S05 - Industry QAs - RFQ 36C10A23Q0093 Amend 02.pdf

36C10A23Q0093 Amendment 0001 – Industry Questions and Answers

Question 1: As the RFQ was released after close of business Thursday, March 30th, will the government be willing to offer an extension through to April 28th to allow time to develop a quality demonstration video?

Answer: An extension has been granted. Per Amendment 0001, Video Demonstrations are due April 17, 2023 @ 10:00AM EST.

Question 2: On page 41 of the RFQ document, we see that Volume 1 is to be submitted separately from the rest of the volumes, but the government also states on page 44 that “the respondent will be responsible for providing a private web link (to be included in the written response) to the video” Is there a separate written response to be submitted with the virtual technical demonstration? Or can the link to the YouTube video be submitted directly via email?

Answer: No; there is not a separate written response required for Step 1. The only required submission for Step 1 is the Video Demonstration. Advisory Notifications will provide the timeline for submitting Step 2, Volume II – Written Technical (as well as Volumes III through VI). For Step 1, yes; you can submit the link to the YouTube video via e-mail.

Question 3: On page 41 of the RFQ document, the government states “Step 2 submissions shall be submitted electronically via email to Samantha.McIntyre2@va.gov and Lori.Walker1@va.gov within the timeframe specified in the CO’s advisory notice."

How long of a timeframe will be provided in the CO's advisory notice to give respondents sufficient time to build and submit Volumes 2-6?

Answer: The advisory notice will provide the timeline for submission of Volumes II through VI, but those dates are not known at this time.

Question 4: On page 44 of the RFQ document, the government states we are not to use hyperlinks, but contradicts this notion when they require a video to be linked in the second volume. Can the government please clarify?

Answer: The statement that “The use of hyperlinks or embedded attachments in the quotes is prohibited.” is under Step 2, for submission of Volumes II through VI. For Step 1, Virtual Video Demonstrations shall be provided as a pre-recorded video technical demonstration through YouTube or an equivalent video sharing website. Said website can be provided via e-mail per Question #2 above.

Question 5: Does the government have a legacy system or multiple in place for this objective currently? If so, will the contractor be responsible for migrating data from the legacy systems to the new solution?

Answer: The Government does have a system currently in place. However, the vendor managing our current system will not be responsible for migrating data to the new solution. If any data needs to be migrated, it will be merged with the new solution as appropriate in coordination with the contractor running the new system.

mailto:Samantha.McIntyre2@va.gov mailto:Lori.Walker1@va.gov

Question 6: Would the government be willing to extend the 45-day implementation timeframe mentioned on page 6 of the PWS?

Answer: If necessary, but no longer than 60 days. However, it is understood that implementation will be contingent upon the necessary actions needed to be taken, by both the Government and the vendor, to bring the solution on to the VA Enterprise Cloud and ensure its compliance with all security policies.

Question 7: Would the System Steward be considered Key Personnel?

Answer: Yes, the System Steward is considered Key Personnel.

Question 8: Section 3.0 states, “The software solution shall meet the necessary requirements to be deployed as an outside hosted managed service on the VA Enterprise Cloud (VAEC).” And then further states, “The Contractor shall not be responsible for providing or acquiring cloud capacity or server hosting infrastructure for this contract.”. Section 5.2 then states, “The vendor shall manage the solution in either the VAEC or another cloud environment as agreed to by VA.” And continues, “If the application is not hosted on the VAEC, the vendor shall obtain a VA approved Authority to Operate (ATO) in whatever environment the software is hosted in.” Can the VA please clarify if SaaS solutions hosted by a vendor which has successfully obtained a VA ATO are acceptable or should vendors only propose solutions that can be hosted on the VAEC? If SaaS solutions are acceptable, can the PWS be updated to reflect that option. In particular, Sections 5.7, 6.5, and A1.0.

Answer: If the Software as a service (SaaS) solution has a FEDRAMP HIGH approved Joint Authorization Board (JAB) Authority to Operate (ATO) then the SaaS solution could be acceptable but must meet the VA requirements for FEDRAMP requirements.

Question 9: Section 5.7.3(3) states, “Develop necessary artifacts to obtain a VA authority to operate (ATO) for the solution and complete VA Assessment and Authorization (A&A) process. After ATO is achieved, the Contractor shall update and maintain the A&A documentation as required to ensure continued compliance. The Contractor shall monitor, track, and respond to Plan of Action and Milestones (POAM).

The Contractor shall provide input to update the VAEC ATO, as needed.” Assuming that vendors can propose SaaS solutions, would a FedRAMP High accreditation be acceptable to meet the requirements of the ATO package request? Additionally, would the FedRAMP ConMon process be acceptable to address the A&A and POAM processes?

Answer: Still would need to be processed through the VA ATO process. See response to Question #8.

Question 10: Section 6.1.2 discusses FICAM requirements. Does the VA anticipate any users who do not have PIV/CAC cards (excluding the successful vendor) to need access to the Crisis Information Management Software? If so, would VA be providing the hardware tokens or should the vendor provide pricing for those items?

Answer: If access is required to the system, then it must be personal identity verification (PIV)/multi factor authentication (MFA) if for access to be granted and should be able to integrate in the VA environment.

Question 11: Section 6.1.4 discusses TIC requirements. If a vendor provides a SaaS solution that meets FedRAMP High requirements, will the system still require a TIC or is that only applicable for VAEC vendors?

Answer: The Solution would still need to connect through the Trusted Internet Connection (TIC) stack of VA. The additional TIC would not be required unless working TIC 3.0 approved case with VA.

Question 12: Will this be procured on SEWPV?

Answer: No; this requirement was solicitated on Contract Opportunities (SAM.gov) as a small business set-aside.

Question 13: Is there any paperwork required to be submitted in addition to the video link for Volume 1?

Answer: See response to Question #2.

Question 14: Is the FedRAMP High authorization via the agency path also acceptable or will VA only consider JAB authorized packages?

Answer: The quickest path to implementation would be to host a Commercially available off-the-shelf product in the VAEC per the answers above and have the vendor operate in from there as a managed service. In that case, only a VA ATO would be necessary, rather than a FedRAMP certification. That is the only way to host such an application. The FedRAMP JAB allowed package is the approved documented process for SaaS, and the other would be acceptable only after being evaluated. The usage of a managed service would still have to meet all the FedRAMP requirements, as well as give VA with complete visibility to the product, which would need to be within the VAEC boundary for cloud products.