RFI 36C10B26Q0830 - QandA - Part 2.xlsx
XLSX spreadsheet 17 KB Posted
- Attached to
- 7A21--(New Action): VA Procurement Policy Documentation Control Software (VA-27-00008195)
- Solicitation number
- 36C10B26Q0830
About this file
This is a Questions and Answers document (Part 2) for Request for Information (RFI) 36C10B26Q0830 issued by the Department of Veterans Affairs Technology Acquisition Center Austin for a document control management system to manage Standard Operating Procedures (SOPs), forms, and related reference materials within SharePoint Online. The RFI response deadline was extended to October 15, 2026, at 10:00 a.m. Eastern Time.
The Q&A clarifies critical technical and operational requirements for prospective vendors. VA will not provide separate development/test environments; vendors must work within the production SharePoint Online tenant operating in GCC (not GCC High). Only approved SharePoint Framework (SPFx) packages from VA's catalogs are permitted, though open-source solutions like PnP Modern Search may be submitted for governance review without platform-level VA support. Solutions operating entirely within VA's existing Microsoft 365 tenant inherit the tenant's FedRAMP authorization and do not require independent FedRAMP certification; however, an alternative SaaS deployment path outside the VA tenant would require FedRAMP Moderate authorization (impact level pending finalization of VA's Data Security Categorization). VA expects approximately 145 SOPs and 173 attachments in mixed office formats (Word, PDF, Excel), with volumes expected to fluctuate 10-20% over time; concurrent editing will not exceed two users per document. The base period of performance runs December 1, 2026, through November 30, 2027, with initial implementation using non-live content prior to Authority to Operate (ATO) grant. For native builds within the M365 tenant, VA will furnish Microsoft 365/SharePoint Online licensing and price contractor effort as services (implementation/development and recurring support/maintenance) rather than licensed products. Accessibility must comply with WCAG 2.1 AA, and archived SOP versions require read-only protection via alternative methods (SharePoint permissions, approval workflows, or custom controls) since Microsoft Purview record labeling is only in pilot status. The true concurrent user base is estimated in the hundreds at any given time, not the full 400,000 VA population figure cited for total addressable readership.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 36C10B26Q0830 0002.docx | DOCX document | |
| RFI 36C10B26Q0830 - QandA.xlsx | XLSX spreadsheet | |
| 36C10B26Q0830 0001.docx | DOCX document | |
| DRAFT - Product Description - SharePoint Online Integration.docx | DOCX document | |
| 36C10B26Q0830.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Vendor Questions | Customer Answers |
| Is the proposed system expected to implement document authoring capabilities (similar to MS Word/Adobe)? If not, should it interface with any such software? | The original thought was to have the authoring done outside the doc control system. This would reduce the number of licenses required for seats on the system. We would certainly entertain such a system. |
| At most, how many concurrent editors for a given document are required? | the number of editors concurrently editing a document simultaneously would likely not exceed two. |
| Implementing a system with version control, editorial oversight and access restrictions will necessitate operational changes to enforce these policies. Consequently, detailing the current document authorship workflow will enable us to design a system that minimally disrupts operations. | Document authorship is envisioned to happen outside the system. Likely, concurrent editing of a draft document for approval (also envisioned to occur outside the system) would not exceed two individuals when proposing a solution that includes document authorship. |
| Please provide services CLINs for Task 1.1 (Solution Implementation) and Task 1.2 (Ongoing Technical Support), since the current Table of Requirements lists only a part number and quantity for a services effort. | This research is designed to help us better understand exactly what those would include. |
| Please confirm the number of existing SOPs, forms, and job aids, and their current formats, since this drives migration scope and cost. | VA's current inventory consists of approximately 145 SOPs and 173 associated attachments (forms, job aids, and reference materials). This volume is expected to fluctuate by approximately 10–20% over time as procedures are added, revised, or retired. Current content exists in a mix of common office formats (e.g., Word, PDF, Excel). Respondents should size their proposed migration and ongoing-management approach accordingly. |
| Please confirm the tenant cloud, GCC or GCC High, and whether SPFx and Power Automate are approved for this use. Please also confirm whether open source SPFx solutions, such as PnP Modern Search, are permitted on the VA Technical Reference Model. | VA's SharePoint Online tenant operates in GCC (not GCC High). Only SPFx packages from VA's approved catalogs are currently permitted — custom SPFx packages require a multi-step governance review (intake, Technical Advisory Group review, architecture/security review, and code review) prior to approval. Open-source SPFx solutions, including PnP-based solutions (e.g., PnP Modern Search), may be submitted for assessment and SharePoint Technical Advisory approval through the same intake process; however, VA does not provide platform-level support for PnP solutions, and respondents should be prepared to rely on open-source documentation and community support rather than VA assistance. Power Automate approval for this specific use case has not yet been confirmed and would be subject to the same governance review. |
| Please confirm that Section 6 (FedRAMP) does not apply to a solution operating entirely within the VA tenant. | Confirmed. Section 6 (FedRAMP Assessment and Authorization) applies to solutions requiring their own, separate cloud authorization boundary outside the VA M365 tenant. A solution operating entirely within VA's existing, already-authorized M365 tenant inherits that tenant's existing authorization and would not require independent FedRAMP authorization under Section 6. |
| Please align the accessibility standard. Section 2.1 cites WCAG 2.0, while the salient characteristics require WCAG 2.1 AA. | Confirmed — this is an inconsistency in the draft Product Description. The correct, intended standard is WCAG 2.1 AA, as stated in the salient characteristics table. Section 2.1 will be corrected in a future amendment to reflect WCAG 2.1 AA rather than WCAG 2.0. |
| Please specify the applicable VA Records Control Schedule for archived SOP versions. | VA's current expectation is that the retention period for these SOPs will be indefinite, given that they direct contracting activities tied to individual contracts, and it is not administratively practical to determine when all contracts governed by a particular SOP version have reached completion. VA is confirming the applicable VA Records Control Schedule (RCS) item number with VA Records Management and will provide this citation once confirmed. |
| Please define the category taxonomy owner, notification recipients, and review cycle intervals. | VA anticipates that the Content Administrator role, as described in the salient characteristics table, will serve as the taxonomy owner, with overall governance residing within the Program Office (OALC, Office of Procurement Policy). A specific individual or role will be designated post-award. |
As this is an initial stand up of such a system, review cycle intervals are yet to be determined. Notification recipients are those within the acquisition field and their customers.
Please confirm that Sections 3.0, 4.0, 5.3, and 5.7 do not apply to a tenant-native configuration. Sections 3.0 (Sustainable Products) and 4.0 (Electronic Shipment) do not apply to this acquisition regardless of deployment model, as this effort involves no physical IT hardware or shipped products.
Section 5.3 (SSN Reduction) is not anticipated to apply based on the current functional scope, as the system is not expected to use SSNs to identify individuals. VA will confirm this determination as the technical design matures.
Section 5.7 (Generative AI Requirements) applies only if the proposed solution incorporates AI/LLM functionality, regardless of hosting model. This is not a blanket exclusion — respondents proposing any AI-driven features (e.g., automated summarization, smart search, content tagging assistance) should address Section 5.7 requirements in their response.
| Please confirm whether Microsoft Purview record management (record labels) is licensed for this tenant, since read-only protection for archived versions depends on it. | Microsoft Purview record management (including record labeling) is currently in pilot/assessment status within VA's M365 environment, with no established timeline for full implementation. Respondents should not assume Purview record labeling will be available for this effort and should propose an alternative method for enforcing read-only status on archived versions (e.g., SharePoint permissions, content approval workflows, or custom-developed controls). If Purview becomes available during the period of performance, VA may evaluate its use as an enhancement, but it should not be treated as a dependency in the initial proposed solution. |
| Editorial: in Section 1.0, "achieving" should read "archiving."? | Confirmed. This is a typographical error. Section 1.0 should read "archiving" rather than "achieving." This will be corrected in a future amendment to the Product Description. |
| 1.1 accepts "FedRAMP Moderate authorization" and 6.0 provides a track, with VA sponsorship, for a solution that has not completed FedRAMP, but the impact level in 6.0, 6.1 and 6.2 is a template placeholder. Please state the required FedRAMP impact level and confirm that the 6.0 sponsorship track (VA agency authorization) remains available to a SaaS product that holds a FedRAMP High Readiness Assessment Report and is under FedRAMP 20x assessment. What authorization boundary does VA expect: the vendor's SaaS boundary only, or components inside the VA boundary as well? | The required FedRAMP impact level has not yet been finalized; it is pending completion of VA's formal Data Security Categorization process. VA anticipates this will align with the Moderate baseline referenced in the salient characteristics table, but this is not yet confirmed. |
Regarding FedRAMP 20x: VA has not yet determined whether a FedRAMP High Readiness Assessment Report under the 20x assessment pathway would satisfy the agency-sponsorship track described in Section 6.0; this will be evaluated as part of the acquisition's security review process.
Respondents should propose based on their current authorization status and may note any FedRAMP 20x progress for VA's consideration.
| Performance begins December 1, 2026, and live VA data may be used only after a VA ATO. Does VA expect the ATO to be in place by December 1, 2026, and will the implementation period before the ATO (configuration with non-live content) be part of the base period? | The base period of performance (December 1, 2026 – November 30, 2027) is intended to include an initial implementation and configuration phase, during which the system will be stood up and tested using non-live/sample content. Live VA data will not be used until a VA Authority to Operate (ATO) has been granted. VA's current expectation is that the ATO and transition to live operations will occur within the base period, following the implementation phase; however, VA acknowledges that the exact timeline is dependent on the ATO process and reserves the right to adjust accordingly. |
| Does “approximately 400,000 concurrent read-access users” mean simultaneously active sessions, or the total authorized VA population? Please state peak throughput, response-time targets and the method of acceptance testing. | VA intends "approximately 400,000" to describe the total addressable VA population with potential read access over time — not simultaneous concurrent sessions. Based on anticipated usage patterns, VA expects true concurrent usage at any given moment to be in the range of several hundred users, with a smaller subset (estimated in the low thousands) representing repeat/regular users of the system. Respondents should size their proposed solution accordingly. Specific peak throughput and response-time targets have not yet been finalized and will be addressed as part of VA's technical requirements refinement; acceptance testing methodology will be defined in the resulting solicitation. |
| For an application hosted wholly within the existing VA Microsoft 365 tenant, which FedRAMP, VA security-control, TRM, ATO, TIC and IPv6 evidence is required of the application vendor, and which controls are inherited from the tenant? The current SaaS and M365-native alternatives appear to have different authorization paths. | For an application hosted wholly within the VA M365 tenant, VA anticipates that security controls inherited from the tenant will cover infrastructure-level protections (e.g., underlying cloud boundary, network security, and tenant-level authentication). The application vendor will still be expected to demonstrate compliance with VA Critical Security Controls, TRM approval for any components or frameworks used, Section 508/accessibility compliance, and IPv6 support, since these apply to the application layer regardless of hosting model. The precise division of inherited versus vendor-demonstrated controls for TIC and ATO purposes will be finalized in coordination with VA's security and technical review teams as part of the acquisition process; a definitive control-by-control breakdown is not yet available. |
| The draft Product Description contains unresolved FedRAMP impact-level placeholders, while the salient-characteristics table says the solution must be FedRAMP Moderate or reside entirely within VA's existing Microsoft 365 tenant. Please confirm the required authorization boundary and impact level for a Microsoft 365/SharePoint-native solution. | For a Microsoft 365/SharePoint-native solution operating entirely within VA's existing tenant, the authorization boundary is the VA tenant itself, and no separate FedRAMP impact level applies to the application, since it does not constitute an independent cloud offering outside that boundary. The FedRAMP Moderate reference in the salient characteristics table applies specifically to the alternative SaaS deployment path, where a vendor's solution is hosted outside the VA tenant and therefore requires its own authorization. |
| The draft line item leaves the part number and quantity blank. Should respondents assume enterprise availability for approximately 400,000 VA personnel, and is that population licensed users, potential readers, or concurrent users? | The population of approximately 400,000 refers to the total potential VA readership across the enterprise, not a fixed count of licensed users or concurrent sessions. VA anticipates actual concurrent usage to be substantially lower — likely in the hundreds at any given time — with a smaller core group (estimated in the low thousands) of repeat/regular users. Respondents should propose a licensing and access model appropriate for broad, intermittent enterprise readership rather than a high-concurrency architecture. Part number and quantity fields will be completed once a specific solution and licensing model are identified. |
| The Product Description lists a "SharePoint Online-Native application" line item with a part number and quantity. If VA accepts a custom native build in its M365 tenant, as the Q&A indicates, would VA anticipate pricing it as fixed-price services (implementation plus support), with Microsoft licenses furnished by VA? | Yes, VA anticipates this model for a native build: VA will furnish the underlying Microsoft 365/SharePoint Online licensing, and the Contractor's effort (implementation, development, and ongoing support) would be priced as services rather than as a licensed product. Respondents should structure pricing accordingly, separating one-time implementation/development costs from recurring support/maintenance costs. |
| For a native build, would VA's existing M365 tenant authorization serve as the ATO boundary, or does VA expect a separate FedRAMP package? Also, what impact level does VA anticipate? The PD leaves it as a placeholder. | For a native build operating entirely within VA's existing M365 tenant, the VA tenant's existing authorization serves as the authorization boundary; VA does not anticipate requiring a separate FedRAMP package for this deployment model. The required impact level is still pending finalization of VA's formal Data Security Categorization, though VA anticipates alignment with the Moderate baseline referenced in the salient characteristics table. |
| Will VA provide a non-production SharePoint Online tenant or site for development and testing? Also, how many active SOPs, and how many total versions, would need to be loaded at go-live, and in what format do they live today? | VA does not maintain a separate SharePoint development/test tenant. "Dev/test" refers to a site or environment within VA's existing production tenant, with permissions scoped/contained to the development and testing team. |
VA does not anticipate significant historical version migration at go-live. VA's documentation is currently undergoing a restructuring effort independent of this acquisition. Because these are newly issued or in-progress document sets, the historical version depth at go-live is expected to be light — the majority of documents are expected to be at Version 00 or 01, with only a portion having undergone one or two revisions by the time the system is deployed. Respondents should plan for an initial load consisting primarily of current/active versions rather than extensive historical archives, while ensuring the system's version-control and archival functionality is ready to capture history going forward from go-live.
VA's active inventory consists of a mix of common office formats (e.g., Word, PDF, Excel). This does not yet reflect eventual volume from the VAPG transition, which is anticipated to be the largest document population; an updated estimate will be provided once that restructuring progresses further. The total populatoin will be approximately 145 SOPs and approximately 173 attachments. Since these new documents are a work in progress, these are just estimates.
File details come from the government source that posted it. Updated .