24 - ISS Solicitation Questions and Answers.xlsx
XLSX spreadsheet 43 KB Posted
- Attached to
- Interim Servicing Solicitation - Amendment 0001
- Solicitation number
- 91003120R00180001
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1 Attachment 24 - ISS Solicitation Questions and Answers *Contractors are advised to manually click on each of FSA's answers and review the entirety of the cell's content
| # | Topic | RFP Page/Section | Question | Answer | Does this require a revision to the ISS Solicitation or any of the attachments? If Yes, what are the proposed edits or resolution? |
| 1 | Page Limit | C.2 Proposal Volume Requirements (p. 124-125) |
| D.1 Volume 1: Technical Capability Proposal (p. 127) | Based on the page limits in section C.2 and the required sections described in D.1.1 – D.1.6, we understand the Technical Capability Proposal to have a total page limit of 70 pages, 10 pages each for the Staffing Plan, Key Personnel, and Quality Control Plan, and 40 pages for the remaining sections described in section D.1. Please confirm the total page limit for this volume and all sections of D.1 are to be submitted in a single document versus individual documents as outlined in the table in section C.2. | The maximum total number of pages for the Technical Proposal is 85 pages, plus additional attachments associated with "Appendix IRPE-G Cybersecurity Requirements". In accordance with the ISS Solicitation, C.4 Format, each volume in the proposal shall include a copy of the cover letter (letter of transmittal), title page, and table of contents. The table of contents shall list sections, subsections, and page numbers. Offerors may choose to submit as a single document or individual documents; as long as the total maximum page numbers are not exceeded for this volume. | Updated the table in the ISS Solicitation, Section C.2, Proposal Volume Requirements to reflect max number of pages for Key Personnel. | |||
| 2 | IRPE | C.2 Proposal Volume Requirements (p. 124-125) | Based on the RFP and “Additional Solicitation Requirements Volume” in section C.2, our understanding is that the only IRPE deliverables required with our proposal submission are the completed Attachment 13 - Contractor Position Mapping and System Access (D.4.3) and Contractor Software Usage information (D.4.7). Please confirm that validation and responses to the other IRPE requirements will occur as part of the award process and is not required as part of the proposal submission. | In addition to including Attachment "13 - Contractor Position Mapping and System Access" (D.4.3) and Contractor Software Usage information (D.4.7), the IRPE document, Attachment “03 – IRPE Elements v 5.0.2 incl Monitoring ISS Tailored v2”, "Appendix IRPE-G Cybersecurity Requirements" shall be completed and submitted as part of Offeror's Volume 1, Technical Proposal. For more information on this please review Attachment “09 – Pricing Template Instructions v2", Section B.7. The Offeror's answers to the IRPE questions are NOT independently part of the evaluation criteria, but may be considered to the extent that they impact risk levels related to the Technical Evaluation of one or more of the six (6) Technical Capability Subfactors. However, the costs associated with those elements or requirements, including any proposed costs for requirements in "Appendix IRPE-G Cybersecurity Requirements", must be captured in Attachment “10 – Pricing Template”. | Updated Section B.7 in the Pricing Instructions |
Updated the Solicitation Section D1 Instructions to Offerors Updated the Attachment 03 IRPE and removed all the tables and instructions for those tables within each element Updated Appendix IRPE - G, within Attachment 03 to have the original column Headers 3 Consumer Protection Compliance Template D.4.5 Special Responsibility Standards
| Attachment 15 - Instructions | Section D.4.5 of the RFP indicates the completed Attachment 15 should include legal proceedings that have reached a final disposition within the last three years; however, the instructions in Attachment 15 state within the last five years. Please confirm the scope to be included in Attachment 15. | Attachment "15 - Consumer Protection Compliance Template" has been updated to state that information for the last three (3) years shall be used to complete this document. Please refer to Attachment "15 - Consumer Protection Compliance Template v2". | This attachment was updated to reflect the revised version. | ||
| 4 | Integration | C.2.a and D.1.1 | Section C.2.a states that integration requirements will be provided post-award, via the Change Management Process, yet Section D.1 states “Offerors shall also notate the timeline and level of effort to support exposure of system data and processes for external consumption for items not currently available.” Is there scope or additional information to guide an estimate of level of effort and timeline or as indicated in Section C.2.a these will be forthcoming and offerors are not able to comply with the requested information. Please clarify how offerors should provide timeline and level of effort without knowing requirements and potential gaps. | These two (2) statements should not be read together. C.2.a, expressly speaks to future integration whose requirements will come at a later date. The general requirement here is that the Contractor has a solution that allows for integration--meaning it has data and services that can be exposed and consumed. The instructions in D.1.1 speak to the Offeror's existing data, services, and processes; specifically, the instructions requests that the Offeror explain what it would take and the level of effort needed to expose (or refactor) all of its available data and services such that an external solution could consume them to perform loan servicing. FSA is not asking that the Offeror propose a solution to a specific set of requirements or to a specific solution at this time. FSA seeks to understand the full set of data services and processes of each ISS Contractor, and what it would take and level of effort to make that available for use by an external application/solution. | |
| 5 | Physical Documentation | C.3.b.i.4 Interim Servicing Solution | Given the current TIVAS transfer process (utilizing the EA80 electronic file), what physical documentation is required to be transferred to the contractor and what is the anticipated volume? | Borrower records include both electronic and physical documentation that will be transferred to ISS Contractors. The actual volume of these documents is not known. FSA prefers that all borrower records are in an electronic format. | |
| 6 | Partner Portal | C.3.d.ii | Can FSA provide more detailed requirements in the "01 - Business Operations Servicing Requirements" for the Partner Portal. Only high-level requirements are provided in Section C.3.d.ii. If these are to be defined post-award via the Change Management process, how should the offeror capture any detailed gap or features in our solution description and pricing? | Section C.3.d.ii provides the requirements associated with the partner portal. Offerors shall propose their technical solution for meeting the requirements identified in the ISS Solicitation and the Offeror's Price Proposal shall reflect the costs associated with meeting these requirements. |
| 7 | Specialty Tasks | D1.5 - Specialty Servicing Tasks | Within the SOW in Section D.1.5 and Subfactor 5 of the evaluation criteria it references "inclusive of how the Offeror intends to implement a technology solution that can manage up to 100% of the Specialty Servicing Tasks." Does the 100% refer to all of the outlined specialty servicing tasks (i.e., all 6 of 6) and/or does it reference 100% of the volume for whichever tasks are awarded to the winning ISS bidders. | Offerors shall describe how they can manage all Specialty Tasks, as well as how they can manage up to 100% of the volume for each of the Specialty Tasks. |
| 8 | Specialty Tasks | D1.5 - Specialty Servicing Tasks | Within the SOW in Section D.1.5 and Subfactor 5 of the evaluation criteria it references "inclusive of how the Offeror intends to implement a technology solution that can manage up to 100% of the Specialty Servicing Tasks." In the staffing plan and technology plan, should the offeror still only plan to 50% of the specialty volume (as indicated in the Q&A for general benchmarking and scaling baseline), or should the staffing plan and pricing models assume an offeror could be doing 100% of a function in case a Specialty Servicing Task is only assigned to a single ISS provider? | Offerors shall describe how they plan to implement the requisite technologies for and staff up to 100% of the volume. Pricing models should assume 100% of the volume and may include economies of scale with pricing tiers. For Specialty Servicing Tasks, or any other tasks that could benefit from economies of scale, the pricing tiers should be provided in the other costs portion of the Pricing Template and described in the Supplemental Price Narrative. |
| 9 | Specialty Program Requirements - Teach & PSLF | Please provide drivers and/or resource estimates for the tasks associated with the TEACH and PSLF programs to help in determining staffing based on the volume estimates that were provided? | FSA will not provide resource estimates. FSA has provided additional information in the ISS Solicitation, Section C.7 Expected Volumes. Please note this information does not guarantee the level of work or volume in the future. Offerors should use this information, in conjunction with required service levels, to determine resources needed to meet the Government's requirements. | ||
| 10 | Borrower Status Definitions | B.1 Payment of Operation & Maintenance Costs | In Section B.1 Payment of Operation & Maintenance Costs of the RFP, borrowers in current repayment status are defined as less than 31 days delinquent. Should that read as less than 6 days delinquent? | The definition has been updated to read less than 6 days delinquent. | Updated Section B.1 definition for Current Repayment |
| 11 | Service Level Agreements | 03 - IRPE Elements page 44 and 08 - ISS SLA Performance Measurements row 34. | Appendix IRPE-D of the 03 - IRPE Elements document outlines Service Level Agreements for e-QIP submissions which conflict with or are not also included in the 08 - ISS SLA Performance Measurements document. Can the conflict be resolved? | The e-QIP Service Level Agreement (SLA) in "Appendix IRPE-D Service Level Agreements" of Attachment “03 – IRPE Elements v 5.0.2 incl Monitoring ISS Tailored v2” matches to the SLA listed in row 34 of Attachment "08 - ISS SLA Performance Measurements". FSA did remove the disincentives that were listed in Appendix IRPE-D Service Level Agreements. | |
| 12 | Evaluation Criteria | B.1 Proposal Evaluation Criteria Factor 1: Technical Capability | According to Section D.1 Proposal Evaluation Criteria Factor 1: Technical Capability, an Offeror's proposed strength must relate to "risk reduction or faster timelines or both." Would FSA consider additional benefits as strengths or will FSA only score those that tie to the two categories listed? If yes, are risk reduction and faster timeline benefits weighted higher than other potential benefit categories that an offeror’s strength delivers on? | In regards to B.1 Proposal Evaluation Criteria Factor 1: Technical, FSA will not consider additional benefits as strengths, other than the two (2) categories listed. | |
| 13 | Level of Effort | D.1.1 and D.1.5 | In sections D.1.1 and D.1.5, the RFP asks for offerors to provide a level of effort for various tasks (integration, specialty program tasks), yet in the introduction of D.1, FSA explicitly states that no pricing information is to be provided as part of the Technical Proposal. Is FSA looking for total number of FTE hours (without the bill rate) in the Technical Proposal even though level of effort directly correlates to pricing? | Offerors shall provide the proposed labor categories and estimated number of hours by labor category necessary to execute the various tasks. No pricing information shall be included in the Offeror's Technical Proposal. The Offeror's Price Proposal will contain the requisite pricing information (consistent with instructions by contract year). | |
| 14 | Level of Effort | D1.1. and D.15 | In areas of the response where FSA is seeking level of effort, should the offerors assume this is level of effort as related to implementation tasks and potential requirement gaps, vs. effort tied to recurring operational tasks that will be captured in the ongoing unit pricing for providing the services requested? | FSA is seeking detailed level of effort for all tasks under the ISS Solicitation. | |
| 15 | Additional Solicitation Requirements (Volume 4) | D.4.9.b | Requirement b in Section D.4.9 Additional Solicitation Requirements states that offerors should include the completed EDAR 3452.209-71 Conflict of Interest Certification with their proposal submission. However, EDAR 3452.209-71 is titled Conflict of Interest and does not require completion. Please confirm FSA intended to require EDAR 3452.209-70 Conflict of Interest Certification. | EDAR 3452.209-70 Conflict of Interest Certification has been included in the ISS Solicitation. Offerors are required to submit this certification as part of Volume 4, Additional Solicitation Requirements. | Updated ISS Solicitation to include this clause. |
| 16 | Additional Solicitation Requirements (Volume 4) | C.2 Proposal Volume Requirements (p. 124-125) | The following documents are not listed as solicitation requirements in section C.2, but appear to be proposal submission requirements based on the FAR language. Please confirm whether any of the following are required for submission. |
- 52.203-2 Certificate of Independent Price Determination
- 52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment
- 52.204-26 Covered Telecommunications Equipment or Services - Representation
- 52.222-42 Statement of Equivalent Rates for Federal Hires
| - 52.227-15 Representation of Limited Rights Data and Restricted Computer Software | Offerors shall include the referenced provisions and clauses in Volume 4, Additional Solicitation Requirements as required in the ISS Solicitation, C.2 Proposal Volume Requirements, and D.4.9 Additional Solicitation Requirements. Any other solicitation requirements and/or provisions shall be included in this volume. | Updated in the ISS Solicitation. Updated C.2, D.4.9. | ||||
| 17 | FAR Language | FAR 52.213-3 Offeror Representations and Certifications - Commercial Items | The FAR clause on page 96 of the RFP, Offeror Representations and Certifications-Commercial Items, appears to be misnumbered (52.213-3 instead of 52.212-3). Please confirm 52.212-3 is the intended clause. | This was a typo. The correct FAR clause number is 52.212-3. | Updated in the ISS Solicitation. | |
| 18 | Data Segregation | IRPE Requirement 6.5 | Is the technical proposal associated with data segregation as defined in IRPE Section 6.5 required to be submitted as an additional attachment with the Technical Proposal (outside of the 40 page limit) if the offeror is not planning on having full data segmentation at the time of ATO or is it due upon an ISS award and not part of this solicitation response? | Attachment "03 - IRPE Elements v 5.0.2 incl Monitoring ISS Tailored" was revised. The individual elements in Attachment "03 - IRPE Elements v 5.0.2 incl Monitoring ISS Tailored v2" do not require answers as part of the proposal process. The Solicitation has been updated for all Offerors to complete "Appendix IRPE-G Cybersecurity Requirements" within Attachment 03. For elements that are not met in Attachment 03 or requirements in "Appendix IRPE-G Cybersecurity Requirements", Offerors shall include pricing details in the Supplemental Price Narrative. Please also see FSA's response above to Question #2. Offerors are reminded that "Appendix IRPE-G Cybersecurity Requirements" is still required and shall be completed and submitted along with the Offerors' proposal. | ||
| 19 | Data Segregation | 03 - IRPE and 05 Cybersecurity | In Attachment 03 – IRPE Elements section 6.5 Data Segregation it states “we are not expecting the offerors to meet this requirement as of Go Live,” however in Attachment 05 – Cybersecurity Timeframes item 1061.0000 it indicates that both logical and physical segregation are marked as must have for an ATO. These statements appear to be inconsistent regarding the required timing for logical and physical segregation. Can FSA please clarify? | This requirement has been revised. Attachment "05 - Cybersecurity Timeframes" is hereby deleted. Data Segregation is a mandatory requirement to maintain an ATO. FSA understands that as of Go Live not all the ATO requirements will be met. Under the FSA ATO process, FSA will accept risks with regard to data segregation based on the Offeror's proposal as to how they will mitigate or correct the risk. It is expected that each Offeror will correctly identify any shortfalls and provide corrective action plan(s) with specific timelines. The ATO memo will provide specific conditions and timeliness for remediation of risks that FSA assumes. | ||
| 20 | Cybersecurity Requirement | 05 - Cybersecurity Timeframes and 03 - IRPE Elements v 5.0.2 incl Monitoring ISS Tailored | In the Attachment 05 - Cybersecurity Timeframes, there are a number of differences from the 03-IRPE Elements v 5.0.2 incl Monitoring ISS Tailored appendix IRPE-G Cybersecurity Requirements. Which document is the correct list of cybersecurity requirements that will be required for contract award? | Attachment "05 - Cybersecurity Timeframes" is hereby removed from the ISS Solicitation and should not be considered as part of the Offeror's proposal. | ||
| 21 | Pricing | D.3.1 - Basis of estimates | Does FSA want basis of estimate to be included as additional tabs within the 10-Pricing Template.xls or within the D.3.2 Supplemental Price Narrative? | The basis of estimates shall be included in the Supplement Price Narrative. Please be sure to clearly annotate what each basis of estimate is referring to in Attachment "10 - Pricing Template". | ||
| 22 | Pricing | Att. 9 - Subsection A3 | Please confirm “1. Outbound postage cost per letter” is inclusive of any outgoing physical correspondence (regulatory, statement, FSA directed, etc.)? | Outbound postage cost per letter is for any outbound mail. | ||
| 23 | Pricing | C.3.b.2 | Will the ISS provider be required to maintain the same hours of operation as BPOs at the time BPOs come on line? If yes, please provide clarity on what functions would be required during all operating hours given the functions that the ISS provider will supply post-BPOs coming on-line? | No. During the transition of Labor Loan Servicing to BPO Contractors, ISS Contractors will be responsible for performing Monday through Friday 8:00 AM to 9:00 PM (EST) and Saturday 7:00 AM to 2:00 PM (EST). Please note during the transition of Labor Loan Servicing to BPO Contractors, the hours of operation for BPO Contractors will be modified to match those of the ISS Contractors. Once Labor Loan Servicing activities have been completely transitioned to BPO Contractors, ISS Contractors shall provide Technology Loan Servicing (including Help Desk Support) for the expanded hours of operation for BPO (6:00 AM to 11:00 PM (EST), 7 days a week, excluding Federal holidays). | ||
| 24 | Pricing | ISS Call Management System | Are there requirements of what solutions are required to be provided as part of the call management system? | Call Management System requirements are intertwined with the Loan Servicing Requirements of ISS. There are requirements in the ISS Solicitation for hours of operations and SLAs that must be met by the Call Management System. There are also requirements for system access and work processes that would include the Call Management System. Offerors are expected to provide a Call Management System that meet the requirements of the ISS Solicitation. | ||
| 25 | Pricing | Att. 9 - Subsection A3 | The Pricing template contains a row for postage cost per letter. Would FSA be open to treating postage expense as a pass through? In the template, respondents are effectively guessing what USPS rates will change over 10 years and thus FSA or Contractor could have significant price risk (e.g. a respondent proposes $0.01 per annum increases but postage stays flat; in this case FSA would be over-paying. Conversely, a $0.02 increase would put the contractor in the negative.). | Yes, FSA will consider offers of a direct pass-through cost. Please provide cost details in the Supplemental Price Narrative. | ||
| 26 | Migrations/Pricing | Data migration is an IRPE requirement and FSA has asked for all IRPE implementation costs to be captured in a single row in the pricing template, should the offeror include costs associated with data migration within this pricing element? If not, where should the cost of the data migration be captured? | FSA will pay no costs for Offerors to utilize existing EA27 and EA80 Process. Should the Offeror propose an alternative approach, the Offeror shall describe all elements as delineated in IRPE 6.4 Data Migration Planning along with the cost for this approach. Any enhancements or modifications to the Contractor’s system that requires data to be migrated will adhere to the requirements of IRPE 6.4 Data Migration Planning. | |||
| 27 | Migration/Pricing | A) Should offerors expect additional supplemental history files for the customer account migration of specialty programs? |
B) Should the specialty program migration be included in pricing or will it follow the change management process? A) The following files are supplemental files that are listed in Attachment "01 - Business Operations Servicing Requirements v2":
- PSLF file – PSLF specific info (this is the ONLY supplemental file specific to a specialty program)
- REPAYE file – Has information about this unique pay plan that EA27 was not fully updated to support
- PAYE file – Has some information about this unique pay plan that EA27 was not fully updated to support
- Cancer Deferment – Has some info specific to cancer deferment eligible borrowers
- TEACH program – Has unique record types within the EA27 specific to TEACH
- TPD – Has another files specific to TPD (LHN files) that are not ‘transfer files’/sent with transfers
B) Costs for implementing the Specialty Programs are directly related to system enhancements necessary to meet requirements. FSA will pay no separate or additional costs associated with migrating borrowers in a Specialty Program.
| 28 | IRPE | Please confirm that for IV&V and other external audits or quality controls being performed by FSA or another subcontracted entity, the offeror should not bear any of the costs other than the offeror's own internal costs to support the external validation/audit. | Offerors are expected to support audit and Quality Assurance activities at no additional cost to the Government. Contractors are expected to perform their own quality control activities at no additional cost to the Government. | |
| 29 | 01 Business Operations Servicing Requirements | Requirement 20015.00 | Requirement 20015.00 in Attachment 01 states the servicer shall assign cycle date (due date) to each borrower and maintain it at a borrow level. Is it FSA’s intention to remove the possibility for borrowers to have split due dates? This is many times done at the request of the borrower. | No. |
| 30 | Volume Assumptions | In the ISS solicitation and pricing volume assumptions, FSA does not indicate a loan count to accompany the estimated borrower volume. Can FSA provide an assumed average number of active loans per borrower to be used across all offerors in performance testing and data migration assumptions? | The average number of loans per borrower is ~5.2 loans. This has been updated in Section C.7.1, Expected Volumes in the solicitation. | C.7.1 updated | |
| 31 | 02 Financial Technical Requirements | If an existing TIVAS is selected for ISS, will they continue to process under their current Servicer ID and ALC or will new ones need to be obtained? | If an existing Servicer is selected as an ISS Contractor, FSA does not anticipate a new Servicer ID and ALC will be required. | ||
| 32 | IRPE | IRPE Section 4.1.1 | IRPE Section 4.1.1 lists applicable Terms and Conditions; among those listed is EDAR 3452.239-71, which requires compliance with the Security and Privacy Requirements for Information Technology Procurements document. Section 2.12 of the Security and Privacy Requirements for Information Technology Procurements requires contractors to “[m]maintain tools and capabilities to support behavior monitoring, to include NetFlow analysis and network traffic capture, which captures the Transmission Control Protocol/Internet Protocol (TCP/IP) stream, allowing for replay of activity to determine what happened during a breach or incident.” |
| Does this requirement apply to all traffic between any hosts within the System Authorization Boundary, all traffic entering/exiting the System Authorization Boundary, or something else entirely? If this requirement applies only to the traffic entering/exiting the System Authorization Boundary, may we assume the TIC/MTIPS will have this capability? | This applies to all traffic between any hosts within the System Authorization Boundary and all traffic entering/exiting the System Authorization Boundary. This requirement is independent of the DHS requirement for Trusted Internet Connections. | |||
| 33 | IRPE | IRPE Section 4.1.1 | IRPE Section 4.1.1 references applicable Terms and Conditions; among those listed is EDAR 3452.239-71, which requires compliance with the Security and Privacy Requirements for Information Technology Procurements document. Section 2.31 of the Security and Privacy Requirements for Information Technology Procurements document implies that unrestricted information can leave the System Authorization Boundary via a route other than the TIC. |
| Does this mean (for example), that unrestricted information can flow from our segmented “ED network” to our corporate network without going through the TIC? | All Federal data must transit a Trusted Internet Connection. | ||||
| 34 | IRPE | IRPE Sections 2.4 and 2.4.1 | What is the difference between IRPE requirements 2.4 and 2.4.1 (if any)? | Numbering errors were corrected in Attachment "03 - IRPE Elements v 5.0.2 incl Monitoring ISS Tailored v2". As a direct result the referenced elements are now 2.3.1, Contractor support of FSA Technology refreshment and Evergreening and 2.3.2, Contractor support of Application and enabling components and Frameworks Evergreening. Element 2.3.1 addresses keeping the platform up to date and Element 2.3.2 addresses keeping the application layer technologies up to date. Element 2.5, contractor Software Usage was renumbered to 2.4. | |
| 35 | IRPE | IRPE Section 6.7 | Regarding “All applications and infrastructure residing in or connecting to an FSA data center shall be IPV6 compatible and compliant” (in IRPE section 6.7), may we assume the TIC/MITPS will provide the IPv6-level connectivity to FSA data centers? | Yes. | |
| 36 | Personnel Security | M. 3452.239-71 |
| Requirement 1008.0300, 1008.0400 | Based on Requirements 1008.0300 and 1008.0400, are only High Risk and Moderate Risk clearance allowed to support the ISS contract? | Yes. | |||
| 37 | IRPE | Appendix IRPE-G Cybersecurity requirements | Since the ISS is defined as a moderate risk system, is requirement 1950.000 N/A for this contract? | Requirement 1950.000 is applicable to this solicitation and resulting contract. The Contractor shall apply elevated levels of protection for higher-risk systems and assets. The statement is not related to the FIPS 199 categorization that is MODERATE. Because of the nature of the system, the PII elements and the financial data the system may be determined to be a High Value Asset under DHS guidance. High Value Asset (HVA) is information or an information system that is so critical to an organization that the loss or corruption of this information or loss of access to the system would have serious impact to the organization’s ability to perform its mission or conduct business. | |
| 38 | IRPE | Section 3.3 Property Management Plan | What Government Furnished Equipment (GFE) will be provided as part of the ISS contract that will be covered by the Property Management Plan? | At this point in time FSA has not developed a listing of GFE for the ISS Contract. This requirement is listed in order to care for any potential GFE issued in the future. | |
| 39 | IRPE | Appendix IRPE-G Cybersecurity requirements: |
| Requirement 1050.0200 | Will FSA provide the required tokens as required by requirement 1050.0200? | No. The requirement states “If vendor proposes use of its corporate tokens to meet FSA’s requirements, vendor shall demonstrate to FSA that without exception it can achieve Identity Assurance Level (IAL) 3, Authenticator Assurance Level (AAL) 3, and Federation Assurance Level (FAL) 3 authentication and meet all FSA requirements.” | |
| 40 | IRPE | Appendix IRPE-G Cybersecurity requirements: |
| Requirement 1056.0130 | For requirement 1056.0130, will FSA provide the required .gov URL? | Yes. | |||
| 41 | IRPE | Appendix IRPE-G Cybersecurity requirements | Can FSA provide the ED Cyber Security Job Aid? The URL referenced in requirement 1056.01280 of IRPE-Appendix G is not accessible. | Attachment "03 - IRPE Elements v 5.0.2 incl Monitoring ISS Tailored v2" inclusive of "Appendix IRPE-G Cybersecurity Requirements", Number 1056.0180 has been revised to remove this requirement that reference the ED Cyber Security Job Aid. This is a duplicate requirement and not necessary for Offerors to respond to this solicitation. | |
| 42 | Page Limit | D.1.3 | Can offerors use the 10 pages allocated to the key personnel section to highlight overall delivery structure, along with 5 bios, not to exceed 10 pages? | Yes, as long as the total page limitation is not exceeded. | |
| 43 | Security | General | In the NextGen briefing call that FSA hosted on 10/28, it was reference multiple times that one of the ‘new’ requirements of the ISS Solicitation was going to be revised cybersecurity requirements focused on the NIST 800 171 controls. After review of the ISS solicitation attachments, there does not seem to be any reference to the NIST 800 171 controls as the baseline expectation for the ISS offerors to be compliant with. Can FSA clarify if the ISS vendors should be expected to be compliant with NIST SP800-53, or NIST SP800-171? | NIST 800-53, current rev, is applicable for all ISS Contractors and solutions. "Appendix IRPE-G Cybersecurity Requirements" requirements 1000.0100, 1000.0110, 1000.0210, 1000.0600, 1002.0100, 1002.0700, 1002.0800, 1036.0000, 1044.0100, all reference NIST 800-53. NIST 800-171 is not mentioned in any of the requirements. | |
| 44 | Additional Solicitation Requirements | General | Can offerors submit a requirements compliance matrix (to map solicitation requirements to the offeror’s response) as part of the Additional Solicitation Requirements volume? | No. |
| 45 | Pricing | The requirements speak to the capability to execute customer outreach, but does not outline a level of effort required. This is critical to providing an accurate basis of estimate and directly impacts proposed pricing. Can FSA provide an outreach strategy by which offerors should provide pricing (e.g. X phone attempts per borrower within Y delinquency range)? | Offerors should refer to the requirements in the ISS Solicitation and the associated attachments (e.g. "01 - Business Operations Servicing Requirements v2", 24000 Communication List, 24005 Due Diligence Delinquency Calls, 24009 Pre-Repayment Contact, and 24012 Skip Tracking Matrix). These detailed Business Operations Servicing Requirements delineate the minimum requirements for outreach campaigns (e.g. number of call attempts, at primary and alternate numbers, within specific timeframes). These attachments contain the level of detail necessary for Offerors to propose outreach approaches that meet the Government's minimum requirements. This includes outreach as part of default aversion, early awareness, and skip campaigns (e.g. telephone and address). | ||
| 46 | IRPE 6.6 | IRPE 6.6 Data Management Documentation | Please define the information required for detailed source target mapping deliverable? | Please see data management artifacts available on the IT Standards Library: https://studentaid.gov/about/contracting-info/it-standards. | |
| 47 | 59 | IV Contract Clauses, J.52-217-8 Option to Extend Services | Please confirm that contractors are not expected to provide separate pricing with this response for any potential six-month extensions under the referenced FAR 52.217-8? | Any extension under this clause will be at the applicable contract year's pricing. | No change required. |
| 48 | Pages 11, 14, 127 | II/IX.D.1 | Does FSA expect Vol. 1: Technical Capability Proposal to include C.3.b Interim Servicing Solution and C.3.d Digital Engagement Layer requirements from the SOW? These are not itemized in section IX.D. INFORMATION TO BE SUBMITTED AS PART OF THE OFFERORS’ PROPOSAL. | Offerors' Technical Proposals shall describe their ability to meet the requirements emphasized in the six (6) subfactors for Evaluation Factor 1: Technical. | |
| 49 | Pages 127-128 | IX.D.1 | Does FSA expect Vol. 1: Technical Capability Proposal to be organized in order according to the instructions in section IX.D.1? If so, sections D.1.2 Staffing Plan and D.1.3 Key Personnel, having their own page limits, will inflate the Technical Capability page count because they come after D.1.1 Scaling, Performance Testing, and Migration Capability and before D.1.4 Fulfillment Management Capability. | In accordance with the ISS Solicitation, C.4 Format, "Each volume in the proposal shall include a copy of the cover letter (letter of transmittal), title page, and table of contents. The table of contents shall list sections, subsections, and page numbers." Offerors may choose to submit as a single document or individual documents; as long as the total maximum page numbers are not exceeded for this volume. | No change required. |
| 50 | Page 14 | FSA requires the following: "The ISS Contractors shall provide timely support for FSA’s future state processing solution from requirements gathering through development, including access to the ISS Contractors’ Subject Matter Experts and solution set (e.g. system code, workflows, processing tools and infrastructure/environment, etc.)." |
| Consistent with commercial arrangements, please confirm that FSA is not expecting extensive access to the code and other trade secrets of the licensed servicing system software, or the ability to re-use the code? If FSA does have such an expectation, please indicate why that access is necessary, how that access would be circumscribed and limited, and whether and how any third party taking part in that access would be required to keep the information confidential. Also please indicate whether the requirement to support will come through a task order for reasonable remuneration, or whether this assistance is to be included in existing pricing. If the latter, please indicate (in addition to the prior answer about the code) the likely scope of the expected assistance. | FSA does not intend to re-use the ISS Contractor's code, so no additional costs shall be included in the Offeror's proposed pricing. FSA does not intend to violate any intellectual property rights. FSA does expect to have access to the code as part of its oversight responsibilities and shall not incur any additional ISS costs associated with the performance of those activities. FSA may also leverage a third-party vendor to review the ISS Contractor's code and shall not incur any additional ISS costs associated with the performance of those activities. Any third-party review will be subject to comparable Non-Disclosure terms and conditions as those included in the ISS Solicitation. Specifically precluding further disclosure of information received as part of the execution of that contract and precluding the use of the information beyond that necessary to support the contractual obligations with the Government. | |||||
| 51 | Page 17 | Section C.6, Deliverables | Please clarify why deliverables, such as “Solution Development Processes” are required to be provided as some appear to be beyond what would typically be provided in a commercial software engagement. | Solution Development Processes are required to meet the Government's obligation to perform comprehensive oversight of systems development and operations activities (under Federal Information Technology Acquisition Reform Act, Clinger-Cohen Act, and other Government IT mandates) and to satisfy security requirements that relate to system lifecycle, such as NIST SP 800-53, controls SA-3 and SA-8 (which are required for ATO). | ||
| 52 | Please confirm that FAR 52.212-1, -4, and-5 are applicable. | FAR clauses 52.212-4 Contract Terms and Conditions-Commercial Items, 52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders-Commercial Items and 52.215-1 Instructions to Offerors-Competitive Acquisition are applicable and included in the ISS Solicitation. | No change required. | |||
| 53 | FAR 52.217 applied only to the database in the last solicitation. Is this true this time? | Please note the correct FAR citation is FAR 52.227-17 Rights in Data-Special Works. Please review FSA's answers to Questions #01 (above) and #54 (below). | ||||
| 54 | Please clarify how routine updates to, and “evergreening” of, the system should be viewed in light of the idea of "data first produced" in the context of the Contract. (FAR 52.227-14) i.e.; are routine system upgrades and improvements considered “data first produced in the performance of” the ISS Agreement? Is anything in the scope of ISS, except data produced in response to an explicit task order requiring data as a deliverable, or data related to system stand-up, going to be considered “data first produced” in the context of the contract? | All dependent software in the solution is maintained to FSA's standard of N -1. |
The Government expects the platform and application to be kept up to date per evergreening requirements and that documentation is provided showing how it is kept up to date. Consistent with IRPE requirement 5.1 and security requirements such as NIST SP 800-40 Guide to Enterprise Patch Management Technologies.
Refer to FSA's answer to Question #01 above regarding rights to source code and "first data produced" aspect of the question. Again, FSA does not intend to receive rights to the code, unless otherwise specifically stated in the contract or any subsequent modifications to the contract.
| 55 | IRPE - Security Requirements | IRPE item 4.3 states that the Contractor shall ensure that the system and associate technologies "meet all requirements" for cybersecurity including the "cybersecurity scorecard". Can FSA confirm that this cybersecurity scorecard is the "risk scorecard" that is currently in use? | Yes. It is the Department's Cybersecurity Framework Scorecard produced on a monthly basis. |
| 56 | Future Solicitation | Reference of the "future state of a single servicing platform operating environment, to be Acquired in a future solicitation" in the ISS solicitation, please provide the timing for the procurement and award of this platform? | There is no timing for the procurement or award of a single system for NextGen. |
| 57 | Imaging, Printing, and Mailing | FSA states that "Contractor(s)’s solution shall be integrated with Workflow Management, imaging, Digital Platform, and CRM, among other solutions." Are these named solutions expected to be accounted for by ISS or through integration with another FSA contracted solution? If the latter, when will integration specifications be made available? | At time of contract award, the ISS Contractors' solutions shall be integrated within systems owned by or licensed to the Contractor. Future integration with other NextGen solutions will be executed via the Change Management Process. |
| 58 | Digital Engagement Layer | Operating Element C.3.A.ii states that the transfer of accounts should include a variety of data elements including auto-pay preferences and contact preferences. In many cases customer preferences and communication consents would have been established between an FSA customer and a prior originator or servicer under a company name and branding experience that will differ from ISS. |
a) Is it FSA's expectation that ISS contractors can use these preferences provided by the prior servicer regardless of the circumstances under which the preferences were established?
| b) Is it FSA's expectation that regulatory consents such as TCPA (and similar) can be used as-is by ISS contractors if the consents are provided by the prior servicer during account migration? | Offeror's proposed solution shall meet the Government's requirements in the ISS Solicitation. The remaining questions are related to the Government's position or policy around the use of prior consent, and expectations around the application of non-Title IV statutes and the regulations thereof. This information is not required to propose a solution to meet the Government's requirements. | ||||
| 59 | Deliverables | The FSA Deliverable Table (page 18) uses terms such as "5 business days after award" and "within 40 Business Days of contract award". In this context are the terms "award" and "contract award" interchangeable or do these terms have different meanings? If the latter, please define each term. | There is no difference with the use of these terms. However, FSA has updated the ISS Solicitation to state "contract award". | Updated ISS Solicitation. | |
| 60 | Security Requirements | The draft version of the security requirements spreadsheet contains an un-numbered item in row 147 which states that contractors shall comply with policies and standards in the "Information Technology Resources Risk Management section of this document". This section cannot be found. Can FSA publish this document or otherwise advise as to where the document can be found? | Attachment "03 - IRPE Elements v 5.0.2 incl Monitoring ISS Tailored v2", "Appendix IRPE-G Cybersecurity Requirements" was revised. Row 147 was deleted and numbers were added to the other requirements that were previously unnumbered. | ||
| 61 | Proposal Volume Requirements | Does the table on pages 124 and 125 of the RFP constitute a full and complete list of all deliverables that FSA expects to be provided upon submission? | No. FSA expects Offerors to submit the items identified for each volume along with any other solicitation requirements and/or provisions. | ||
| 62 | IRPE | A) Per the table on pages 124 and 125 of the solicitation it is clear that IRPE section 2.5, Contractor Software Usage is required for proposal submission. Does FSA expect the entire IRPE Attachment to be completed and submitted or does FSA expect only the details requested in IRPE section 2.5? |
B) If the entire document is to be completed, then regarding the various tables of assertion and the column labeled “Do You Meet the Requirement”, is a simple Yes expected, if applicable?
C) Or is an answer of “How” also expected. It is clear that if the answer is No, then the second column requires an answer of “How”. A) Attachment "03 - IRPE Elements v 5.0.2 incl Monitoring ISS Tailored v2" was revised and it no longer requires completion of the referenced tables. Offerors are reminded that "Appendix IRPE-G Cybersecurity Requirements" is still required and shall be completed and submitted along with the Offerors' proposal. Please note that 2.5, Contractor Software Usage has been renumbered to 2.4 in Attachment "03 - IRPE Elements v 5.0.2 incl Monitoring ISS Tailored v2".
B) The individual elements in Attachment "03 - IRPE Elements v 5.0.2 incl Monitoring ISS Tailored v2" do not require answers as part of the proposal process. However, if there are costs associated with any of the individual elements or "Appendix IRPE-G Cybersecurity Requirements" those costs must be placed in the Attachment "10 - Pricing Template", Tab "Pricing Template", Row 40. Offerors shall review and comply with the instructions in Attachment "09 - Pricing Template Instructions v2" and the ISS Solicitation.
C) Refer to part A above.
| 63 | IRPE | IRPE item 6.5, Data Segregation, states "we will need a Technical Proposal with a detailed plan and milestone dates that show when this requirement can be met" however the solicitation does not appear to include a requirement for project plan. Can FSA expand upon its expectation for a "detailed plan"? | Attachment "03 - IRPE Elements v 5.0.2 incl Monitoring ISS Tailored v2" was revised. Offerors are no longer required to submit a Technical Proposal with a detailed project plan for this requirement. Offerors are reminded that "Appendix IRPE-G Cybersecurity Requirements" is still required and shall be completed and submitted along with the Offerors' proposal. |
| 64 | General Solicitation | The physical separation requirements on page 22 of the Attachment 03 (IRPE Elements) document are inconsistent with a Commercial Items Contract. Will FSA remove this requirement out of the ISS solicitation? | The data segregation requirements are specifically defined in "Appendix IRPE-G Cybersecurity Requirements" of Attachment 03. This is a Federal requirement and it will not be removed. |
| 65 | General Solicitation | The COTS Licensing requirements on page 15 of the Attachment 03 (IRPE Elements) document are inconsistent with a Commercial Items Contract (e.g., transferring ownership of licenses procured by the contractor to FSA upon Acquisition). Will FSA remove this requirement from the ISS solicitation to comply with FAR Part 12? | Attachment "03 - IRPE Elements v 5.0.2 incl Monitoring ISS Tailored v2" was revised. FSA does not require COTS licenses to be transferred unless otherwise requested via the Change Management Process. |
| 66 | General Solicitation | The answer to question #17 of the pre-solicitation conference Q&A states that the ISS solicitation is a free and open competition, however the answer to question #39 points out “this is a recompete for existing servicing” (referring to ISS). The requirements in the ISS solicitation appear to be unduly restrictive to a potential bidder that is not already a TIVAS with an in-house system/platform (e.g., the limited transition period allowed to implement the solution and migrate accounts). Will FSA amend the ISS solicitation to maximize competition and ensure best value to the Government? | Although this procurement is a recompete of current contracts, this is an unrestricted full and open competitive solicitation. There is no limitation allowing only incumbent contractors to submit a proposal. While incumbent contractors may have a fairly acquired competitive advantage, all timely submitted proposals will be evaluated pursuant to the terms of the Solicitation. |
| 67 | General Solicitation | Section C.5.4 on page 17 of the solicitation states that FSA seeks solutions that provide all Specialty Servicing Requirements immediately after contract award. These requirements are very unique, and not consistent with a Commercial Items Contract. Additionally, asking for the requirements to be ready immediately after contract award is unduly restrictive to a full an open competition. Will FSA modify this requirement to allow for bidders to propose a more flexible implementation approach and timeline for transition (to provide the Specialty Servicing Requirements) in order to support competition? | Please refer to the ISS Solicitation, Section C.5 Milestones; specifically, C.5.4. Offerors are not required to provide all Specialty Servicing upon award, but those that offer Specialty Servicing implementation sooner will be more competitive than those who offer Specialty Servicing later. FSA has a statutory mandate to execute all Loan Servicing Programs provided for under the law. The Specialty Servicing Programs are existing requirements that must be continued by FSA without lapse. FSA has crafted a requirement that has provided for the maximum competition practicable. Offerors are required to provide an implementation approach that can begin being executed upon award, including a proposed timeline for transitioning support. Offerors' proposals will be evaluated in accordance with the applicable evaluation factors in the ISS Solicitation. |
| 68 | General Solicitation | Only three entities own a viable Title IV loan servicing system/platform. By awarding ISS to only two vendors the Servicing platform component of a future state of a single servicing platform operating environment award will be limited to the two ISS vendors selected. These two systems will continue to evolve while the third will either be retired or otherwise not exist in a state to be reasonably competitive for a future state platform solicitation and award. Will FSA amend the ISS solicitation to allow for awarding to three vendors to assure full and open competition for the future state single servicing platform? | No amendment is necessary. There is an inaccurate assumption being made that only one of the ISS Contractors could successfully compete for a future state servicing system. |
| 69 | General Solicitation | During the Pre-Solicitation Conference on 9/8 FSA communicated that it cannot extend the existing TIVAS and NFP contracts beyond December 2021 and March 2022, respectively. The answer to Question #82 in the recently published ISS Pre-Solicitation Q&A indicates the same constraint. Given these constraints, how could implementation dates for Specialty Servicing of December 31, 2021 or December 31, 2022 be possible? | The dates in the ISS Solicitation are correct and should be used as a basis for Offerors' proposals. |
| 70 | General Solicitation | During the Pre-Solicitation Conference on 9/8 FSA communicated that it cannot extend the existing TIVAS and NFP contracts beyond December 2021 and March 2022, respectively. The answer to Question #82 in the recently published ISS Pre-Solicitation Q&A indicates the same constraint. If an offeror submits a proposal that includes an implementation plan that does not complete prior to the end of the current TIVAS and NFP contracts, will FSA's evaluation of the proposal be deemed to meet or not meet related ISS requirements? | Please refer to FSA's answer to Question #67 above. |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .