36C10A25R0002 Published QA Responses.xlsx
XLSX spreadsheet 32 KB Posted
- Solicitation number
- 36C10A25R0002
About this file
This document is a Q&A (Questions and Answers) spreadsheet for Solicitation No. 36C10A25R0002, a Department of Veterans Affairs (VA) procurement for a modernized messaging Software-as-a-Service (SaaS) solution. The VA seeks a non-physical pager text messaging application that provides secure, encrypted communication across mobile platforms, with strict requirements including FedRAMP HIGH authorization, FIPS-199 HIGH data security characterization, and complete data protection (no data stored on devices).
Key procurement details include a 100% set-aside for Service-Disabled Veteran Owned Small Businesses (SDVOSB), with an initial requirement for 20,000 licenses expandable to 120,000 licenses. The solution must support Government Furnished Equipment (GFE) and Bring Your Own Device (BYOD) across Android and iOS platforms, transmit text, images, and graphics, and integrate with VA's Active Directory/Entra ID. The solicitation closes on 7/29/2025 at 2:00 PM CST, with annual licensing and no on-site implementation support required. The contract will be awarded as a Firm-Fixed Price (FFP) based on the most beneficial proposal to the government.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| S06 - 36C10A25R0002 0002 Attachments D1-D.3.xlsx | XLSX spreadsheet | |
| S06 - 36C10A25R0002 0002.pdf | ||
| S06 - 36C10A25R0002 0002 Amended RFP.pdf | ||
| 36C10A25R0002 A00001.pdf | ||
| 36C10A25R0002 Amended RFP.pdf | ||
| S02 Attachments D1-D.3.xlsx | XLSX spreadsheet | |
| S02 - 36C10A25R0002.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Modernized Messaging SAAS
| Note: The answers provided below are for informational purposes, to assist potential offerors in preparing proposals, and such answers do not themselves constitute an amendment to the Request for Proposal (RFP). Where questions and answers necessitated such an amendment, such changes have been or will be incorporated into a formal amendment to the RFP. To the extent that any answers provided below conflict in any way with the RFP and any Amendments, the final RFP takes precedence. | ||||
| # | PWS Reference/Topic | Question | Response | |
| 1 | B.4.17.3.5 | Will the existing site IT desks initially field Tier 1 calls before routing to the contractor ? | VA will field initial troubleshooting through the IT Service desk. If required they will route to the contractor's help desk for resolution. | |
| 2 | B.4.8.3 | How does the VA plan to utilize the data being collected in the application? | PWS Reference B.4.8 MESSAGING SOFTWARE APPLICATION SOLUTION, B.4.8.1 The solution shall replicate the non-life safety requirements and functions of the current VA legacy 2-way pagers using Wireless Communications Transfer Protocol (WCTP); B.4.20.9.2.5 The sensitive information transferred, generated, transmitted, or stored herein is for VA benefit and ownership alone. | |
| 3 | B.4.5.9.5 | Is on-site Go Live Support desired? | No, on-site Go-Live support is not required. | |
| 4 | B.4.9.2 | What IdP is being used? | VA uses Single Sign On identify (SSOi) and Entra Identify (EntraID) | |
| 5 | B.4.5 | Can this solution be deployed to VA Cloud or would it have to be Our GovCloud? If it can be deployed to VA cloud can you provide guidance on estimating? | The VA requires the SaaS be hosted on the contractor's Cloud Service Provider (CSP) PWS Reference Topic B.4.15 messaging Software SaaS Cloud Infrastructure | |
| 6 | B.4.5 | RFP B.4.5 states, “The Contractor shall ensure no VA data, of any nature, is stored on the device.” If this is the case, how does the customer expect users to be able to share files between each other? Where are these files located? Do the users need to be able to edit, sign, or otherwise modify these files on the mobile device? | PWS Reference B.4.5 Specific Tasks and Deliverables; B.4.9.2 Messaging Software Application Privacy and Secuirty B.4.9.2. | The Contractor provided mobile software application messaging solution shall prevent VA data, of any nature, from being stored on the device. We expect the images/messages to be stored on the contractor's CSPand retained in accordance with VA's records and retention policy (3-years). |
| 7 | General | EMR/System Integration: The document heavily focuses on a standalone communication platform. Is there a requirement for this solution to integrate with the existing Electronic Medical Record (EMR) or other clinical systems? For example, should a message be linkable to a specific patient's chart, or should the user directory be synced with an existing system like Active Directory? | PWS Reference Topic B.4.5.10 SAAS FedRAMP Requirements and B.4.5.10.1.6 The Contractor shall work with a VA Digital Transformation Center (DTC) Subject Matter Expert to develop a specific system boundary diagram including any integration and connectivity components for VA use, to include integration with VA’s Active Directory/Entra ID/global address directory (GAL). | |
| 8 | PWS B.4.9 | Authentication Details: Does "personalized passcode login" need to integrate with the enterprise's Single Sign-On (SSO) provider? Is Multi-Factor Authentication (MFA) a mandatory requirement? | It is up to the offeror to generate the requirement for the login as long as it complies with PWS Reference Topic B.4.2 Applicable Documents and B.4.2.37 NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” | |
| 9 | General | Will the Government consider granting a 7-day extension to Thursday, July 31, 2025? | The VA is not inclined to extend the RFP at this time. | |
| 10 | B.4.5 and B.4.9.2 | In section B.4.5, the solution requires text messaging of alpha-numeric, and numeric communications. However, B.4.9.2 mentions transmitting text, images, pictures, and documents. What are the exact data types that must be transmitted? What data types are NOT allowed to be transmitted? | The permissable data types are broad. The primary data types currently utilized are text, IMG, GIF and PNG. No executable file types, to include but not limited to .exe and .MSI | |
| 11 | D.1 - D.3, TAB D.3 Page 95 RFP | Is the Step 2 Evaluation tab to be answered and made part of our current RFP response, part of a future phase response, or is this a post-award activity? If it is to be submitted with the RFP response, in what Volume would it reside? | Offerors participating in Step 2 - Technical Sub-Factor 2- Software Testing shall provide written step-by-step instructions that illustrate how to accomplish all of the use cases identified at Attachment D.3 Step 2 Evaluation. Offerors do not need to provide this as part of Step 1 Evaluation, but will be notified by VA in advance if required for Step 2. | |
| 12 | B.1 Page 4 -12 | Will the government be providing a separate Pricing attachment (Schedule B) as reference in the PWS on page 94 on the Step One table, Volume III - Price? | No. Offerors shall submit a completed B.1 Schedule of Supplies and Services. | |
| 13 | B.4.14.4.2 | The requirement to identify a caregiver by their “patient assignment” is mentioned. This functionality does not appear to be mentioned elsewhere. This functionality would require the addition of an interface to receive a patient list, and an interface to receive the staff assignments for those patients. Will the government clarify if this patient assignment functionality is in scope? | This was a provided as an example for Use Case D. VA is seeking a solution that will solve problems encountered in situations where users are unable to find on call peers or groups due to outdated or missing on call schedule based on roles. | |
| 14 | B.4.14.4.2 | In section B.4.14.4.2, the requirement to identify a caregiver by their current “on call status” is mentioned. This functionality does not appear to be mentioned elsewhere. This would require an interface to an existing on-call system that is the source of truth for on-call. Will the government clarify if this functionality is in scope? If so, which system would we interface with? | The functionality is available at some locations within the VA and is within scope. It is a manual interface. | |
| 15 | B.4.16.2 | This section uses the term ‘perpetual’ licenses; however, pricing is scheduled as a yearly buy, not a perpetual one-time buy. Will the government confirm that this is not a perpetual license procurement? | The Government confirms that in accordance with B.1 Schedule of Supplies and Services, VA is seeking annual licenses. | |
| 16 | B.1 Page 11 | The Period of Performance for the ‘Option to Extend Services’ (not to exceed six months) is 8/1/2020-1/31/2031. Please clarify for CLINS 5001-5008. | The dates are corrected for CLINS 5001 - 5008. Option to extend services may be exercised at any time during the life of the contract. | |
| 17 | Ref. Page 6 (up to 100,000k lics) | Is the intent of the Government to include implementation costs in CLIN 0007 (up to 103 sites) and CLIN 00010 (addl. 72 sites, for total of 175)? If so, please clarify what the expected costs are to be included in CLIN 0005 (Messaging Software Application Solution IAW PWS Section B.4.8). The clarification is being asked because “implementation” is the same as explained in B.4.8.1 where it is stated “The Contractor shall provision all required hardware, software, and ancillary products for solution.” Please note that CLIN 0005 is not included in the “Optional Task Items” section, hence placing implementation cost in CLIN 0005 would be problematic. | Yes, it is the intent to have implementation costs in CLINS 0007 and 0010. There should not be any implementation costs in CLIN 0005 | |
| 18 | Ref. Page 6 (up to 100,000k lics) | For the optional “out years” will the Government consider omitting the word “implementation” for CLINS 1005, 1008, 2005, 2008, 3005, 3008, 4005,4008, 5005, & 5008? This will prevent repetitive costs for implementations that are already included in CLINS 0007 & 00010 in the base year. | The work implementation was removed from CLINS 1005, 1008, 2005, 2008, 3005, 3008, 4005,4008, 5005, & 5008 via amendment to the solicitaiton. | |
| 19 | B.4.5 | Is the VA open to the solution being hosted in the VAEC cloud? | The VA requires the SaaS be hosted on the contractor's Cloud Service Provider (CSP) PWS Reference Topic B.4.15 messaging Software SaaS Cloud Infrastructure | |
| 20 | Ref. Page 6 (up to 100,000k lics) | Does this indicate 20K->100K or is it an additional 100K taking it from 20k to 120K? | The VA may exercise the optional CLIN to order up to 100K additional licenses in addition to the initial requirement of 20K licenese. The total shall not exceed 120K total. | |
| 21 | General | The VA requires a FedRAMP HIGH Authorization or In-Process designation. Will Moderate tier be considered? | No, the VA requires FedRamp High. PWS Reference Topic B.4.3 Scope of Work; B.4.5 Specific Tasks and Deliverables, B.4.4.10 SAAS FedRAMO Requirements, C.1.10 VAAR 852.239.73 Information System Hosting, Operation, Maintenance, or Use (Feb 2023), Section E-Solicitation Provisions E.1.FAR 52.212-1 (1) Volume I - Technical (Phase 1) b) FedRAMP: The Offeror shall demonstrate that the Messaging SaaS solution meets the requirement for FedRAMP HIGH Authorization or provide documentation showing that the Messaging SaaS is in the process of FedRAMP HIGH Authorization IAW PWS section B.4.5.10 (for example, FedRAMP In-Process designation provided to Cloud Service Providers (CSPs)). | |
| 22 | General | The VA mandates a documented Data Security Characterization HIGH per FIPS-199. Will the Moderate standard of FIPS-199 be acceptable? | In accordance with PWS Reference Topic B.4.3 Scope of Work FIPS-199 Moderate standard will not be acceptable. | |
| 23 | B4.1 | Text messaging (SMS) is not secure as a product. Are we to assume the text message is the message in the platform and not a SMS? | The message must only transmit inside of the SAAS. PWS Reference B.4.3 Scope of Work The Contractor shall provide text messaging software application in a Software as a Service (SaaS) Federal Risk and Authorization Management Program (FedRAMP) HIGH/secure, and encrypted alpha, numeric and graphic communications cloud environment with Federal Information Processing Standards (FIPS)-199 Security Characterization HIGH., and B.4.5 Specific Tasks and Deliverables The Contractor shall provide a non-physical pager, non-life safety text messaging software application solution that delivers Federal Risk and Authorization Management Program (FedRAMP) HIGH secure, and encrypted alpha-numeric, and numeric communications. | |
| 24 | B4.1 | The data must at a minimum exist for the user to interact with the messages as explained in the scenario section. Is it the intent that there is no permanent data on a device outside of operational usage of the system? | All data transmitted shall reside on the Contractor's CSP. No data should reside on the device. PWS Reference B.4.1 Background No government data or information exists on device (No VA information or data exists, stored, or saved on device); B.4.5 Specific Tasks and Deliverables The Contractor shall enable the full capability and functionality of the solution with Government Furnished Equipment (GFE) smartphones and tablets as well as end user Bring Your Own Device (BYOD) non-GFE smartphones and tablets. The Contractor shall ensure the proposed messaging solution is designed to protect the confidentiality and integrity of all electronic Protected Health Information (PHI), Personally Identifiable information (PII), Sensitive Personal Information (SPI), and VA sensitive information, created, transmitted, received, and maintained/stored as alpha-numeric text messages. All messages shall be encrypted according to the Federal and Agency standards for all data at rest, in use and in transit to include compliance with the Federal Information Security Management Act (FISMA) and Federal Information Processing Standards (FIPS). The Contractor shall ensure no VA data, of any nature, is stored on the device. The Contractor shall ensure 100% separation of government/corporate and personal device data and information. | |
| 25 | B4.3 | ATO involves many groups that may be outside of this contract team. Is there a timeline expected to complete the ATO? | PWS Reference B.4.6 Authority To Operate (ATO) The Contractor shall develop necessary artifacts to obtain a VA authority to operate (ATO) for the solution (both cloud service provider SaaS platform and mobile text messaging software application) and complete VA Assessment and Authorization (A&A) process. All deliverables shall be provided within one year of award. | |
| 26 | B4.5 | Mobile device technology evolves quickly, and it might be impossible to guarantee compatibility will all devices. | PWS Reference B.4.8 MESSAGING SOFTWARE APPLICATION SOLUTION, B.4.8.3; and B.4.15 MESSAGING SOFTWARE SaaS Cloud infrastructure The Contractor shall provide a messaging software application capability that operates on software as a service cloud infrastructure, which is accessible from a diverse type of mobile operating systems (i.e. Android, iPhone Operating System (iOS)). The message software solution shall provide the functionality to adapt features and functionality on demand as the needs of the VA non-life saving alpha, numeric and image communication message traffic changes. | |
| 27 | B4.5 | The government has requested a SaaS solution which would appear to contradict this statement. Is there in place equipment that is expected to be supported outside the SaaS platform? | There is no inplace VA equipment for this requirement. | |
| 28 | General | GFE and BYOD are called out in multiple locations as well as SaaS. Can you elaborate on what hardware might be provided or offer examples? | PWS Reference B.4.5 Specific Tasks and Deliverables The Contractor shall enable the full capability and functionality of the solution with Government Furnished Equipment (GFE) smartphones and tablets as well as end user Bring Your Own Device (BYOD); B.4.15 MESSAGING SOFTWARE SaaS Cloud infrastructure The Contractor shall provide a messaging software application capability that operates on software as a service cloud infrastructure, which is accessible from a diverse type of mobile operating systems (i.e. Android, iPhone Operating System (iOS)). | |
| 29 | B4.4.4 | The government lists a site count and locations then indicates no travel. Will all deployments be remote for training and all other components or will we need to travel. | No travel is anticipated for this requirement. PWS Reference B.4.5.6 Contractor Managemenrt Plan; PWS Reference E.1.6 FAR 52.216-1 Type of Contract 9APR 1984) | |
| 30 | B4.9.2 | OS provided by the equipment manufacturer will have some control over the security but every effort will be made to adhere to this within the available controls of the OS manufacturer. Is that the intent? If not please explain. | The SaaS should comply with PWS Reference B.4.15 Messaging Software SaaS Cloud Infrastructure, B.4.21.4.9 Information Systems Design and Development, C.1.9 VAAR 852.239-72 Information System Design and Development (Feb 2023) | |
| 31 | C.1.2 | We respectfully requests to remove FAR 52.227-19, Commercial Computer Software License, and perpetual license terms. Those provisions are not applicable to the commercial off-the-shelf SaaS solutions provided under this contract, and the solution offered does not involve delivery of software or the grant of a perpetual license. | VA declines to remove FAR 52.227-19. With regard to the perpetual license terms, see Question #15. | |
| 32 | C.1.2 | Accordingly, any reference to a "perpetual license" or "delivery of software" should be replaced with the terms suggested below, which reflect a time-limited right to access the service under our standard subscription model: "Client shall have a limited, non- exclusive, non-sublicensable right to access and use the SaaS solutions during the subscription term, solely for its internal business purposes, (a) for those Solutions expressly indicated on a Quote (or documents referenced therein) as intended for download by the Client, to download and install the Solutions in object code form only on the number of servers and for the Users specified in the Quote; and/or (b) otherwise access and use the Solutions that are offered on a remotely-hosted basis by Company (in which case a copy of the software itself will not be made available for download)." | The VA declines this recommended langauge. |
File details come from the government source that posted it. Updated .