36C10B24Q0379 0001_1.pdf

36C10B24Q0379 Amendment 0001 – Industry Questions and Answers

5. PROJECT NUMBER (if applicable)

CODE 7. ADMINISTERED BY

2. AMENDMENT/MODIFICATION NUMBER

CODE

6. ISSUED BY

8. NAME AND ADDRESS OF CONTRACTOR

4. REQUISITION/PURCHASE REQ. NUMBER 3. EFFECTIVE DATE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED

PAGE OF PAGES

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED

BPA NO. 1. CONTRACT ID CODE

FACILITY CODE CODE

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

E. IMPORTANT:

is extended,

(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY is not extended.

12. ACCOUNTING AND APPROPRIATION DATA

(REV. 11/2016)

is required to sign this document and return ___________ copies to the issuing office. is not, A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

15C. DATE SIGNED

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER

Contractor

16C. DATE SIGNED

14. DESCRIPTION OF AMENDMENT/MODIFICATION

16B. UNITED STATES OF AMERICA

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER 16A. NAME AND TITLE OF CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR

STANDARD FORM 30 PREVIOUS EDITION NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.243

(Type or print) (Type or print)

(Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

(Number, street, county, State and ZIP Code)

(If other than Item 6)

(Specify type of modification and authority)

(such as changes in paying office, appropriation date, etc.)

(If required)

(SEE ITEM 11)

(SEE ITEM 13)

(X)

CHECK

ONE

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

(Signature of person authorized to sign) (Signature of Contracting Officer)

1 4

N/A

36C10B

Department of Veterans Affairs Technology Acquisition Center Procurement Service B 23 Christopher Way Eatontown NJ 07724

36C10B

Department of Veterans Affairs Technology Acquisition Center Procurement Service B 23 Christopher Way Eatontown NJ 07724

To all Offerors/Bidders

36C10B24Q0379

05-07-2024

X

TBD

X 1

The purpose of this amendment is to respond to the Request for Information questions that were submitted.

See Continuation Pages

Peter T. Lewandowski Contracting Officer

See Industry Q&As below – RFI 36C10B24Q0379 Amend 0001.

Question 1: The RFI asks to “Provide separate Rough Orders of Magnitude for the SaaS product in accordance with PD Paragraphs 1.0 through 1.2.”

o What does this mean? Not sure what you are wanting to see exactly.

Ans: The Rough Orders of Magnitude (ROM) are meant to provide a ballpark figure to help with initial budgeting and decision making. The ROM is an estimation technique that provides a high-level cost or time estimate for the product. This type of estimate is frequently used early in the development of a product when detailed information is not yet available. The ROM can be divided into key components as described in the PD paragraphs 1.0 through 1.2. To provide a ROM, let’s assume the following components based on a standard SaaS product requirement:

1. Development and Integration (if applicable)

2. Infrastructure and Hosting

3. Licensing and Subscriptions

4. Security and Compliance o 1.2 discusses FedRamp requirements, so not sure how to apply "orders of magnitude."

Ans: It has not yet been determined whether FedRAMP authorization is required for this requirement. Once this is determined, additional information/details will be provided.

Typically, when addressing specific FedRAMP requirements in a ROM estimate, it is critical to consider the significant effort and costs associated with achieving and maintaining compliance. It may include the cost of conducting an initial gap analysis, readiness assessment, and planning to determine the current security posture and what is required to achieve FedRAMP compliance. Adding the FedRAMP compliance costs to the other components of your SaaS product, as mentioned above, can provide the overall ROM as requested. Using “orders of magnitude” means understanding the scale of costs and efforts required to provide the product.

Question 2: PD states, “Work shall begin within five calendar days of award.” What constitutes “work”?

o Setting up users and beginning use of the platform, beginning FedRamp authorization, or some combination? We can handle either.

Ans: It has not yet been determined whether FedRAMP authorization is necessary for this requirement. Once this is determined, more information/details will be provided. It will be determined later whether the system can be used without FedRAMP authorization. If VA can use the product without first obtaining FedRAMP, then the work will include both user setup and FedRAMP authorization. If the system requires FedRAMP authorization, it must be completed before the product can be used.

Question 3: PD 5.5: The requirement for individual background checks is unclear and not specified by risk tier. For which tasks will the VA require background checks on our staff?

Ans: As stated in PD Section 5.5, if Contractor personnel will have any exposure to PHI or PII information, the sensitivity level will be medium, necessitating a background investigation.

Question 4: While unclear, it is our assumption that this specific RFI response intends that we acknowledge the federal privacy and security policy requirements and perhaps informally attest to compliance or our ability to comply, yet without formal attestation.

How much detail, if any, are you expecting for attesting to compliance for PD section 1.2 and thereafter?

Ans: When responding to the RFI that requires acknowledgement of federal privacy and security policy requirements, it is critical to provide a balanced response that demonstrates your understanding and ability to comply without committing to formal attestation at this early stage. You must effectively communicate your understanding of the requirements, demonstrate your capability and readiness to comply, and outline your proposed approach without committing to a formal attestation at the RFI stage. It should include enough detail to demonstrate your commitment and preparedness while remaining concise and focused.

Question 5: We have been told by VA security personnel that because vendors are submitting patient data and documents, the information is not considered “VA data”? Is this correct? If so, does it impact the security or compliance assessment requirements?

FedRamp authorization requirements? Timeline to implementation?

Ans: Since the data is originally provided to the vendor from VA, it is considered VA Data, and still requires PHI or PII protection from VA.

Question 6: Is it advisable to submit a video demonstrating the platform since some features are best appreciated by seeing it.

Ans: The customer would request a video demonstration of the platform’s features later if it was determined to be necessary/beneficial to determine product viability, while still in the planning phase.