RFP QAs - 36C10B26Q0632_final.xlsx
XLSX spreadsheet 15 KB Posted
- Attached to
- DA01--Data Engineering, Management Support and Quality Assurance Recommendations (VA-26-00062403) Federal contract opportunity
- Solicitation number
- 36C10B26Q0632
About this file
This is a Questions and Answers document for RFQ 36C10B26Q0632, addressing clarification inquiries from prospective contractors regarding a Data Engineering, Management Support and Quality Assurance Recommendations solicitation for the Department of Veterans Affairs.
The solicitation requires a contractor to maintain and manage the Authority to Operate (ATO) for the Staff Sgt Gordon Fox Suicide Prevention Grant Data Collection Tool (DCT), a hybrid system combining custom software (onboarding app, ETL pipeline) with commercial off-the-shelf products (PowerBI, BHL Touch) housed on VA Enterprise Cloud services. Key support requirements include application support limited to business hours (8am-5pm Eastern) with near-real-time monitoring, alert management, troubleshooting, production deployments, and QA checks. The system has a maximum tolerable downtime of 7 days and requires vulnerability patching timelines ranging from immediate (emergent patches) to 60 days depending on severity and exposure. The scope encompasses planned and routine data requests, monthly/quarterly/annual analyses, new or revised forms, ETL changes, enhancements, and troubleshooting on a Firm-Fixed-Price basis. Transition activities run from contract award until January 7, 2027, with plans for potential extensions. Offerors may substitute anonymized case study artifacts or hypothetical scenarios demonstrating comparable enterprise data engineering, cloud systems integration, COTS platform configuration, and federal operations experience if customer restrictions prevent artifact disclosure. The Government will provide at no cost all necessary documentation, system access, VA PIV credentialing (low-risk classification), network access, and required HIPAA/privacy training. The proposal due date was extended to August 12, 2026, at 3:00 PM EST. Past performance evaluation requires CPARS records with no alternative Past Performance Questionnaire option accepted. Small business teaming and subcontracting are permitted and encouraged; a Small Business Subcontracting Plan is not required.
View the file
Other files for this federal contract opportunity
| File | Type | Posted |
|---|---|---|
| 36C10B26Q0632_3.pdf | ||
| 36C10B26Q0632_3.docx | DOCX document | |
| 36C10B26Q0632_2.docx | DOCX document | |
| 36C10B26Q0632_2.pdf | ||
| 36C10B26Q0632_1.pdf | ||
| 36C10B26Q0632_1.docx | DOCX document | |
| 36C10B26Q0632.docx | DOCX document | |
| 36C10B26Q0632 Final.docx | DOCX document |
On GovTribe
Work with this file on GovTribe
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Clarification Questions Data Engineering, Management Support and Quality Assurance Recommendations — RFQ 36C10B26Q0632
| Question Number | RFQ Section and/or | ||
| Topic | Question | VA Response | |
| 1 | PWS Background; PWS 5.2 and Managing the ATO Process | The PWS states that the DCT received a two-year ATO in June 2025 and requires the Contractor to maintain the DCT ATO and manage the ATO process. |
| Please confirm whether the successful Contractor will be responsible for completing the next full reauthorization during the base period. If so, please provide the system’s current FIPS 199 impact level/control baseline and the number of open POA&M items by risk level that the Contractor should account for in its Firm-Fixed-Price proposal. | See the final PWS provided in Section B.2 of the solicitation, specifically Sections 5.2, 5.3.5, 5.4.2, 5.5.1 and 5.5.3, for all requirements. | ||
| 2 | PWS 5.3.4 and Transition Activities – Monitoring and Support Coverage | The PWS requires near-real-time monitoring and assigns responsibility for alerts, troubleshooting, production deployments, and QA checks, but does not state the required service window or incident response targets. |
Please confirm whether support is limited to normal business hours or requires after-hours/on-call coverage, and provide any incident severity definitions and response or restoration time requirements that Offerors must staff and price. See the updated PWS provided in Section B.2 of Amendment 0003 to the solicitation.
Application support is limited to business hours (8am-5pm Eastern) and provided by the contractor. After hours responses are managed by VA OIT platform support teams.
Information System Vulnerability Management Plan (ISVMP) Definitions for Patching Timelines:
1. Emergent: patches are required to be tested and applied as soon as possible in accordance with an organizational assessment of risk.
2. Public Facing Critical: patches are required to be tested and applied within 15 days.
3. Public Facing High: patches are required to be tested and applied within 30 days.
4. Known Exploited Vulnerabilities (KEV): patches are required to be tested and applied within timelines established per DHS Cybersecurity & Infrastructure Security Agency. (CISA) catalog or a POA&M mitigation strategy is required.
5. All other vulnerabilities:
- Critical: vulnerabilities are required to be tested and remediated within 60 days.
- High: vulnerabilities are required to be tested and remediated within 60 days.
- All other, non-critical or non-high vulnerabilities: the Information System Owner determines the remediation timeframe.
For systems with vulnerabilities not remediated within the established timeframes, a Plan of Action and Milestone (POA&M) mitigation strategy is required following the current guidance.
System Business Impact Analysis (BIA) Downtimes:
Information System/Application: Staff Sgt Gordon Fox Suicide Prevention Grant Data Collection Tool and Analytics Maximum Tolerable Downtime: 7 days Recovery Time Objective: 30 days Work Recovery Time: Immediate Recovery Point Objective: 30 days 3 PWS 5.1–5.2 / Section B.1 Price Schedule – Workload Assumptions The Firm-Fixed-Price scope includes planned, routine, and ad hoc data/reporting requests; monthly, quarterly, and annual analyses; new or revised forms; ETL changes; enhancements arising from Congressional or policy changes; and troubleshooting.
| To establish a common pricing basis, please provide the trailing 12-month quantities for (a) ad hoc data/reporting requests, (b) new requirements or enhancement requests, (c) production releases, and (d) incidents or technical-assistance tickets, or provide the workload assumptions Offerors should use for each category. | This information cannot be provided at this time as what has been required in previous years is not an indication on what will be needed in the upcoming years. | ||
| 4 | Section E.6(i), Volume I – Technical Factor: Case Studies | The solicitation requires Offerors to submit artifacts that are actual work products generated for the described Case Study, and states that artifacts must not be created in response to this solicitation. The solicitation also permits artifacts to be anonymized to protect PII, PHI, or proprietary data. However, for work performed within Federal or other sensitive environments, the underlying artifacts, including code, screenshots, system configurations, and other technical work products, may be owned by the customer and subject to contractual, security, or data-handling restrictions that prohibit their removal, reproduction, or disclosure, even when anonymized or redacted. |
| If an Offeror is unable to provide an original Case Study artifact due to such restrictions, what alternative evidence or submission format will the Government accept to demonstrate and validate the relevant experience without violating customer ownership, security, or data-protection obligations? | An Offeror may provide whatever artifacts they can to best demonstrate their experience. The Offeror may provide scenarios that could potentially work the problems and cite specific examples, even if those examples cannot show many details. The Offeror may also provide hypothetical situations similar to those they have completed in the past, but are protected, and describe the staff and resources used to perform those tasks. | ||
| 5 | Section E.6(i), Volume I – Technical Factor: Case Studies | The solicitation requests case studies demonstrating experience with: |
• systems configuration of an existing Commercial Off-the-Shelf (COTS) product in a Federal Cloud Enterprise, such as the VA Enterprise Cloud; and
• achieving and maintaining an Authority to Operate (ATO) for a federally implemented COTS product requiring additional systems configuration.
| Would the Government consider experience performing comparable enterprise data engineering, cloud systems integration, COTS platform configuration, ETL, reporting, and secure operations within commercial or state-regulated cloud environments as relevant experience, where the Offeror does not have prior experience specifically within the VA Enterprise Cloud or maintaining a federal ATO? | Yes | ||
| 6 | CPARS | We saw that the Government is requesting and requiring CPARS to assess contract performance risk but did not provide any PPQ forms that industry can submit in lieu of CPARS. Some contracts like OTAs don't require CPARS to be issued yearly and CPARS do not reflect subcontractor performance or non federal contracts. Requiring offerors to demonstrate past performance solely through CPARS ratings, without offering an alternative mechanism such as Past Performance Questionnaires (PPQs) for relevant experience that lacks a CPARS record, unreasonably restricts competition and may constitute grounds for protest under applicable procurement regulations. |
| Would the Government consider issuing a Past Performance Questionnaire (PPQ) as an alternative to CPARS for demonstrating relevant past performance? If so, industry would need additional time to work with customers to complete and return the PPQs, and we request the Government consider a corresponding extension to the proposal due date. | No, see Section E.5 B.3. of the solicitation. | ||
| 7 | Past Performance | The evaluation criterion states 'Past performance records — prolonged delay exceeding two business days in resolving software problems will be noted in past performance records.' Our firm is a small business with no prior federal contract history and therefore has no CPARS records. |
Will the Government accept
(a) commercial past-performance references and/or contractor-completed Past Performance Questionnaires from non-federal customers covering equivalent software engineering, sustainment, and QA work, and
| (b) our proposed subcontractor's CPARS records, in lieu of offeror CPARS? Please confirm whether CPARS is the sole acceptable vehicle or whether other documentation of relevant past performance will be evaluated. | No, see answer to Q6. | ||
| 8 | NAICS code | We are a small business under NAICS 541519 with primarily commercial past performance. |
Please confirm:
(a) teaming arrangements and subcontracting are permitted and may be evaluated under the past-performance factor using the team member's records;
(b) whether the Government requires a Small Business Subcontracting Plan even though the acquisition is not set aside; and
(c) the minimum subcontractor experience the Government would require to credit a teammate's record.
| Knowing this will determine whether we propose as a prime with a teammate, or pursue this only as a subcontractor to a CPARS-credentialed prime. | Yes, see Section E.6 2.b.(iii) of the solicitation. The government welcomes partnerships with other contractors. A Small Business Subcontracting Plan is not required. The minimum experience is in Section E.6 2.b.(iii) of the solicitation. | ||
| 9 | DCT | Our read indicates the existing Data Collection Tool (DCT) supports VA's suicide-prevention grantees, and that the incumbent's architecture, source code, and operational runbooks are not specified as deliverables. |
Please confirm:
(a) whether the Government will provide at no cost access to the incumbent's source repository, environment credentials, architecture documentation, and operational runbooks during transition-in;
(b) the planned duration (in business days) for transition-in and any parallel operations with the incumbent; and
(c) whether an incumbent-furnished technical briefing will be funded as a separate CLIN.
| This affects our staffing ramp, transition risk, and price. | VA will provide access to all necessary documentation, systems, servers, repositories, etc. to complete the tasks of the requirement at no cost. The DCT is housed on VA servers using VA Enterprise CLOUD services. As of today, the duration of transition will be from the time of award until 01/07/2027. However, there are plans for further extensions based on how the transition progresses. | ||
| 10 | SF1449 | The synopsis references FAR Part 12 commercial-item procedures, completion of blocks 12, 17, 23, 24, and 30 of the SF1449, and a 5-business-day response window, but does not state the contract type. |
Please confirm:
(a) whether this is a single-award task order, a single Performance Work Statement, or an IDIQ/BPA;
(b) the pricing arrangement (FFP, T&M, or CPFF);
(c) the Period of Performance including any option periods; and
| (d) whether SF1449 blocks 23 and 24 should reflect a total evaluated price or a price schedule. This will determine whether we price as a fixed deliverable or build labor categories and rates. | A final PWS was already provided in Section B.2 of the solicitation. The contract type was already provided in Section E.3 of the solicitation. The period of performance was already provided in Section C.2 of the solicitation. The Price Schedule was already provided in Section B.1 of the solicitation. | ||
| 11 | DCT | The document states 'The Contractor shall deliver to the Government all data first produced under this Contract/Order with unlimited rights as defined by FAR 52.227-14, including any custom code developed for the purpose of performing under this contract,' and separately that commercial computer software may carry restricted rights. |
Please clarify whether the existing suicide-prevention grantee Data Collection Tool (DCT) is (a) custom-developed for VA so unlimited rights apply and no third-party license is in effect, (b) a COTS product with an existing VA-wide license, or (c) a hybrid.
| This determines whether our team must budget for commercial license pass-through and whether modifications are deliverable with unlimited rights. | It is a hybrid. There is custom software, to include the onboarding app, ETL and Pipeline, and COTS, to include PowerBI and BHL Touch, that both work together. MITRE owns the IP, but the software belongs to VA as VA paid for the software in perpetuity. The software can be used by the Contractor at no cost. The Contractor will have ownership over the software during the life of the contract. | ||
| 12 | DCT | The Data Collection Tool supports grantees collecting information on VA suicide-prevention programs, which likely involves personally identifiable information and possibly protected health information. |
Please specify:
(a) the required background investigation or suitability level for personnel (e.g., Public Trust Tier 2/3, MBI, NACI);
(b) the sponsoring agency and adjudication entity;
(c) whether VA credentialing (PIV) and system access (e.g., VA network/email accounts) will be provided to contractor staff at no cost; and
(d) any BAA or HIPAA requirements.
| This will determine the onboarding lead time, staffing cost, and whether cleared personnel are reasonably available. | This is a low risk and low tier security classification that does require VA access with the use of a PIV. That PIV will be adjuticated by the COR of the contract through the VA at no cost to the Contractor. All required network access will be provided to the Contractor at no cost by the COR of the contract through the VA. There are two Talent Management System (TMS) requirements needed upon award related to HIPAA and privacy. Access and guidance for the training will be provided by VA at no cost to the Contractor. | ||
| 13 | PWS | Our read of the synopsis indicates the actual technical scope is limited and the bulk of the package consists of FAR 52.212 clauses, data-rights language, and SF1449 blocks. |
| Please confirm whether a Performance Work Statement (PWS), Statement of Objectives (SOO), or detailed task description is attached to the solicitation or distributed separately to interested offerors, and if so the file name and where it can be obtained. Without the detailed PWS we cannot accurately scope labor categories, hours, or technical approach. Please also indicate whether an industry day, site visit, or one-on-one conference is planned during the open period. | A final PWS was provided in Section B.2 of the solicitation. There are virtual conferences almost daily with the VA and the VA will perform a site visit annually. | |||
| 14 | Extension | Would the government consider extending the due date for submission to August 12th due to the number of live VA proposals industry is responding to? | Yes. See Amendment 0002. | |
| 15 | Page Count | Can you please confirm the cover pages do not count toward the maximum page count? | No. See Section E.6 2.b. of the solicitation. |
File details come from the government source that posted it. Updated .