Sol_47QMCA23Q0019_Amd_0001.pdf

(x)

47QMCA23Q0019

x x copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted ; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGEMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR

OFFER. If by virtue of this amendment you desire to change an offer already submitted , such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

x

47QMCA

WASHINGTON DC 20405

1800 F STREET, NW

GSA/FAS AUTOMOTIVE CENTER

47QMCA23Q001906/06/20230001

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

12. ACCOUNTING AND APPROPRIATION DATA (If required) is not extended.is extended, Items 8 and 15, and returning

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended , by one of the following methods: (a) By completing

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

FACILITY CODE CODE

10B. DATED (SEE ITEM 13)

10A. MODIFICATION OF CONTRACT/ORDER NO.

9B. DATED (SEE ITEM 11)

9A. AMENDMENT OF SOLICITATION NO.

CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code)

7. ADMINISTERED BY (If other than Item 6)CODE 6. ISSUED BY

PAGE OF PAGES

4. REQUISITION/PURCHASE REQ. NO.3. EFFECTIVE DATE2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO. (If applicable)

1. CONTRACT ID CODE

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

06/06/2023

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority) appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

E. IMPORTANT: Contractor is not is required to sign this document and return __________________ copies to the issuing office.

ORDER NO. IN ITEM 10A.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

Program: Electronic Maintenance and Repair Authorization System (EMRAS)

The purpose of this amendment: 1)provide response to questions 2)update links to references

3)update LiSaaS Solution Profile Template.

The POC for this amendment is Leresa Garrett @ leresa.garrett@gsa.gov.

All other terms and conditions remain unchanged.

Period of Performance: 08/20/2023 to 08/19/2028

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)15A. NAME AND TITLE OF SIGNER (Type or print)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA 15B. CONTRACTOR/OFFEROR 16C. DATE SIGNED

(Signature of person authorized to sign) (Signature of Contracting Officer)

Charlene Cardenas

STANDARD FORM 30 (REV. 11/2016)

Prescribed by GSA FAR (48 CFR) 53.243

Previous edition unusable

Except as provided herein, all terms and conditions of the document referenced in Item 9 A or 10A, as heretofore changed, remains unchanged and in full force and effect .

Ques # RFQ Page # Offeror Question Government's Response

GSA IT Security Procedural Guide 16-75, Rev 5“Security Reviews for Low Impact Software as a Service (SaaS) Solutions"

FIPS PUB 199, “Standards for Security Categorization of Federal Information and Information Systems Guide to Understanding FedRAMP GSA InSite

Electronic Maintenance and Repair Authorization System RFQ Question & Answer Matrix

Solicitation No: 47QMCA23Q0019

Version 2/7/2023

U.S. General Services Administration [LiSaaS Solution Name]

Low Impact Software-as-a-Service (LiSaaS) Solution Profile

[Date]

[LiSaaS Solution Name] Profile

Profile Instructions: For each section of the profile, follow the blue italicized instructions contained in each box. After the sections have been completed, remove the instruction boxes (including this box) and any examples provided in the tables.

[SaaS Solution Name] Overview:

Instruction: Summarize the SaaS Solution being provided. Convey the who, what, when, where, and how with regards to the service function and purpose across all users.

Infrastructure Overview:

Instruction: Summarize the Vendor infrastructure(s) the SaaS solution leverages. For example, “The system is built in Amazon AWS with a multi-region architecture deployed in AWS East and AWS West for high availability."

Additionally, in the following table, identify whether the infrastructure services and the service used are FedRAMP or CISO authorized. (Note: GSA can provide a list of CISO authorized Infrastructure-as-a-Service (IaaS) services per provider as needed.)

Leveraged Vendor Infrastructure Services

Service Name FedRAMP Authorized / CISO Authorized AWS EC2 (example) FedRAMP Authorized AWS Inspector (example) FedRAMP Authorized AWS GuardDuty (example) CISO Authorized

Instruction: In the following table, identify the Vendor SaaS integration(s) used to provide the LiSaaS offering. Identify whether the infrastructure is FedRAMP authorized. If there are no Vendor SaaS integrations, enter “Not applicable – no vendor SaaS integrations.”

Vendor SaaS Integration(s)

SaaS Name FedRAMP Authorized Github (example) FedRAMP Authorized OpsGenie (example) Not FedRAMP Authorized

[SaaS Solution Name] Solution Summary

Instruction: In the following table, provide an overview of the LiSaaS solution, including the type of data and the risk level based on the sensitivity of the data, authorization capability, MFA capability, identify if the following capabilities exist-- completed ICAM Portfolio review, audit/logging capability, and encryption capabilities in storage and at rest.

Data Requested Response Data Description and Sensitivity [Describe] Authorization Capability [Describe how accounts and roles are managed (e.g., add/remove), authorized (e.g., least privilege) and audited (e.g., monitored)].

Multi-factor Authentication Capability(ies)

[Describe the types of users of the system. For example:

GSA users (@gsa.gov) only Other federal agency customers (@agency.gov) Vendors Public]

[Note: Perform an ICAM Portfolio review (see CIO 2183.1) to determine the GSA authentication service(s) to integrate with. The GSA IT Program Manager or GSA Information System Security Officer should complete this form for an evaluation.]

ICAM Portfolio Review Completed Choose an item.

Audit Logging Capability Choose an item.

Encryption in Transit Capability Choose an item.

Encryption in Storage Capability Choose an item.

Users

User Type(s) Included? Estimated Number

Authentication Service

GSA Users Choose an item.

Other federal agency users

Choose an item.

Vendors Choose an item.

Public Choose an item.

[SaaS Solution Name] Connection Type(s)

Data Requested Response (If additional rows are needed, add them to the end of this table)

Connection Type (to GSA) Choose an item.

Is API over HTTPS? Choose an item.

API Connection Security Describe.

API Connection Type Describe.