36C10A25R0002 Published QA 10.21.25.xlsx
XLSX spreadsheet 30 KB Posted
- Attached to
- VA Modernized Messaging Software as a Service (SaaS) Federal contract opportunity
- Solicitation number
- 36C10A25R0002-0003
About this file
This document is a Questions and Answers (Q&A) file for VA Solicitation 36C10A25R0002, a Modernized Messaging Software as a Service (SaaS) procurement. The Department of Veterans Affairs Technology Acquisition Center Austin is seeking a secure messaging platform for healthcare communication, specifically targeting a Software as a Service solution compatible with Apple and Android devices. The solicitation is a total set-aside for Certified Service-Disabled Veteran-Owned Small Businesses (SDVOSB), with an initial license requirement of 20,000 users that can scale up to 120,000 users. Key technical requirements include FedRAMP Moderate authorization, secure mobile messaging capabilities, integration with EntraID/Active Directory, and compliance with data retention and privacy standards.
The procurement will follow a phased deployment approach, beginning with initial site testing for 30 days before enterprise-wide rollout. Vendors must provide a testing environment with their proposal and demonstrate ability to obtain a VA Authority to Operate (ATO) within 12 months of award. The solicitation allows for BYOD and government-furnished devices, with strict data privacy requirements. Licensing will be added in phases, with renewal options in subsequent contract periods. The VA anticipates the ATO process could take 9-12 months, and while AI is not currently being utilized, the solution must be adaptable to future technological integrations.
View the file
Other files for this federal contract opportunity
| File | Type | Posted |
|---|---|---|
| S06 - 36C10A25R0002 0003.pdf | ||
| S06 - 36C10A25R0002 0003 Amended RFP.pdf | ||
| S06 - 36C10A25R0002 0003 Attachments D1-D.3.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file on GovTribe
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Modernized Messaging SAAS
| Note: The answers provided below are for informational purposes, to assist potential offerors in preparing proposals, and such answers do not themselves constitute an amendment to the Request for Proposal (RFP). Where questions and answers necessitated such an amendment, such changes have been or will be incorporated into a formal amendment to the RFP. To the extent that any answers provided below conflict in any way with the RFP and any Amendments, the final RFP takes precedence. | |||
| # | PWS REFERENCE | QUESTION | RESPONSE |
| 1 | General | Can the Government confirm that funding is currently obligated or anticipated to be obligated at the time of award for Solicitation 36C10A25R0002 | Funding is not currently available as the Federal Government is shutdown. Requirement will not be awarded until such time as funds are made available. FAR Clause 52.232-18 "Availability of Funds" has been added via amendment to the solicitation. |
| 2 | General | Will the cost of OEM COTS software licenses provided to the Government under this contract be treated as “materials” or “supplies” that are excluded from the 50% self-performance calculation for services contracts under FAR 52.219-14/VAAR 852.219-75? | The requirement is for Software as a Service and and will not be treated as a supply requirement. 'In the case of a contract for services (except construction), the contractor |
will not pay more than 50% of the amount paid by the government to it to firms that are not certified SDVOSBs"
| 3 | General | Does the Government anticipate structuring the license portion under a separate CLIN and/or NAICS code to distinguish it from services? | The license CLINS will not be assgined a separate NAICS code. |
| 4 | General | Does the Government anticipate an applicable Non-Manufacturer Rule (NMR) waiver for the license component? | The VA is not seeking an individual NMR waiver as this RFP is for a Software as a Service (SaaS). |
| 5 | Sec. E.2 (Pg 105) | For Step 2, which mobile devices will evaluators use? | Apple and Android |
| 6 | Sec. E.2 (Pg 105) | For Step 2, can application login credentials be sent separately from the Step 2 documentation? | Offerors can provide this in accordance with FAR 52.212-1 Additional Instructions: (II) Technical step 2. |
| 7 | Sec. E.1 of the PWS (Pgs 92 - 93) | Regarding Excel spreadsheet tabs D.1 and D.2: Is the intention that these are now answered in the RFP response doc rather than in the Excel spreadsheet? In other words, are offerors expected to submit the Excel spreadsheet at all? If the VA’s intention is that the information from the D.1 and D.2 tabs is to be included in the technical response narrative, would the VA consider increasing the page count maximum from 35 pages to 40 pages? | Offerors shall adhere to FAR 52.212-1 Additional Instructions: (I) Volume I - Technical (Phase 1) Paragraph 1 "...B.4. The narrative shall also address how the Offeror’s proposed solution meets all of the Attachment D.1 - Functionality Checklist." The VA declines to increase the page count. |
| 8 | Sec. D (Pg 86) | Includes D.1 and D.2 on list of attachments. Please confirm that the Excel document with tabs D.1 and D.2 is no longer a deliverable in Excel format. | This was answered at question 7. |
| 9 | Tab D.3 - Written Step-by-Step Instructions for B.4.15 Software Application Capabilities and Effectiveness | This tab, and all tab numbering, and all use cases, reference B.4.15 Software Application Capabilities and Effectiveness. RFP on page 28 of 125 has this section, and all use cases, as B.4.14. Please confirm that the RFP numbering is the correct numbering. | Attachment D.3 has been updated via amendment to the solicitation to align with the PWS for B.4.14. |
| 10 | General | What mobile device management (MDM) solution does VA currently use for GFE devices? | Microsoft InTune (prefered) and WorkSpace One |
| 11 | Sec. B.4.9.2 | For the audit trails mentioned in B.4.9.2, what specific data elements must be captured, and in what format should logs be exportable? | Images, pictures Logs should be export in CSV, PDF or Excel |
| 12 | General | What is the expected peak message volume per hour and average message size to properly size the infrastructure? | Peak message volume can vary depending on location. For example: VA Hines, IL could receive priority messages every 15 minutes, whereas VA Topeka, Kansas might receive messages every 1 to 3 hours. |
| 13 | Sec. B.4.10 | Can you provide examples of the message escalation cascade rules mentioned in B.4.10 to better understand the complexity required? | CRITICAL ALERT: Patient Doe, John, Rm 421. Troponin: 2.1 ng/mL. Acknowledge and order cardiology consult. |
STROKE ALERT: Patient Jane Doe, 68F, presents to ED with facial droop and slurred speech. Last seen normal: 13:30. Activate Stroke Team.
| 14 | General | Can the VA clarify the expected timeline and process for mobile application compliance approvals (Privacy, Security, Section 508, Technical Reference Model, FedRAMP documentation, and ATO)? Specifically, will these approvals occur sequentially or in parallel during implementation and go-live? | Reference paragraph B.4.5.10.1.1 "The contractor shall obtain VA authorization within 12 months from date of award." and B.4.5.10.1.15 " B.4.5.10.1.15. | Successful issuance of a VA ATO will be required before live VA data can be used in the system." | |
| 15 | General | The RFP states that at the time of submission, vendors must provide “access to proposed temporary software licenses in vendor training environment.” Can you please clarify whether this means: • | Vendors are expected to provide a fully functional mock prototype or demo environment that reflects the proposed solution’s look, feel, and functionality, and | ||
| • | Does the environment have to be accessible to VA evaluators at the time of proposal submission, with appropriate temporary licensing in place? | ||||
| Understanding the depth of access and functionality expected will help us align our technical demonstration and licensing strategy accordingly. | Offerors proposed solution should meet all of the requirements of B.4 of the solicitaiton at time of proposal. Offerors shall adhere to FAR 52.212-1 Additional Instructions: (I) Volume I - Technical Step 2. Offerors are expected to provide VA with access to the offeror’s testing environment for the proposed Messaging SaaS. | ||||
| 16 | General | Does the government desire to have changes to the submission clearly marked for the ease of identification, or an entirely new submission? | Offerors shall submit a complete proposal in response to the amended solicitation. | ||
| 17 | General | Does the government desire to have changes to the submission focus only on the changed requirements in the amendment, or can other content be updated as well? | This was answered at question 16. | ||
| 18 | General | Is the VA open to proposals based on any FedRAMP High-authorized SaaS solution, or are only the specifically listed vendors/products eligible? | FedRamp Moderate is the minimum acceptable requirement. The solicitation does not contain any specifically listed vendors or products. | ||
| 19 | General | Will the VA accept consortium or integrator approaches (e.g., SDVOSB prime with a large business technology partner), or must all licensing/support flow through the SDVOSB? | Offerors shall comply with C.1.11 VAAR 852.219-73 VA Notice of Total Set-Aside for Certified Service Disabled Veteran Owned Small Businesses paragraph (f) regarding Join Ventures. | ||
| 20 | General | Will the VA consider solutions that meet all compliance/security requirements but may not offer every feature listed (e.g., specific escalation workflows, multi-tenant isolation)? | Offerors shall propose a detailed written approach addressing the requirements, as stated in the instructions provided in the solicitation at page 93-94. | ||
| 21 | General | Are there any “must-have” requirements that would disqualify a solution if not met at go-live? | Offerors shall propose a detailed written approach addressing the requirements, as stated in the instructions provided in the solicitation at page 93-94. | ||
| 22 | General | Does the VA require the proposed solution to have an active VA Authority to Operate (ATO) at proposal submission, or can this be completed post-award? | This was answered at question 14. | ||
| 23 | General | Will the VA accept FedRAMP High certifications from the underlying platform, or must the entire solution (including integrations) be separately authorized? | The VA will accept the underlying platform's FedRAMP High authorization for its services; however, you must separately authorize any integrations that process, store, or transmit data | ||
| 24 | General | Can a large reseller (such as SHI) fulfill licensing, cloud infrastructure, and support as a named subcontractor if the SDVOSB prime manages overall delivery and reporting? | Offerors shall comply with C.1.11 VAAR 852.219-73 VA Notice of Total Set-Aside for Certified Service Disabled Veteran Owned Small Businesses | ||
| 25 | General | Does the VA require all billing and end-user support to be handled exclusively by the SDVOSB? | Offerors shall comply with C.1.13 VAAR 852.232-72 Electronic Submission of Payment Requests | ||
| 26 | General | Will the VA provide a prioritized list of sites for phased rollout, or is nationwide deployment expected at once? | The VA anticipates a phased approach, starting with the first few sites for 30 days of testing. Once all ATO approvals are obtained, it will then be deployed enterprise-wide. | ||
| 27 | General | Are integrations with existing VA communication platforms (Teams, mobile device management, etc.) required, or optional? | Teams is optional. Mobile Device Management is required for government-furnished devices. For BYOD, Mobile Application Management is preferred, with a PIN lock required to unlock the app. | ||
| 28 | General | Will VA require all 100,000+ users enabled at launch, or will licenses be added in phases? | Licenses will be added in phased approach | ||
| 29 | General | Is there a minimum license commitment per year? | Licenses once ordered will be renewed at the option period. | ||
| 30 | General | Please confirm the Government wants the Offeror to submit the narrative addressing the aforementioned requirements within the Volume 1 Technical Volume (Word or PDF format) and NOT complete the Attachment D.1 and D.2 Excel Spreadsheet. | This was answered at question 7. | ||
| 31 | General | If the Government requires the Attachment D.1 and D.2 Excel Spreadsheet to be completed and submitted in .xls format, we respectfully ask that the instructions be updated accordingly. | This was answered at question 7. | ||
| 32 | General | Will testers utilize a variety of devices for testing (i.e. iPhone, Android, Desktop)? | This was answered at question 5. | ||
| 33 | General | Are any or all of the testers clinicians? | The VA will utilize a mix of subject matter experts. | ||
| 34 | General | Will bidders be made aware of the specific time frame the test scripts are being executed and allowed to interact with the testers during evaluation for demo purposes? | Offerors will not be permitted to interact with the testers during the evalution for demonstration purposes. | ||
| 35 | General | Regarding Solicitation 36C10A25R0002 for a Modernized Messaging Software as a Service solution, can the VA elaborate on its assessment criteria for data retention features in proposals, especially solutions featuring automated bots for greater adaptability? | The solution must be capable of implementing and enforcing data retention policies to maintain records that align with federal guidelines. | ||
| 36 | General | For Solicitation 36C10A25R0002 concerning Modernized Messaging Software as a Service, could the VA provide insight into how it appraises proposals’ integration of artificial intelligence or large language models, focusing on systems that support effortless incorporation and activation of AI-enhanced tools right inside the messaging interface? | Currently, AI is not being utilized. | ||
| 37 | General | Will each tester execute all test scripts provided? | Yes | ||
| 38 | General | Could the government please provide any insight into the decision to shift from FedRAMP High to FedRAMP Moderate? | The prior requirement was unduly restrictive and VA determined it was in its best interest to amend the requirement. | ||
| 39 | General | How does the government want the vendor to show graduated pricing for licenses in the case of volume discounts? | Offerors may propose volume discount pricing or graduated pricing in their proposal. There is not a defined format. | ||
| 40 | PWS B.4.1 | This statement and the next statement conflict with each other: | |||
| • | No government data or information exists on device (No VA information or data exists, stored, or saved on device) • | 100% separation of government/corporate and personal device data and information (Preserves end-user privacy) Is Government data allowed on devices? This may contradict the requirement for encrypted data in transit, at rest, and in use, which implies some transient data storage or caching on devices. Is temporary device memory storage (for transmission buffering or notifications) acceptable under “no data at rest” interpretation? | On a government-furnished device managed by Mobile Device Management, data storage is acceptable. For bring-your-own-device (BYOD), the VA does not want any data stored on the personal device. Storing data in the SaaS environment is acceptable. | ||
| 41 | General | In reference to integration with other VA systems, will there be development, testing, QA, and/or production environment for all systems? | Integration with the EntraID system for user lookup is required. However, if the application supports Single Sign-On (SSO) with EntraID (Also know as Active Directory), please note that only a production environment is available. | ||
| 42 | General | In reference to integration, how many different types of systems will the SaaS product need to integrate with besides VA’s Active Directory/Entra ID/global address directory systems? | Active Directory and EntraID are the authentication solutions. If your solution is capable of integrating with these systems for seamless user lookup to validate legitimate VA users, it would be beneficial. | ||
| 43 | Ref. CLIN 008, Pg #6 | Does this indicate 20K->100K or is it an additional 100K taking it from 20k to 120K? | The VA intends to utilize 20K licenses initially with the ability to scale up to 120K. | ||
| 44 | B4.1 Pg #16 | Text messaging (SMS) is not secure as a product. Are we to assume the text message is the message in the platform and not a SMS? | The VA is seeking a secure messaging platform, not an SMS-based solution. | ||
| 45 | B4.1 Pg #16 | The data must a a minimum exist for the user to interact with the messages as explained in the scenario section. Is it the intent that there is no permanent data on a device outside of operational usage of the system? | The data's existence is directly tied to the system and app on Apple or Android device. When the user is done with a message or a chat session, that data is not stored on the BYOD device to fulfill the system's operational requirements | ||
| 46 | B.4.3 Pg #20 | ATO involves many groups that may be outside of this contract team. Is there a timeline expected to complete the ATO? | ATO approval can take anywhere from 9 months to a year. While VA employees will assist with the process, a significant portion of application security responsibilities will fall under the vendor's SaaS environment and the mobile application | ||
| 47 | B4.5 Pg #21 | Mobile device technology evolves quickly, and it might be impossible to guarantee compatibility will all devices. | Apple and Android are the only two brands currently being utilized | ||
| 48 | B4.5 Pg #22 | The government has requested a SaaS solution which would appear to contradict this statement. Is there in place equipment that is expected to be supported outside the SaaS platform? | No | ||
| 49 | B4.5 Pg #22 | GFE and BYOD are called out in multiple locations as well as SaaS. Can you elaborate on what hardware might be provided or offer examples? | Government-furnished devices and bring-your-own devices (BYOD) will be used for testing the pager modernization solution by users. The system will be hosted on a SaaS platform (e.g., Office 365). | ||
| 50 | B4.9.2 Pg #29 | OS provided by the equipment manufacturer will have some control over the security, but every effort will be made to adhere to this within the available controls of the OS manufacturer. Is that the intent? If not please explain. | The VA requires that only the mobile application and SaaS environment be secured. If there are limitations due to the operating system, the VA understands. | ||
| 51 | Sec. D3 | Step 2 Evaluation In the attachment it only covers 4.8.2 The SOW covers 4.14-4.14.7, in addition to 4.8.2. Which scenarios do offerors need to prepare for in Step 2? | Attachment D.3 has been updated via amendment to the solicitation to align with the PWS for B.4.14. Offerors shall be prepared to address the scenarios in Attachment D.3. | ||
| 52 | RFP Pgs 92 - 93 | Will the government confirm that offerors shall include their responses to the Attachment D.1 checklist and Attachment D.2 questions within the Volume I PDF, rather than populating the Attachment D.1/D.2 Excel spreadsheet and submitting it separately? | Attachments D.1 and D.2 are to be addressed in Volume 1, Phase 1 Technical. The VA declines to increase the page count. | ||
| 53 | General | Confirm if there was an incumbent contractor for this (solicitation 36C10A25R0002)? If so, I would greatly appreciate it if you could provide the total awarded contract amount. | No incumbent. This is a new requirement. |
File details come from the government source that posted it. Updated .