than six pages long." Does the page count include only the Tech Volume, or does it include the Price Volume as well? Which pages are excluded from page count (e.g., title page, table of contents, and etc.)?

Answer: The page count does not include cover letters, title pages, table of contents, table of figures, cost volume, appendices, resumes, or past performance references.

51. Are these servers physical or virtual servers?

Answer: Virtual

52. What is the architecture of the application, where the software is running? Are the IIS, and SQL Server running on one Windows server or different servers?

Answer: All the software IIS, SQL, and ColdFusion are running on one Windows Server.

53. What are the versions of the Microsoft Server, SQL Server, Internet Information Server, ColdFusion, etc.?

Answer: Microsoft Windows Server 2022, SQL Server 2022, IIS 10, and ColdFusion 2023

54. Is the same Offeror expected to conduct IT security audits as well as maintenance updates and security fixes?

Answer: Yes, the same firm, which could include a subcontractor.

55. What kind of non-technical qualifications are required for the staff - i.e. US Citizenship, permanent resident, public trust clearance etc.

Answer: Staff must be legally permitted to work in the United States. No clearances are required.

56. Are there specific features or aspects of IMIS that you consider crucial, and we should highlight relevant experience in those areas?

Answer: ColdFusion, SQL and IIS experience are crucial.

57. Can you provide specific examples of the types of code changes and enhancements that may be needed?

Answer: Code changes and enhancements, including reporting and use enhancements, are required when our unit requests them, which is rare, or when application or security scans find items requiring remediation.

58. How frequently are code changes and enhancements anticipated?

Answer: Few software enhancements were requested in 2023, totaling less than 20 hours per year. We anticipate 2024 to maintain a similar level of effort.

59. What tools or metrics are currently used for monitoring the IMIS application's performance?

Answer: None. Response times, issue resolutions, and other critical metrics should be identified as a part of the new contract.

60. Can you provide more details on the predefined SLAs for performance monitoring?

Answer: There are no current SLA’s for the software. Generally, the past Contractor responded to the OIG and begun work to resolve functional technical issue (not and enhancements) within one business day of a technical support request. We anticipate response times, issue resolutions, and other critical metrics to be identified as a part of the new contract.

61. Are there known performance bottlenecks that should be addressed?

Answer: There are currently no known bottlenecks.

62. Are there specific performance metrics or benchmarks for optimizing Microsoft SQL Server databases?

Answer: Currently , we do not have any SLA’s for the software. Generally, the past Contractor responded to the OIG and begun work to resolve functional technical issue (not and enhancements) within one business day of a technical support request. We anticipate response times, issue resolutions, and other critical metrics to be identified as a part of the new contract.

63. Could you elaborate on the project management activities expected to ensure effective coordination with the OIG?

Answer: Regular meetings with IT staff to provide updates on work completed.

64. Are there specific certifications or qualifications that you prioritize for the staff assigned to this project?

Answer: At minimum, assigned staff should have certifications and qualifications relevant to Microsoft Windows for Server and Desktop OS application and security patching, as well as qualifications and certifications for SQL.

65. Could you clarify the desired level of experience for the proposed staff?

Answer: Staff should have a minimum of 3 years’ experience in application and security patching for Microsoft Windows for Server and Desktop OS, and for SQL.

66. Are you open to exploring updates or changes to the current technology stack, or is the preference to maintain the existing stack with technologies such as Microsoft SQL Server, Adobe ColdFusion, and Windows Server?

Answer: We wish to maintain the existing stack.

67. If open to changes, are there specific technologies or platforms you are interested in exploring, or any constraints we should be aware of?

Answer: We are not open to change.

68. Is the cover sheet and table of contents exempted from the 6-page limit?

Answer: The page count does not include cover letters, title pages, table of contents, table of figures, cost volume, appendices, resumes, or past performance references.

69. Does the client want us to provide our in-house candidate for this project?

Answer: In-house candidates are preferred, but subcontractors are acceptable as long as the prime takes full responsibility for the work product.

70. Will the Agency consider the Sample resume for now?

Answer: Yes.

71. Is the resume should be out of the 6-page limit?

Answer: The page count does not include cover letters, title pages, table of contents, table of figures, cost volume, appendices, resumes, or past performance references.

72. How many hours per week does the agency anticipate for this project?

Answer: The OIG estimates the level of effort for this project to be about 20 hours per month.

73. Would you be open to considering a replacement candidate with either equal or superior qualifications in case the proposed candidate is not available at the time of joining??

Answer: Yes

74. Is there any incumbent for this opportunity?

Answer: Yes. Clarks Consulting is the incumbent.

75. If there is an incumbent then why are you looking for other companies? Are you not satisfied with the previous incumbent?

Answer: The previous contractor was only performing software updates, not security patches. The OIG seeks to enter into a new contract that includes both security checks and patches, as well as software enhancements.

76. Is the current incumbent bidding for this opportunity?

Answer: Yes. We anticipate that the previous contractor will bid on this opportunity.

77. What is the current framework for existing web application?

Answer: ASP.

78. What is the preferred platform for the development of web application?

Answer: Currently the OIG has no preferred platform.

79. Who is the current web hosting provider?

Answer: The platform is internally hosted.

80. What is the data transfer limit / bandwidth?

Answer: 100mb

81. What are the current key metrics for monitoring the performance of the web application?

Answer: We do not have any metrics for monitoring performance. Generally, the past Contractor responded to the OIG and begun work to resolve functional technical issue (not and enhancements) within one business day of a technical support request. We anticipate response times, issue resolutions, and other critical metrics to be identified as a part of the new contract.

82. What is the current size of the database as we want to measure the current size of the user bank?

Answer: The database is less than 200GB. Currently it has seven users.

83. Are there any specific requirements or preferences for data integrity and consistency and compliance that contractor should consider?

Answer: There are no specific requirements currently.

84. What predefined SLA do you require?

Answer: There are no current SLA’s for the software. Response times, issue resolutions, and other critical metrics should be identified as a part of the new contract.

85. Could you elaborate on the current bug tracking and reporting process? How is severity prioritized, and what tools or systems are currently in place for reporting issues?

Answer: We do not have a formal process for tracking and reporting bugs or issues.

86. Are there any particular security incidents or threats that have been of concern in the past, and how have they been addressed?

Answer: This information should not be disclosed in a public forum.

87. How is the technical support currently structured for end-users and internal staff? Are there established channels for reporting issues?

Answer: Currently, the Unit point of contact emails the contractor directly for technical support. We are looking to create a formal reporting channel that will include the contractor, IT, and end users/internal staff.

88. What level of user training and documentation updates are typically required, and are there any specific training materials currently in use?

Answer: Minimal user training is required, nor are there any training materials currently in use. The contractor should train staff on any modifications to the software that impacts their use. We request documentation of monthly findings and the remediations undertaken. We also request documentation of any software maintenance done. Should the contractor have recommendations for improvements to software maintenance, we would request they document the recommendation and share them with the OIG.

89. Could you please clear the dates mentioned in the RFP for inquires and submission as the dates mentioned in the RFP are January 10, 2023, and January 24 2023 respectively?

Answer: An updated version of the RFP was uploaded to indicate that deadlines are January 10, 2024 and January 24, 2024.

90. What is are the software versions for MSSQL, Windows Server, and the Adobe Coldfusion engine?

Answer: Microsoft Windows Server 2022, SQL Server 2022, IIS 10, and ColdFusion 2023

91. Is the custom web app built with a ColdFusion framework (e.g. ColdBox, FuseBox, Mach II, FW1)?

Answer: No

92. What technology is being used for the front end?

Answer: ASP

93. What source control software is being used?

Answer: The OIG is not using source control software currently.

94. How is your infrastructure setup (Load balancer, Traditional Server -how many?-, Container, etc.), and where is it hosted?

Answer: The OIG maintains a traditional Virtual Server on premise. No load balancing is required.

95. Is the custom web app a multi-tenant application?

Answer: No. It is not.

96. Is the custom web app deployed as a single instance or are there multiple instances?

Answer: It is deployed as a single instance.

97. Is there a single database?

Answer: Yes

98. Do you have a Test / Staging Environment?

Answer: We do NOT have a test/staging environment.

99. Are you using distributed cashing (e.g. with Redis, Couchbase, Mongo)?

Answer: No, we are not.

100. How do you deploy code from local development (the developer’s machine) to production?

Answer: Previously, a majority of the changes were made manually to the production system after the developer tested on its own machine.

101. Is there an existing backend and/or frontend testing suite?

Answer: There is NOT an existing backend or frontend testing suite.

102. Are the testing frameworks automated?

Answer: No.

103. What is the current test coverage?

Answer: There is no current test coverage.

104. If the work is performed remotely, how will our team members be granted access to work on the source code and database?

Answer: The contractor’s team members will be granted access remotely and directly to the software on the server.

105. Do you already have a Ticket management system and/or a Support Service Desk?

Answer: This software is not managed with tickets or a support desk. Previously, a POC for the unit would reach out to the contractor and communicate changes needed.

106. Will our team be the only ones working on the custom app, or will there also be internal staff working on it?

Answer: The contractor’s team will be the only people working on the software.

107. Where is documentation being kept?

Answer: There is no documentation currently kept.

108. What is the current documentation coverage?

Answer: There is no documentation currently kept for code, API, or Test.

image1.png image2.png