ATTM 4_RFP_Questions Response Form_Combined .pdf

ATTM4_RFP_QUESTIONS

Solicitation Document Page / Paragraph Requirement / Portion Questions/Concerns/Comments OPM Response i.e. Attachment 1 Requirement

Description

Applicable Page and

Paragraph Numbers.

Identify the requirement or portion to which exception is taken. Describe in detail, questions, concerns, comments, etc.

Attachment 1A-PWS Page 3, Section C ATO If the incumbent has an active ATO, will this carry over into the new contract or will a new ATO be required?

An ATO is specific to a particular contract and contractor. If the incumbent were to win award, their active OPM ATO would be able to carry over from the old contract to the new contract as long as the signing OPM Authorizing Official and System Owner remain the same, the system boundary has not changed, and the terms of the ATO conditions are being met. A risk analysis will still need to be completed by OPM Cybersecurity to determine that those terms are being met. The ATO from the incumbent would expire if a new contractor wins the award as only one contractor may hold an active ATO for the same requirement at the same time.

Attachment 1A-PWS, Addtional

IT Compliance Requirements

Page 4, Section D, top of page, first paragraph System logs

Can OPM elaborate on what costs could be expected related to the processing of system logs that must be provided to the OPM Chief Information Security Officer (CISO)?

The Contractor’s solution shall at the time of award be capable of integrating with the OPM’s Security Information Event

Management (SIEM) capability, sending operating system, database, and web application event logs in comma-delineated electronic format to the OPM in real-time continuously, via

Application Programming Interface (API) feeds or other automated mechanism.

See revised language in Section II.D. Additional IT Compliance

Requirements in the Performance Work Statement.

Attachment 1A-PWS, Claim

Payment to Participants Page 13, 1., 3rd bullet Debit Card

The Ordering Period begins on January 1, 2026. Given the significant work necessary to establish a debit card with OPM's unique security requirements including the separate database and no co-mingling of data, would OPM be amenable to the card being effective at a later date, such as 1/1/27?

OPM and the selected vendor need ample time to define requirements and obtain OPM approval on each piece. We want to ensure a smooth implementation and the best participant experience. Items to consider include, but are not limited to, the following:

*Selection of card type to implement (full HCFSA, RX-only, IIAS-only)

*Set up a single card environment for OPM due to the separate database requirement, which will also be required at the bank and card vendor

*Card package design with fully custom branding and language

*Card substantiation rules (pharmacy, co-pays, card turn-off, etc.)

*Set up card IVR for particpant inquiries

*Establish an OPM-specific web portal at the card vendor for particpants and internal teams for support

*Coordination with paperless reimbursement carriers

*Establishing custom, unique file exchanges with bank and card vendor due to the separate database, which requires a completely separate setup and file exchange

*Updates to web site (online account, mobile app, FAQ's, banners, message board, etc.)

*Custom employee communications/plan and training documentation

*Card package mailing timeline

OPM is amenable to the card being effective at a date later than January 1, 2026. The effective date proposed by the offeror will affect the evaluation of the proposal.

Attachment 1A-PWS, Claim

Payment to Participants Page 13, 1., 3rd bullet Debit Card

Given Open Season occurs through early/mid December, is OPM amenable to cards not being in the hands of its participants after 1/1 of any year? There is unlikely enough time between the end of

Open Season and 1/1 for 500K cards to be printed, mailed and received by participants by 1/1 so it may be closer to mid to late January.

OPM is amenable to debit cards not being delivered to participants until mid-January of the 2026 plan year. For subsequent years, debit cards should be delivered by 1/1.

Attachment 1A-PWS, Claim

Payment to Participants Page 13, 1., 3rd bullet Debit Card

Please confirm that "opt-in" means that participants will need the ability to select either Paperless

Reimbursement or the debit card upon enrollment? Also, please confirm this selection will apply to the entire year, and participants will not be able to "switch" back and forth during the year to minimize duplicate payments.

OPM will consider any limitations or restrictions regarding the

Debit Card and the interaction with Paperless Reimbursement in its evaluation of the proposal.

Attachment 1A-PWS Page 19, 9c. Customer

Service, Website Website

Does the utilization of Login.gov phishing-resistant MFA solution that is currently being used meet the requirements outlined in this section as it relates to login and security? Yes.

Attachment 3C 1752.224-71 Identification and Authentication Certification (Dec 2023) In what section should this documentation be included? Please confirm this will not apply to the the

25-page limit. Submit in Part 1 – Criteria 6. This is not part of the page limitiation.

Attachment 3C 1752.239-79 Data Protection Requirements Certification (Dec 2023) In what section should this documentation be included? Please confirm this will not apply to the the

25-page limit. Submit in Part 1 – Criteria 6. This is not part of the page limitiation.

Attachment X Page 4, second paragraph Proposal submission date 2pm ET on Monday, May 26th

Given that Monday, May 26th is a Federal holiday, and the Federal goverment is closed, would

OPM been amenable to extending the due date, such as Wednesday, May 28th? This would ensure confirmations of receipt of the proposals could be received before the deadline. Please see due date in amendment.

Attachment X Criteria 3: Minimum

Experience Identify any/all customers

The Experience Questionnaire indicates the offeror should identify all/any customers from whom your company provided FSA administration services within the past ten (10) years. This could easily exceed 100K clients. Considering this, if the offeror provided 10-20 separate customers from the last tean (10) years as long as the overall total participants across those clients is 50% of the current number of FSAFEDS participants (which is currently 494K) be sufficient ot meet this requirement?

The offeror should identify enough customers to demonstrate that they meet the criteria stated in Criteria 3: Minimum

Experience.

Attachment X Criteria 3: Minimum

Experience Identify any/all customers To confirm, the list of clients may include active as well as non-active clients? Yes

Attachment X Criteria 5: Subcontractor

Compliance

Submit Ownership and Place of Performance Compliance Form for all proposed subcontractors.

We are unable to locate the "Ownership and Place of Performance Compliance Form" for all proposed subcontractors in the RFP packet. Please provide this form.

This will be submitted by offerors with their proposal to identify ownership and place of performance. This is not a form provided by OPM.

SAM.gov listing

Under the section”1.

Questions” on the SAM.GOV

Contract Opportunity summary page

Attachment 4 item missing Under QUESTIONS, it states there is a Tab 2 on Attachment 4 with the 2020 RFP Q&A, but it does not appear to be included. Can OPM update the document to include this information? OPM has answered questions received with this document. The inclusion of Tab 2 on Attachment 4 is no longer relevant.

Attachment 3a Provisions FAR 52.222-56 Certification Regarding Trafficking in Persons Compliance Plan

(OCT 2020)

In what section should this documentation be included? Please confirm this will not apply to the the

25-page limit. Submit in Part 1 – Criteria 6. This is not part of the page limitiation.

Attachment 3c OPM Clauses 1752.224-70

1752.224-72

Identification and Authentication

Protecting Information

Login.gov recommends using OIDC over SAML due to it's modern, modern phishing-resistant MFA solution for native mobile applications and web, and is what is currently being utilized for

FSAFEDS login. Please confirm that OIDC is an acceptable SSO solution supported by Login.gov.

OIDC is currently being used by other programs.

The Contractor’s solution shall at the time of award have the capability to integrate directly with the OPM’s Azure Active

Directory (AAD) identity provider and SSO mechanism, having the built-in ability to accept a Security Assertion Markup

Language (SAML) assertion from a third-party software provider.

Attachment 3c OPM Clauses 1752.224-70

1752.224-72

Identification and Authentication

Protecting Information

Today, Login.gov requires a "back-up plan" for those employees who are unable to complete the

Identity Verfication (IDV) process through the online solution. Employees must contact their ABO and have the ABO send a secure message to FSAFEDS validatig the employee's identity and employment status before FSAFEDS can allow access to the site. Please confirm this "back-up plan" will still be required going forward.

Yes, a Login.gov back-up plan will continue to be required moving forward.

Attachment 3b FAR Clauses

52.222-26 Equal Opportunity

Based on Executive Order 11246, we understand that this particualr FAR Clause will not, at this time, be enforced. Is our understanding correct? Is it also correct that if EO 11246 is ever modified or revoked, the intention is that this award will be subject to 52.222-26?

The contract will comply with the Federal Acquisition

Regulation (FAR) and will reflect any revisions made to the FAR as required by Executive Orders and the FAR.

Attachment 1a PWS

Page 4 or 38

Section II.D

Additional IT Compliance

(last paragraph)

The Contractor is responsible for the costs to meet evolving government IT requirements and maintain certifications.

Will OPM consider modifying this provision to allow for the contract to provide for a contract modification or equitable adjustment to the price consitent with applicable law to fairly and seprately compensate the Contractor for additional costs of developing and implementing any evolving government IT requirements? In the alternative, This is a Firm Fixed Price contract and the offeror is responsiblity for proposing costs to meet the needs of the requirement. Any additional work required that was not defined will require a modification.

Attachment 1A-PWS, Prevention and Reporting of Fraud, Waste and Abuse (FWA)

Page 21, 10b, i Establish and maintain a fraud hotline for reporting allegations of

FWA

Would OPM be amendable to leveraging the current FSAFEDS toll-free number for reporting fraud?

Yes.

Attachment 1A-PWS, Claim

Payment to Participants Page 13, 1., 3rd bullet Debit Card

While a card for DCFSA is not required, if the offeror decides to include this feature, will OPM be able to provide a pre-fund amount to ensure compliance with IRS guidelines that stipulate DCFSA expenses can only be reimbursed to what is on deposit in the account? Or would OPM expect the participant to be advised not to use the card until the account is funded AND also after dates of service have been rendered?

OPM will review the proposed solutions and evaluate them according to the evaluation criteria.

Attachment 1A-PWS, Claim

Payment to Participants Page 13, 1., 3rd bullet Debit Card

Would OPM be amenable to allowing its participant card data (demographics, last 4 SSN, transactions, and balance) to be integrated with the established card database and files already being sent to the card vendor and funds being transmitted to the and/or bank?

No. FSAFEDS data must remain separate from non-Federal data.

ATTM X_ Proposal Instructions -

Evaluation pg. 10 Section 1 - Factor 4: Betterment Promises

Is OPM open to proposed solutions that allow the government to centrally manage FSAFEDS and

BENEFEDS programs under one unified benefits platform with a contractor that has existing past performance and existing integrations with all Federal payroll providers?

No. The BENEFEDS system is distinct from the FSAFEDS program and includes services for programs other than

FSAFEDS.

ATTM 1b_Appendices A through

H and Exhibit J

Pg. 13 Appendix G Appendix G Is OPM able to provide more recent participation information for enrollments in the years of 2020-

2024? Yes. An updated Appendix G has been provided.

Attach 2_ Pricing Proposal

Schedule.

Pg 1 Estimated Quantity Does the government anticipate any changes in the estimated order quanitities with active Reduction

In Force announcements across multiple agencies? Yes, however OPM is not able to provide estimates.

ATTM X Proposal Instructions -

Evaluation Pg. 7 Factor 1: Financial Capability and Financial Risk

Will OPM require bidders to disclose if they, or their parent companies/private equity owners, are currently for sale or in negotiations for sale?

If a company is sold a novation will be required in accordance with the Federal Acquisition Regulation.

ATTM X Proposal Instructions -

Evaluation Pg. 7 (Criteria: Current Ratio) Financial Ratios Evaluation

Can OPM clarify how the evaluation of the Current Ratio will ensure fairness towards companies actively managing working capital and reinvesting cash into their operations, potentially impacting short-term asset and liability balances? This requirement is not in Attachment X. OPM has no response.

ATTM X Proposal Instructions -

Evaluation Pg. 7 (Criteria: Current Ratio) Treatment of Participant Funds

Does OPM require participant funds managed by the Contractor to be held off-balance sheet in a trust account, and how does the evaluation of financial ratios consider participant liabilities held on the Contractor’s balance sheet? This requirement is not in Attachment X. OPM has no response.

ATTM X Proposal Instructions -

Evaluation

Pg. 7 (Criteria: Debt to Equity

Ratio) Debt to Equity Ratio Calculation

Will participant funds held by the Contractor be excluded from the calculation of the Debt to Equity

Ratio, recognizing these funds as liabilities that do not reflect operational debt? This requirement is not in Attachment X. OPM has no response.

ATTM X Proposal Instructions -

Evaluation

Pg. 7 (Criteria: Debt to Equity

Ratio) Public vs. Private Companies

Is the Debt to Equity Ratio designed to favor publicly traded companies with established equity structures, and if not, how does OPM ensure a fair evaluation for privately held or pass-through entity businesses? This requirement is not in Attachment X. OPM has no response.

ATTM X Proposal Instructions -

Evaluation

Pg. 7 (Criteria: Capital

Turnover Ratio) Capital Turnover Ratio Accuracy

Given that working capital typically represents only a subset of total assets, is OPM open to revising or clarifying the capital turnover ratio calculation to avoid misleading representations that suggest the possibility of a ratio exceeding 1.0? This requirement is not in Attachment X. OPM has no response.

ATTM X Proposal Instructions -

Evaluation Pg. 10 Section 1 - Factor 4: Betterment Promises

Could OPM clarify if alternative benefits or service enhancements beyond those specified are permissible under the scope of Factor 4: Betterment Promises?

Yes, alternative benefits or service enhancements are permissible as long as they comply with IRS requirements for

FSAs.

Attachment 1a Performance Work

Statement Pg. 7, Section V.A.1 Eligible Employee Population & Participation Data

Given the approximate eligible population of 2 million employees stated, can OPM provide updated participation numbers for each FSA type (Health Care FSA, Dependent Care FSA, Limited Expense

Healthcare FSA) for the most recent plan year available, and specify how many employees participate concurrently in multiple FSAs?

Yes. An updated enrollment file (Appendix K

FSAFEDS_Enrollment_by_Agency_04212025.pdf) has been provided.

ATTM 1a Performance Work

Statement

Pg. 3 C. Authorization To

Operate (ATO) FedRAMP ATO

If the contractor employs a FedRAMP-authorized cloud service provider, does OPM require a new evaluation to be performed after the contract is awarded in order the deliver an acceptable SA&A package for approval?

Yes, OPM requires an assessment of all Customer Responsible

Controls identified by the FedRAMP Cloud Service Provider

(CSP).

ATTM 1a Performance Work

Statement

Pg. 3 C. Authorization To

Operate (ATO) Existing ATO from another Federal Agency

Can OPM leverage an existing ATO awarded by another federal agency, or is obtaining a new, separate OPM-specific ATO mandatory? An OPM-specific ATO is required.

ATTM 1a Performance Work

Statement Pg. 3 Authorization to Operate (ATO) Are there any specific countries prohibited from accessing or connecting to the FSAFEDS system?

No. A participant must have access to the FSAFEDS system from wherever in the world they are stationed, whether temporarily or permanently.

Attachment 1a Performance Work

Statement Pg. 12 Acceptance of Paper Claims and Paperless Reimbursement Claims

What is the current overall total of claims by the following types: debit card, FEHB and FEDVIP carrier, auto-ajudicated claims, Reconsidered claims, and disputed claims? OPM does not have the data to provide this information.

Attachment 1a Performance Work

Statement Pg. 12 Acceptance of Paper Claims and Paperless Reimbursement Claims Can you provide the customer service calls per participant annually? OPM does not have the data to provide this information.

Attachment 1a Performance Work

Statement Pg. 12 Translation Services Other than English, what languages are required for claims translation services? Any languages are identified in the PWS Attachment 1a Performance Work

Statement Pg. 13 Debit Card

What factors currently prevent OPM from offering a debit card for FSAFEDS, and what decision criteria will be used to determine if a debit card will be introduced? Per the PWS, a debit card is required.

Attachment 1a Performance Work

Statement Pg. 14 Funding Claims Payments

Please provide the current calculation or an estimate of the average cash balance required to maintain 5 days cash on hand, as well as the current balance and projected year-end balance of the

Risk Reserve Account.

The cash forecast will vary based on debits and claims payments. OPM will not provide the current balance and projected year-end balance of the Risk Reserve Account.

Attachment 1a Performance Work

Statement Pg. 17 Customer Service

Can OPM provide the monthly customer service call volumes, including participant emails, calls, appeals, average handle time per transaction, and specifically claims-based calls for the most recent full plan year? OPM does not have the data to provide this information.

ATTM 1b Appendices A through

H and Exhibit J All Appendix C

Could OPM please provide Appendix C, as it appears missing from the provided supporting documentation? Yes.

ATTM 1b Appendices A through

H and Exhibit J Pg. 13 Appendix G Participant Demographic Data Could OPM provide updated participant demographic data beyond what is available in Appendix G? OPM does not have the data to provide this information.

Attachment 1b Appendices A through H and Exhibit J Appendix G Enrollment History and Forfeitures

Given no publicly disclosed data since 2019, can OPM provide comprehensive annual totals of

FSAFEDS participant forfeitures from 2020 through 2024, clarify the rationale for withholding this information from public disclosure, and explain how these funds have been allocated or utilized?

OPM will not provide forfeiture totals. Forfeitures are transferred to OPM's Risk Reserve Fund and are used for OPM's costs for administration of the FSAFEDS Program.

Attachment 1b Appendices A through H and Exhibit J Appendix G Participant Demographics and Contributions

Can OPM provide updated average contribution amounts for the Health Care, Dependent Care, and

Limited Expense Healthcare FSAs, and the number of participants enrolled in multiple FSAs? OPM does not have the data to provide this information.

Attach 2 Pricing Proposal

Schedule Pg 1 Estimated Quantity

Does OPM anticipate any revisions or updates to the estimated quantities outlined in Attachment 2

(Pricing Proposal Schedule)? No.

General Questions N/A Mobile and API Integration

Is OPM open to integrating a contractor’s existing mobile application if it meets security requirements, and using APIs or Single Sign-On (SSO) to integrate other OPM benefit and user systems?

The contractor may integrate an existing mobile application if it meets security requirements. FSAFEDS may not be integrated with other OPM benefit user systems.

Attm 1a General Information Page 5 Paragraph IV.A. The Contractor shall handle enrollment, interactive voice response

(IVR) systems, customer service, and other customer service functions.

What is the Fiduciary arrangement with OPM? Is the contractor the fiduciary? This has impacts on how servicing operations work. The contractor, as the plan administrator, has a fiduciary duty to safeguard the funds it holds on behalf of FSAFEDS.

Page 10, 3rd full paragraph The Contractor’s focus must be on the individual covered employee. The payroll office may not always know why an employee’s pay has changed, including why the employee is not receiving pay. This is perhaps nowhere more apparent than when a Federal employee transfers between agencies. While their years of Federal service, eligibility for benefits, etc. move with them, this individual is very much like a new employee from a payroll perspective.

When an employee changes agencies, is this considered a qualifying life event? Further, is OPM's expectation that a separate account be established for the employee under the new agency?

Changing agencies without a break in service is not considered a qualifying life event. The employee's account should continue and no separate account should be created.

Attm 1b Appendix E Paragraph 1, Personnel

Security

Top Secret clearances Can OPM please provide guidance regarding the number of the contractor's employees who will need to achieve Top Secret clearance, either by stating the number of contractor employees with this clearance level currently engaged with the FSAFEDS contract, or a percentage of the workforce that has historically held clearnce? OPM does not have the data to provide this information.

Attm 1b Appendix E Paragraph 1, Personnel

Security

Top Secret clearances Will OPM extend the start date of the contract without penalty if the government is unable to grant

Top Secret clearances in advance of the start date?

OPM will not extend the start date of the contract if contract requirements are not met.

Attm 1b Appendix E Appendix E General Facility Security Clearance Will a Facility Security Clearance be required for the contractor's servicing facilities?

The Physical Security requirements and other requirements related to facilities must be met or upgraded as requested by

Intelligence Community agencies.

Attm 1a Page 6 Section IV. B. 3. All employees (and subcontractor employees) supporting performance of this

Contract must be physically located within the 50 United States or the District of

Columbia.

Will any of the contractor's employees be required to work on site in the contractor's facility? Or may the contractor's employees work remote provided they do their work within the United States? If certain roles are required to work on site, please describe which roles.

OPM does not require employees to work at a contractor facility provided they comply with the requirements of the contract and applicable laws.

Attm 1a Page 3 Part C, first paragraph All costs for obtaining an ATO shall be included in the price quoted for Start-Up Period/Start-Up

Pricing, Contract Line Item

Number (CLIN) 00001. Refer specifically to OPM Clauses

1752.239-74 and 1752.239-75 for further detail on ATO, Federal Risk and Authorization

Management Program (FEDRAMP) and Cloud Computing requirements.

What impact level is of FedRAMP is the contractor required to meet for this contract: Low, Moderate, or High?

FIPS 199 moderate.

Attm 1a Page 13 B. Administration and

Systems > 6.l. Debit Card

Participants must have the ability to make payments for their claims with a debit card if they Opt-In. Each proposal must include a debit card solution for health care flexible spending accounts. A proposal may include a debit card solution for dependent care flexible spending accounts.

The Contractor shall comply with the Government-approved implementation process and administration procedures.

Can OPM please provide the "Government-approved implementation process and administration procedures?"

OPM will work with the contractor to develop the implementation process and administration procedures.

Attm 1a Page 13 B. Administration and

Systems > 6.l. Debit Card

Participants must have the ability to make payments for their claims with a debit card if they Opt-In. Each proposal must include a debit card solution for health care flexible spending accounts. A proposal may include a debit card solution for dependent care flexible spending accounts.

The Contractor shall comply with the Government-approved implementation process and administration procedures.

Does OPM anticipate that the FSAFEDS debit card will be customized with FSAFEDS branding? If no, can the contractor assume that it may use its standard debit card design? If yes, can OPM provide details in the PWS regarding the specifications and approval process? OPM does not require FSAFEDS branding for the debit card solution but FSAFEDS branding is acceptable. OPM does not have any additional specifications for the debit card and is not able to provide details about the approval process.

See revised language in Section V.C.6.l. Debit Card in the

Performance Work Statement.

Attm 1a Page 13 B. Administration and

Systems > 6.l. Debit Card

Participants must have the ability to make payments for their claims with a debit card if they Opt-In. Each proposal must include a debit card solution for health care flexible spending accounts. A proposal may include a debit card solution for dependent care flexible spending accounts.

The Contractor shall comply with the Government-approved implementation process and administration procedures.

Will OPM require that the FSAFEDS debit card is a chip card?

Yes. The FSAFEDS debit card must be a chip-based debit card.

See revised language in Section V.C.6.l. Debit Card in the

Performance Work Statement.

Attm 1a Page 13 B. Administration and

Systems > 6.l. Debit Card

Participants must have the ability to make payments for their claims with a debit card if they Opt-In. Each proposal must include a debit card solution for health care flexible spending accounts. A proposal may include a debit card solution for dependent care flexible spending accounts.

The Contractor shall comply with the Government-approved implementation process and administration procedures.

Will OPM allow the contractor to assess participants with a nominal fee for the replacement of a lost debit card?

OPM is open to a nominal fee for any replacement debit card after the first replacement.

See revised language in Section V.C.6.l. Debit Card in the

Performance Work Statement.

Attm 1a Page 13 B. Administration and

Systems > 6.l. Debit Card

Participants must have the ability to make payments for their claims with a debit card if they Opt-In. Each proposal must include a debit card solution for health care flexible spending accounts. A proposal may include a debit card solution for dependent care flexible spending accounts.

The Contractor shall comply with the Government-approved implementation process and administration procedures.

Will OPM allow cards to be issued to dependents of the participant? Alternatively, is OPM interested in allowing two cards to be issued for each participant?

Issuance of debit cards must comply with all legal requirements. Only one debit card may be issued per individual.

Attm 1a Page 3 Part C, first paragraph All costs for obtaining an ATO shall be included in the price quoted for Start-Up Period/Start-Up

Pricing, Contract Line Item

Number (CLIN) 00001. Refer specifically to OPM Clauses

1752.239-74 and 1752.239-75 for further detail on ATO, Federal Risk and Authorization

Management Program (FEDRAMP) and Cloud Computing requirements.

What are the expectations for system logging (online and/or offline log retention)?

The Contractor’s solution shall at the time of award be capable of integrating with the OPM’s Security Information Event

Management (SIEM) capability, sending operating system, database, and web application event logs in comma-delineated electronic format to the OPM in real-time continuously, via

Application Programming Interface (API) feeds or other automated mechanism.

Attm 1a Page 30 XI. Records Retention The Contractor shall maintain and protect copies of all records for at least seven years from final date of contract performance.

What are the expectations related to data retention? Is the retention of participant and claim data included in the 7 year requirement listed? Yes, participant and claim data is included in the 7 year requirement.

Attm 1 Page 36 QASP #2 Ordering Period System Availability The QASP does not appear to include a requirement for system availability. Does OPM have a specific requirement defining system availability? As stated in the PWS, The Contractor shall ensure website is accessible and operational 24 hours a day, seven days a week, except for maintenance downtime of less than 1%.

Attm 1a Page 3 Part C, first paragraph All costs for obtaining an ATO shall be included in the price quoted for Start-Up Period/Start-Up

Pricing, Contract Line Item

Number (CLIN) 00001. Refer specifically to OPM Clauses

1752.239-74 and 1752.239-75 for further detail on ATO, Federal Risk and Authorization

Management Program (FEDRAMP) and Cloud Computing requirements.

What are the expectations related to data backup and disaster recovery (Recovery Point Objective, Recovery Time Objective)

Services must be restored in four hours or less.

Attm 1a Page 3 Part C, first paragraph All costs for obtaining an ATO shall be included in the price quoted for Start-Up Period/Start-Up

Pricing, Contract Line Item

Number (CLIN) 00001. Refer specifically to OPM Clauses

1752.239-74 and 1752.239-75 for further detail on ATO, Federal Risk and Authorization

Management Program (FEDRAMP) and Cloud Computing requirements.

Can OPM describe their preferred engagement model and reporting expectations to meet the

FedRAMP Continuous Monitoring requirements? The Contractor’s solution shall at the time of award be capable of integrating with the OPM’s Security Information Event

Management (SIEM) capability, sending operating system, database, and web application event logs in comma-delineated electronic format to the OPM in real-time continuously, via

Application Programming Interface (API) feeds or other automated mechanism.

The Contractor’s solution shall have the capability to export its inventory of all components in a comma-delineated electronic format (e.g., .csv), preferably via API or other automated method, into the OPM’s inventory tracking mechanism. The

Contractor shall provide to the OPM, on an ongoing basis, a one-to-one mapping of all identified vulnerabilities to individual assists or components of its solution.

The Contractor’s solution shall be designed and have the capability to integrate with the OPM’s existing SIEM capabilities, providing continuous visibility into the anti-malware status, activity, and management for all components of the solution.

The Contractor shall facilitate weekly feeds to the OPM, preferably via encrypted API, for all patch, vulnerability, and baseline configuration information across the Contractor’s solution.

Attm 1a Page 3 Part C, first paragraph All costs for obtaining an ATO shall be included in the price quoted for Start-Up Period/Start-Up

Pricing, Contract Line Item

Number (CLIN) 00001. Refer specifically to OPM Clauses

1752.239-74 and 1752.239-75 for further detail on ATO, Federal Risk and Authorization

Management Program (FEDRAMP) and Cloud Computing requirements.

Significant changes within the system's authorization boundary require FedRAMP approval prior to implementation. Can the OPM clarify the attributes of a change that would constitute a significant change?

Changing of cloud provider, changing of cloud region, change of

FedRamp status in the cloud, etc.

Attm 1a Page 3 Part C, first paragraph All costs for obtaining an ATO shall be included in the price quoted for Start-Up Period/Start-Up

Pricing, Contract Line Item

Number (CLIN) 00001. Refer specifically to OPM Clauses

1752.239-74 and 1752.239-75 for further detail on ATO, Federal Risk and Authorization

Management Program (FEDRAMP) and Cloud Computing requirements.

If the achievement of ATO is delayed due to timelines of the Federal government (i.e. FedRAMP

PMO’s ability to process and grant authorization) will OPM change the due date for ATO, or allow the contractor to meet ATO at a later date without penalty?

An ATO must be obtained within the stated timelines.

Attm 1a Page 3 Part C, first paragraph All costs for obtaining an ATO shall be included in the price quoted for Start-Up Period/Start-Up

Pricing, Contract Line Item

Number (CLIN) 00001. Refer specifically to OPM Clauses

1752.239-74 and 1752.239-75 for further detail on ATO, Federal Risk and Authorization

Management Program (FEDRAMP) and Cloud Computing requirements.

Will the OPM act as an initial authorizing agency for the FedRAMP Authorization? If yes, will

OPM be willing to serve as an agency partner for bidders or finalists prior to a contract award?

OPM is not sponsoring FEDRamp authorizations at this time.

Attm 1a Page 23 #3, Investment Income The Contractor may invest a portion of the funds in the FSAFEDS claims reimbursement account. The Contractor shall maintain all bank accounts and sweep available funds into identified investments.

Does the government have any specific requirements around the types of investments the contractor may use? If so, can OPM please provide details regarding acceptable investement types?

As stated on Page 15, Attachment 1a, no specific guidance will be given regarding permitted investments.

Attm 1a Page 3 Part C, first paragraph All costs for obtaining an ATO shall be included in the price quoted for Start-Up Period/Start-Up

Pricing, Contract Line Item

Number (CLIN) 00001. Refer specifically to OPM Clauses

1752.239-74 and 1752.239-75 for further detail on ATO, Federal Risk and Authorization

Management Program (FEDRAMP) and Cloud Computing requirements.

Can OPM describe how it will accommodate a scenario where a required service that is not available within the FedRAMP marketplace (i.e. printed check fulfillment)? Will OPM consider granting exceptions for subcontracted services that are not available within the FedRAMP marketplace?

OPM will consider granting exceptions for subcontracted services that are not available within the FedRAMP marketplace?

Attm 1b Appendix E General question General question regarding which agencies are applicable for the requirements in this appendix

Can OPM please provide a list of agencies in the intelligence community and any specific security requirements for each, identifying those which will require Top Secret clearances to service?

OPM does not have the data to provide this information.

Attm 1b Appendix E General question First paragraph, Personnel Security When will OPM grant sponsorship for the contractor's employees to obtain clearance? Can it be prior to the contract award?

OPM may assist the contractor with obtaining the appropriate clearances.

Attm1a Page 38 Section VIII F. 5. Start-Up Costs – The contractor shall submit, in accordance with federal Cost Accounting

Standards (CAS) a single report, no later than thirty days following completion of transition from previous contractor following ATO, which details the actual costs incurred during the Start-Up Period.

Can OPM confirm that Cost Accounting Standards do not apply to the execution of the contract ouside of the start-up costs cited in this requirement?

Because the Start-up Costs are a Firm Fixed Price, Cost

Accounting Standards will not apply to the Start-up Costs. Cost

Accounting Standards will also not apply to the contract outside the Start-up Costs.

Attm 1a Page 3 Part C, first paragraph All costs for obtaining an ATO shall be included in the price quoted for Start-Up Period/Start-Up

Pricing, Contract Line Item

Number (CLIN) 00001. Refer specifically to OPM Clauses

1752.239-74 and 1752.239-75 for further detail on ATO, Federal Risk and Authorization

Management Program (FEDRAMP) and Cloud Computing requirements.

Given that no vendors offering Flexible Spending or Dependent Care accounts are currently authorized within the FedRAMP marketplace, will OPM accept, or consider acceptance of, HITRUST and PCI-DSS certifications in lieu of FedRAMP authorization? If not for the duration of the contract, will OPM consider acceptance of alternate security certifications for ATO while the contractor achieves FedRAMP authorization?

If the Offeror's solutuon is not a cloud solution, then the

FedRAMP requirements do not apply.

Attm 1a Page 3 Part C, first paragraph All costs for obtaining an ATO shall be included in the price quoted for Start-Up Period/Start-Up

Pricing, Contract Line Item

Number (CLIN) 00001. Refer specifically to OPM Clauses

1752.239-74 and 1752.239-75 for further detail on ATO, Federal Risk and Authorization

Management Program (FEDRAMP) and Cloud Computing requirements.

Must all third party technical solutions be FedRAMP authorized or may we use other industry standard/leading solutions and tools to deliver the services if they meet the requirements?

If the Offeror's solutuon is not a cloud solution, then the

FedRAMP requirements do not apply.

Attm 1a Page 3 Part C, first paragraph All costs for obtaining an ATO shall be included in the price quoted for Start-Up Period/Start-Up

Pricing, Contract Line Item

Number (CLIN) 00001. Refer specifically to OPM Clauses

1752.239-74 and 1752.239-75 for further detail on ATO, Federal Risk and Authorization

Management Program (FEDRAMP) and Cloud Computing requirements.

Can the contractor's system solution be delivered using a multi-tenant cloud based architecture where logical access controls separate federal data from commercial customer data? Or must this be an isolated self contained bespoke environment?

Data must be kept separate from non-Federal data.

Attm 1a Page 30 Section F. #2 Audited annual accounting statements of FSAFEDS in a format mutually agreed upon by both parties

What is the scope of the required audit? Will OPM consider agreeing to acceptance of an existing audit that the contractor produces annually? If not, please provide details regarding the scope and requirement of this audit.

The audited annual accounting statement must comply with

OPM's Agreed Upon Procedures. An existing audit will not be acceptable.

Attm 1a Page 6 Section A. #14 The Contractor shall migrate all claims history from the previous

Contractor for the year they begin contract administration and the previous calendar year. Two years’ history of claims must be searchable for the purposes of responding to inquiries from program participants, OPM and congressional inquiries. The outgoing and incoming contractors will need to coordinate on the format.

Based on previous experience with recent contracts involving services provided through OPM to other agencies, what did the engagement between the contractor and OPM, as well as participating agencies look like? What were the pain points and lessons learned?

OPM does not have the data to provide this information.

Attm 1a Page 5 Section IV.A. #2 The Contractor shall interface with more than a hundred federal payroll interfaces in a wide variety of formats, usually through BENEFEDS. BENEFEDS will interface on the Contractor’s behalf.

Can OPM please provide a list of payroll interfaces used, and the number of different formats used?

OPM does not have the data to provide this information.

Att 1B page 13 Appendix G Appendix G Enrollment History Given the oudated nature of the data provided in this appendix, the incumbent is the only potential bidder with recent enrollment information that is material to assumptions around the cost to fulfill the contract. Can OPM please provide historical enrollment data for all plan types for the years

2020 through 2024 and the beginning of 2025?

Yes. An updated enrollment file (Appendix K

FSAFEDS_Enrollment_by_Agency_04212025.pdf) has been provided.

Att 1B page 13 Appendix G Appendix G Enrollment History While enrollment history is helpful to assume the costs of the contract, OPM previously provided bidders with call statistics and claims statistics in its 2020 procurement process for this contract.

Given that the incumbent is the only potential bidder with access to this informatoin, can OPM please provide this information to all potential bidders?

Yes. An updated sanitized file (Appendix L

WeeklyOperationalSummaryReport_04.23.2025_Sanitized.xlsx) has been provided.

Attm 1a Page 12 Part 6.d. Allow Spousal Linking: If one spouse’s account has exhausted its funds, submitted claims will automatically be reimbursed out of the other spouse’s account provided the participant(s) have requested this link and unused funds are available.

How many pairs of spouses currently opt in to the linkage of accounts?

OPM does not have the data to provide this information.

Attm 1a Page 12 Part 6.d. Allow Spousal Linking: If one spouse’s account has exhausted its funds, submitted claims will automatically be reimbursed out of the other spouse’s account provided the participant(s) have requested this link and unused funds are available.

Please define what "automatic" means within this requirement. Does it infer that the system executes this requirement without human intervention?

The reimbursement should occur without further action needed by either spousal participant.

Attm 1a Page 23 Section D All bank accounts related to FSAFEDS must be Federal

Deposit Insurance Corporation

(FDIC) insured, and located in financial institutions that are

U.S. owned.

Does the government have specific requirements around the type bank used for this contract, the size of the bank, or any other requirements regarding the nature of the bank used outside of the bank accounts being FDIC insured, US owned, and on US soil?

No.

Att 1B page 6 Appendix F U.S. Postal Service U.S. Postal Service In 2025 the U.S. Postal Service began using a different program for FSA's. Does the USPS still use

FSAFEDS for certain account types? No.

Att 1B page 6 Appendix F U.S. Postal Service U.S. Postal Service Can OPM please provide any further insights as to challenges or pain points experienced in offboarding the USPS from FSAFEDS? No. This information is not relevant to this solicitation.

Att 1B page 6 Appendix F U.S. Postal Service U.S. Postal Service Can OPM please provide the number of participants with accounts in 2024 who moved to the USPS program and not longer have accounts within FSAFEDS?

No. This information is not relevant to this solicitation. Current enrollment information has been provided.

Att 1B page 6 Appendix F U.S. Postal Service U.S. Postal Service Can OPM please provide the number of participants with accounts in 2024 who moved to the USPS program and not longer have accounts within FSAFEDS?

No. This information is not relevant to this solicitation. Current enrollment information has been provided.

Att 1B page 6 Appendix F U.S. Postal Service U.S. Postal Service Can OPM please provide the number of participants with accounts in 2024 who moved to the USPS program and not longer have accounts within FSAFEDS?

No. This information is not relevant to this solicitation. Current enrollment information has been provided.

Att 1B page 3 Appendix F Current FSAFEDS

Participating Agencies

General question regarding which agencies are applicable for the requirements in this appendix

Per publicly available contract information and news reports, the list of agencies participating in

FSAFEDS is materially different than it was in 2019. Can OPM please provide a list of agencies that currently use the program in 2025? Yes. An updated Appendix F has been provided.

Att 1B page 13 Appendix G Appendix G General question regarding participation Can OPM provide insight as to anticipated enrollment number changes in FSAFEDS due to the reduction in the size of the U.S. government workforce ocurring between January of 2025 and today?

No. OPM does not have the data to provide this information.