Questions and Answers 2 - Solicitation No 24322626R0007.pdf

Question No. Question Category Question/Recommendation Answer

304 Agency Transition

In the answer to question 8, OPM noted that the entirety of DHS is of Large complexity. DHS has recently indicated in the Acquisition Planning Forecast System that ICE is planning on releasing a solicitation on December 10 for a

Human Capital End-to-End Management Solution with similar requirements to this effort. Will ICE be excluded from the OPM solution?

The government intends to determine the complexity of each agency through its PMO communications and operations before each TO is issued to the vendor.

305 Agency Transition In the answer to question 8, OPM noted that the entirety of DHS is of Large complexity. The US Coast Guard released an RFI in September 2025 for HRIT solutions with similar requirements to this effort. Can OPM confirm whether Coast Guard will be excluded from the Agency Transition?

The government intends to determine the complexity of each agency through its PMO communications and operations before each TO is issued to the vendor.

306 Agency Transition In the answer to question 7, OPM noted that the entirety of DoW is X-Large Complexity. Does this include agencies such as DISA, which currently has an in-progress migration to a new HCMS with similar requirements to this effort?

The government intends to determine the complexity of each agency through its PMO communications and operations before each TO is issued to the vendor.

307 Agency Transition For the 60 day shadow mode, is the approach dual entry, data replay, or parallel compare? What outputs constitute pass/fail (error rates, reconciliation rules)?

Parallel compare. The 60-day “shadow mode” UAT is allows the agencies to test the new system using agency obfuscated data.

308 Agency Transition Are agencies expected to execute production transactions during these periods, and how are defects handled without jeopardizing sign off?

"During these periods" is too broad for the Government to respond to.

309 Agency Transition How and when will complexity t shirt sizing be reassessed if discovery reveals materially different integration scope or agency readiness?

The government intends to determine the complexity of each agency through its PMO communications and operations before each TO is issued to the vendor.

310 Agency Transition Please confirm how the “Department of War” scope should be interpreted for onboarding and integrations. The entirety of DoW is the X-Large Complexity.

311 Agency Transition How will shared service customers (e.g., NFC/IBC) be handled—shared tenants vs. separate tenants—and who decides?

The proposed solution may utilize either a single-tenant or multi-tenant architecture, or a combination thereof, as appropriate. Vendors should describe their recommended approach, including rationale, benefits, and any implications for security, scalability, data segregation, and operational efficiency. Section 3.

312 Case Study Submission

Questions and answers 31 through 35 resulted in the Case Study client signature requirement being replaced with an attestation that “Each Case Study must be certified by the Offeror stating that the Case Study is fully true to the best of their knowledge.”

If the Offeror would prefer to provide client signed Case Studies as previously required, is this acceptable in lieu of the attestation requirement? (i.e., requesting that either method is deemed acceptable).

No. The solicitation has been amended to remove the customer verification requirement. Each Case Study must be certified by the Offeror stating that the Case Study is fully true to the best of their knowledge.

313 Case Study Submission

Ref Section M, Step 1, Subfactor A: Past Experience Case Studies (page 164/170): Will the Government please update the Section M language for the Past Experience Case Studies from "The credibility and accuracy of the submitted information, as substantiated by customer-signed attestations" to "The credibility and accuracy of the submitted information, as substantiated by case study certifications," to reflect the elimination of the customer verification signatures, and addition of Offeror certifications, as stated in the Government's Q&A response and in Amend. 2 (Section L, VOLUME I – TECHNICAL FACTOR 1, SUBFACTOR A – CASE STUDY SUBMISSIONS)?

Please see amended solicitation.

314 Case Study Submission

Ref Section M, Step 1, Subfactor A: Past Experience Case Studies (page 164/170): Will the Government please update the Section M language for the Past Experience Case Studies from "Case Studies in the context of this evaluation are detailed customer-verified descriptions of the Offeror’s five largest and most relevant prior contracts" to "Case Studies in the context of this evaluation are detailed descriptions of the Offeror’s five largest and most relevant prior contracts," to reflect the elimination of the customer verification signatures, as stated in the Government's Q&A response and in Amend. 2 (Section L, VOLUME I – TECHNICAL FACTOR 1, SUBFACTOR A – CASE STUDY

SUBMISSIONS)?

Please see amended solicitation.

315 Core Implementation For agencies that initially retain legacy T&A, what data exchanges, frequencies, and validation rules are required to ensure payroll accuracy?

More information regarding payroll integration will be provided at time of award as part of CLIN 1.

316 Core Implementation Please confirm the single ATO authorization boundary, primary control owners (contractor vs. OPM vs. agencies), and how agency unique integrations will be handled without requiring separate ATO packages.

When a new integration is added, the government will assess whether the new integration introduces new risks or changes in the security posture of the system and if documentation updates are required.

317 Core Implementation For Offerors not FedRAMP authorized at proposal time, what specific evidence and schedule must be met pre award and post award to remain compliant?

Offerors must provide documentation demonstrating that their solution is actively pursuing FedRAMP Moderate (or higher) authorization. This includes a detailed FedRAMP project plan, evidence of engagement with a Third-Party Assessment Organization (3PAO), and a timeline for achieving authorization. The plan must show that FedRAMP approval can be “reasonably received by the time of contract award.”

318 Core Implementation Which assessment artifacts (e.g., SSP, POA&M, SAR) are required with the 30/45 day ATO deliverables, and what

Government review window applies before acceptance?

The offeror would need to submit their FedRAMP documentation and all relevant security documentation (SSP, SAR, POA&M, SOC reports, control implementations, etc) for review by the government.

319 Core Implementation Should we assume OPM managed Microsoft Entra as the authoritative IdP for all agencies, or will some agencies federate from their own IdPs?

The specific integration approach for the IdP will be determined based on the proposed architecture of the HR system, which could be either a multi-tenant or single-tenant environment.

320 Core Implementation What MFA standards, step up authentication scenarios, and account lifecycle requirements (e.g., JIT provisioning, SCIM) apply?

Phishing resistant MFA is required. The contractor must implement automated user provisioning using SCIM 2.0 standards for secure onboarding, updating, and deprovisioning of user accounts from the associated identity provider (IdP) to the contractor’s system. (Appendix A, Req. # 5;

Clause: 1752.239-81)

321 Core Implementation Which payroll providers and T&A systems are in scope on Day 1, and what are the minimum acceptance tests for payroll readiness (e.g., leave accruals, premium pay, retro, special pay rules)?

The Payroll providers listed in Appendix B are in scope for CLIN 1. The interconnections to the T&A systems listed in Appendix B will be determined during Agency Transition. Synchronization must occur in near real-time or within a defined SLA (e.g., within 15 minutes of change).

322 Core Implementation Which Section 508/WCAG level is required for web and native mobile (e.g., WCAG 2.0/2.1/2.2 AA)?

Please see amended solicitation - Section 508 and WCAG 2.2 AA standards.

323 Core Implementation Are native mobile apps required, or is responsive web sufficient, and are there offline capture scenarios to support?

Responsive web is sufficient. There are no offline capture scenarios to support.

324 Core Implementation What are PIV/CAC expectations for mobile access? The government will provide additional detail upon award.

325 Data Will Sandbox, Dev, UAT/Pre Prod, Prod, and Post Prod environments be centralized for all agencies, provisioned per agency, or operated in a hybrid model?

Environments are centralized for all agencies.

326 Data What environment concurrency should we plan for during peak onboarding (number of agencies simultaneously in

UAT/Pre

Prod)?

During agency transition, vendor should expect multiple agencies to exist in UAT/Pre-Prod simultaneously. See Appendix A for Notional Agency Implementation Waves.

327 Data How is “Post production” defined and used (hotfix, blue/green, DR site, or other)? Post-production includes ongoing operations, maintenance, hotfixes/deployments, and disaster recovery (DR) activities after go-live

328 Data Requirements reference both near zero RPO and RPO < 1 hour; please reconcile the required RPO and specify the target RTO across all services, integrations, and data stores.

Please see amended solicitation. The contractor must ensure data loss is less than 1 hour (RPO < 1 hour) in the event of a system failure or disaster, achieved through real-time or near-real-time replication. (Section 5.1)

329 Data For “backups accessible upon request,” what are the time to deliver expectations, formats, transfer mechanisms, and frequency of test restores?

See section 5.1 of the PWS. Further details should be included in the resilience strategy/plan deliverable.

330 Data How should cross agency moves be handled while preserving a single employee record and audit continuity? The single employee record is tied to a unique person while their agency-specific records are tied to the position(s) that person encumbered while employeed by a specific agency.

331 Data Please specify preferred protocols (REST, event streams, SFTP for legacy), authentication patterns (mutual

TLS/OAuth), and any rate limit expectations for high volume agencies.

Mutual TLS (mTLS) is required for secure API and data exchanges.

OAuth 2.0 is required for authentication and authorization for API access.

The PWS requires the contractor to support high-volume agencies and enforce rate limits as part of API management, but does not specify numeric thresholds—these are to be agreed upon with

OPM during onboarding.

Section Reference: Appendix B, “API Gateway and Management”

332 Data Please define the minimum historical window per data type to be migrated (e.g., positions, PAR/SF 50 history, training, attachments).

The PWS requires migration of all existing agency Core HCM system of record data, including historical data. The specific scope and duration should be proposed by the bidder and confirmed with OPM. (Section 5.1, Data Migration Strategy)

333 Data Confirm the exact migration accuracy threshold and measurement method (counts, field level rules, tolerances by field/domain).

Data migration must achieve ≥99.5% accuracy and completeness across record types.

Measurement: Accuracy is verified by post-migration audits, cross-system reconciliation reports, and sampling (see Performance Metrics Table, Section 6.10, p. 42; Agency Data Migration, Section 5.2; Appendix B).

334 Data Who approves data exceptions (e.g., unmapped codes), and what remediation window applies after go live, and at whose expense?

OPM OCIO oversees and verifies migration; OPM GPMO and Agency/Department jointly manage data readiness and issue resolution (Section 5.2). Contractor bears the cost for correcting deficiencies (Section 5.8).

335 Data Please specify the required obfuscation approach (fields, masking method, irreversibility) and whether synthetic data is acceptable for portions that cannot be safely obfuscated.

Obfuscated data is required for testing in non-production environments; masking/redaction must use FIPS 140-3 compliant methods (Section 5.2; Section 6.3; Clause 1752.224-73). If unable to mask/redact, OPM can approve the use of synthetic data.

336 Data Which data domains (e.g., personnel actions, time reporting, identity) require near real time replication to the data lake, and what latency targets apply?

Replication must occur daily or on an OPM-approved schedule; identity provisioning must synchronize in near real-time or within 15 minutes. (Appendix A, Req. # 5.)

337 Data Will the data lake function as a passive repository or an active analytics/synchronization layer, and who owns semantic models and governance (e.g., golden employee record, mastering rules)?

OPM owns the data lake and it will be an active analytics layer.

338 Data What data use restrictions, explainability, and human in the loop requirements apply to AI features? AI features must comply with federal security, privacy, and explainability requirements (Section 5.5; Section 6.3).

339 Data What guardrails apply to model training using federal workforce data (e.g., no commingling with public training corpora)?

Federal workforce data must not be commingled with public training corpora; segmentation and access controls are enforced (Refer to Section 6.9)

340 Data For Data Escrow, what is the minimum required content (data, configurations, workflows, schemas), update cadence, and verification method?

Refer to Section 6.9 for Escrow requirements.

341 Data For monthly schema exports, should deliverables include object relationships, data lineage, and API catalogs to ensure portability?

Monthly schema exports must include object relationships, data lineage, and API catalogs.

(Section 6.6.3, Section 6.9.2, Clause: 1752.239-75)

342 Data Who owns the canonical HR data model, and what is the process for evolving it as agencies onboard?

The HR Line of Business (HRLOB) is responsible for HR data standards and publishes the HCIM:

https://www.opm.gov/services-for-agencies/hr-line-of-business/human-capital-information-model-hcim/

343 Evaluation Ref PWS page 32: Based on the Governmen'ts response to Q&A #16, how does the government intend to provide reasonable evaluations to pricing from all vendors when time frames are not clearly defined and assumptions from vendors may be based on inconcise information?

Offorers should consider only the timeframes addressed in the solicitation in proposing their fixed price per agency complexity level.

344 Evaluation Are platform extensions (custom objects/screens built with vendor tools) always considered configuration even when they introduce new logic?

Per the PWS, plaform extensions are considered configuration.

345 Evaluation What activities are considered customization if code executes outside the core (e.g., serverless functions, middleware, UI widgets)?

Per the PWS - Customization means any modification to the SaaS Core HCM platform’s delivered code, data model, or core logic that is beyond vendor-supported configuration, extension, or integration tools. Customization does not include configuration.

346 Evaluation How is the “≥90% OOTB/configuration” threshold measured—by requirement count, weighted criticality, or capability groups?

Requirement Count.

347 Evaluation For the Government’s 10 business day system testing, what personas/roles must be enabled, and what seed data and test scripts will be provided?

The offer shall enable all roles all so OPM can have a comprehensive understanding of the system's capabilities. Please refer to L6, Volume 3, Technical Factor 3 - System Testing for additional details.

348 Evaluation

Ref Section M.2 Evaluation Criteria / Technical Factor 1 Subfactor B: Q&A #s 110–111 confirm that Step 1 will assign confidence-level ratings across Technical Factor 1 subfactors, but do not describe how the extent of Out-of-the-Box (OOTB) functionality will translate to those confidence ratings. Will the OOTB evaluation be used only in the confidence level for the Phase 1 proposal evaluation or will it be also be used in the final evaluation of the

Phase 2 proposal in determining the award? If it is used as part of the evaluation for the final award, how will it be considered in the evaluation criteria?"

As stated in M.1, Basis for Award, the government's determination of the best overall proposal will consider all five evaluation factors (e.g., Technical Factor 1 (including subfactors), Technical

Factors 2-4, and Price).

"The Price Factor is of equal importance to Technical Factor 2, Technical Factor 3, and Technical Factor 4, combined. Technical Factor 2, Technical Factor 3, and Technical Factor 4, individually, are of equal importance to one another. The Price Factor and Technical Factors 2-4 are each more important than Technical Factor 1. "

349 Evaluation Ref L.6 Proposal Submission Instructions, page 153/170: Please confirm that Volume I, Subfactor C is due at the same time as the Volume I submission, Subfactors A and B. Volume I nstructions list only Subfactor A and Subfactor B.

This is because nothing needs to be submitted for Subfactor C. It's a live demo. Nothing will be submitted.

350 Evaluation

The Government states in response to the use of PowerPoint slides in Amendment 2 Q&A #s 95-96: "The demonstrations will be entirely live. Offerors may not use PowerPoint slides to demonstrate their capabilities related to the three scenarios." To clarify, are offerors allowed to use PowerPoint as part of the introductions, closing, and for any additional items not directly related to demonstrating the three scenario capabilities, but for example to help the flow of the live demonstrations and reference back to the key demonstration objectives and background?

Powerpoint slides are not required. Any information provided in Powerpoint slides will not be considered in the Offeror's evaluation.

351 Evaluation Please confirm Offerors have the entire 1-hour and 4.5 hour time slots for their demonstration, and Government

Q&A will follow. Otherwise, please advise the amount of demonstration time and the amount of Q&A time for each demo.

There will not be time dedicated to Q&A following the demonstrations. The time used by the government for internal caucus will not count against the offerors time for the demonstration.

Please see Section L.6 that states: "Evaluators will not provide formal feedback during the demonstration. However, the Government reserves the right to pause for internal caucus and to ask clarifying questions throughout the session. Offerors are expected to respond in real time, demonstrating their ability to communicate clearly and engage effectively with stakeholders.

Offerors may also ask clarifying questions as needed to understand the business scenario or task at hand; however, the Government expects such questions to be limited, relevant, and appropriate to the context. Questions that reflect a lack of familiarity with the functional requirements or that suggest the Offeror is not technically prepared may negatively impact the evaluation. These exchanges are intended to simulate real-world stakeholder engagement and do not constitute formal discussions or exchanges under FAR Part 15. Offerors will not be permitted to add to or revise their demonstration content following the session. "

352 Evaluation

Regarding the Government's response to Q&A # 92, can the government provide clarity? In its response to question 92, the government states that Attachment 2 will be due along with Technical Factor 2. But the evaluation instructions state that Technical Factor 2 is Volume II and still require a separate Volume V. Please confirm that a separate Volume V is required in addition to Attachment 2?

The answer to Q&A #92 should have been more specific to state that the Price volume (e.g., Volume V / Attachment 0002) is due in conjunction with Volume II / Technical Factor 2, Volume III

/ Technical Factor 3, and Volume VI / Solicitation, Offer and Award Documents, Certifications & Representations.

353 FedRamp Ref 6.6: We previously submitted this question and it was missed in the Government’s Q&A response: Please confirm that the cloud services’ FedRAMP authorizations reflecting approval of the cloud services’ AU, IA, PT, RA, and SI controls will satisfy the requirements of section 6.6.

The FedRamp authorization will satisfy most of these controls; however there are some hybrid controls within the control families that will require additional documentation.

354 Integration Should integrations route through OPM’s central API Management gateway or connect directly to each external system when appropriate?

See "Integration Layer Requirements" update in Addendum 2.

355 Integration What are the Government vs. contractor responsibilities for creating and maintaining interface control documents

(ICDs) and test stubs?

Contractor is responsible for developing and maintaining Interface Control Documents (ICDs) and test stubs for all integrations required by the PWS.

356 Integration What usage (e.g., API calls, storage) is included versus billable to avoid double billing for integrations? All usage is included.

357 Integration Please provide current ICDs/specifications and test endpoints for USA Staffing (RPI, NHI, TUAPI), USA

Performance, EHRI, and eOPF, and identify any planned changes during the program.

These will be provided after award.

358 Integration For eOPF, will the initial integration be SFTP/XML only, and what is the timeline for any API based approach? This will be determined after award.

359 Misc Which AI/automation use cases are encouraged (e.g., skills inference, anomaly detection), and which are out of bounds (e.g., autonomous decisions on personnel actions)?

Offerors may propose any AI/automation use cases with the government.

360 Misc What is the change control cadence (board schedule, SLAs) and the appeal path when decisions affect timeline or cost?

There is no pre-established change control board cadence or appeal path defined in the contract. Such matters that the vendor believes may impact schedule or cost will be addressed by the Contracting Officer at the Task Order level during contract performance. The CO, in coordination with relevant stakeholders, will determine whether a contract or TO modification is appropriate. The Government will evaluate such requests in accordance with applicable contract terms and the Federal Acquisition Regulation (FAR).

361 Misc CLIN 1 milestone weights assign 0% to Training—should Training be considered included elsewhere, or will the

Government consider rebalancing milestone payments to align cost with effort?

The Milestone Payment schedule for CLIN 1 is accurate.

362 Misc

In the answer to question 199, OPM states “OPM believes the MFC clause represents a common commercial practice”. FAR Part 12 does not include the MFC clause. The proposed clause is inconsistent with the policies of

FAR Part 12 governing commercial item acquisitions and the standard terms of FAR 52.212-4. Per FAR 12.301(a)(2) and FAR 12.302(c), clauses inconsistent with customary commercial practice may not be used without an approved waiver. A Most Favored Customer provision is not a customary commercial term, imposes significant administrative burdens, and is unnecessary for determining price reasonableness under FAR 15.402(a) and FAR 15.404-1(b). Please reconsider the deletion of the MFC clause.

OPM has researched this issue and concluded that most favored customer pricing clauses are frequently used in commercial contracts among private sector vendors. OPM is prepared to demonstrate examples of use of such clauses. Moreover, the instant clause used in the solicitation is based on the clause used in GSA Federal Supply Schedule contracts, which by defintion are contracts for commercial products, services, and solutions.

363 Performance Metrics What are the entry/exit criteria for the 30 day and 6 month sign offs, who signs them, and what defect thresholds or service KPIs govern acceptance?

OPM signs-off. See section 6 of the PWS - Performance Metrics.

364 Performance Metrics For deliverables due within 5–15 days of award (e.g., platform access, data tables/dictionary, dashboards), what are the specific entry conditions and acceptance criteria?

The government will provide additional detail upon award.

365 Performance Metrics May these early deliverables be phased (e.g., initial subset then full set) with rolling Government reviews instead of single acceptance gates?

The deliverables are outlined in the PWS.

366 Performance Metrics Please confirm hours of coverage, severity definitions, and whether Tier

2/3 resolution clocks are measured in business hours or 24×7.

Please see amended solicitation section 5.2.5 Help Desk: Hours of coverage will be 6:30 AM – 6:30 PM Eastern Time Monday - Friday, excluding Federal holidays. Severity levels are determined based on the nature and impact of the issue, as well as the knowledge, training, and system access available to Tier

1 staff to resolve it. If Tier

1 is unable to resolve an issue due to complexity, required expertise, or access limitations, the issue is escalated to Tier

2 or Tier

3, and the severity is assessed accordingly. For Tier

2 and Tier

3 issues, resolution rates are calculated using the networkdays method where the resolution clock runs 24x7 but excludes weekends and federal holidays from the calculation.

367 Performance Metrics How are multi agency incidents (platform wide issues) handled versus agency specific tickets, and what are the communications and RCA expectations?

See section 6 of the PWS - Performance Metrics.

368 Performance Metrics Are there Government defined performance thresholds (throughput, transaction times, concurrent users) that must be included in system and performance tests?

See section 6 of the PWS - Performance Metrics.

369 Performance Metrics Please list the authoritative KPI set required for the System Metrics Dashboard (availability definitions, uptime calculation window, incident severity, MTTR/MTTD, backup success rate, DR test outcomes).

The KPIs for the System Metrics Dashboard are included in section 6.10 Performance Metrics.

370 Performance Metrics What thresholds or SLOs trigger corrective action plans, and how are credits or remedies handled, if applicable?

Such matters will be addressed by the Contracting Officer at the Task Order level during contract performance. The CO, in coordination with relevant stakeholders, will determine whether a contract or TO modification is appropriate.

371 Performance Metrics For deliverables due on the day of each release (training, online help), what is the Government’s acceptance window, and can acceptance be bundled at the release train level?

The government will provide additional detail upon award.

372 Price Schedule

Please provide additional clarification to the answers to questions 216 – 217 and the Attachment 0002 now composing Volume V – Price Factor.

Given the replacement of the price volume with a pricing spreadsheet, will the Government permit Offerors to address pricing dependencies with either (1) a supplemental Volume V Narrative file or (2) a “Pricing

Dependencies” worksheet added to the ATTACHMENT 0002 - Pricing Spreadsheet.xlsx?

The Government would prefer a supplemental Volume V narrative file so that a separate tab on Attachment 0002 is not inadvertantly missed; however, either method is acceptable.

373 Price Schedule How should pricing and planning account for agency by agency switchover from legacy T&A to the platform’s T&A module?

The solicitation and resultant contract is for 2 million employee licenses. It is projected that approximately 1 million employees will initially require licensing without T&A functionality (CLIN 0003-1) and 1 million employees will require licensing for all functionalities, including T&A (CLIN

0003-2). A pricing template has been provided at Attachment 0002.

374 Price Schedule How are users counted for PEPY pricing (named employee vs. active headcount vs. FTE equivalents), and how are mid year changes and proration handled when moving between “with T&A” and “without T&A” licenses?

The government will define the number of licenses required per agency at the Task Order level.

Refer to section 7.4 of the PWS regarding proration.

375 Price Schedule Are non production tenants and test identities included in the PEPY price before and after CLIN 3 activation? Non-production tenants and test identities will be activated in CLIN 1.

376 Price Schedule Should Offerors plan for any OCONUS scenarios (e.g., overseas facilities) that require on site support? No.

377 Price Schedule Can multiple agencies combine travel approvals to minimize cost (e.g., regional onboarding waves)?

OPM will determine when it is appropriate for the offeror to travel and will take into account numerous factors to minimize cost.

Follow-up Q&A's