2.2.1- RFP 70B06C23R00000121 A0001_QAs - _28Aug2023.xlsx

Sheet1

2 The update to the RFP now includes the, "2.2.1- RFP ATTACHEMNT_70B06C23R00000121_PWS Example.docx" My question is, do we include our responses to the PWS in a separate document or apart of the responses to the 2.2.1-+RFP+ATTACHMENT_70B06C23R00000121_SOO The PWS is a separate document (no page limit) vendors complete. The PWS becomes part of the contract and replaces the SOO.

3 Is there an incumbent contractor or contractors for this effort? No.

4 Regarding "2.2.1-+FINAL+RFP_70B06C23R00000121_18Aug2023.pdf")Addendum to 52.212-1 Instructions to Offerors Commercial Items, p. 2, states, "CBP intends to conduct the procurement via two-phase mandatory down-select process...". Most downselect processes for Government acquisitions are advisory and offerors who are advised that they are not the highest rated can nonetheless continue into the next phase if they elect to do so. Please confirm that for the downselect process for this solicitation, that "mandatory" implies that offerors may not continue into Phase 2 unless they are chosen by the Government in Phase 1. Correct.

12 Regarding "2.2.1-+RFP+ATTACHMENT_70B06C23R00000121_SOO.docx")Questions regarding Development Approach) a) Does the Government have any preference for whether the app will be developed natively for iOS and Android, or be developed using a cross-platform framework? b) Does the Government have any preferences for programming languages and frameworks for the frontend and backend development? a) The app should be able to operate on Apple or Android.

b) No.

13 Regarding "2.2.1-+RFP+ATTACHMENT_70B06C23R00000121_SOO.docx")Questions regarding User Authentication and Security) a) How does the Government envision user authentication and authorization in the app? That is, does the Government have a preference for user authentication and authorization method in the app?

b) Are there any specific security measures the Government would like to implement?

c) What level of security, and security measures, are required to protect Personal Identity Information (PII) and other sensitive data? a) No, up to vendor.

b) In compliance with solicitation clauses.

c) Standard security measures.

b) No.

b) No.

b) URLs can be provided after contract award.

b) No.

b) How does the Government envision the application accommodating future updates and additions/extensions/new functionality?

c) With respect to future updates and additions, presumably the Government is making the contract an ID/IQ instead of a fixed price non-ID/IQ type of contract, because it wishes to allow for further delivery orders for the purpose of accommodating future updates and additions/extensions/new functionality? If this is not the case, or if there are other reasons for this contract to be an ID/IQ in addition to this, please explain.

d) If the Government is issuing this contract as an ID/IQ for the purpose of accommodating future updates and additions/extensions/new functionality, can the Government explain how additional delivery orders under this ID/IQ would actually work as the Government would not be actually paying the Contractor for even the first delivery order, except via the monthly user subscription fees? That is, if the Government issues a delivery order to request further enhancements or changes orders to the app, will they allow the offeror to increase the subscription fees as a result to compensate for the additional development costs which were not originally planned? (For example, if the Government wishes the performance of the app to be higher -- for example, faster -- the Contractor may need to pay for infrastructure upgrades not anticipated and priced in the Contractors initial proposal.)

e) Since ID/IQ contracts order work through delivery orders, how will the first delivery order work? Will the Government issue the first delivery order after the ID/IQ contract is awarded, and require the offeror to price it (i.e., via monthly user subscription fees) exactly as bid in the Contractor's proposal? Or will the first task/deliver/call order of the awarded ID/IQ contract be award along with and at the same time as the ID/IQ contract itself? a) User growth will be based on availability of funding, number of users will based on the price of the app.

b) At this time, specific future functionality is not mandated by the government.

c) Whatever version is currently available in the appropriate "app store" at the time of award is the minimum version compatibility. The vendor will determine the frequency, features, and timing of updates and new releases.

d) At this time, specific future functionality is not mandated by the government.

e) This should already be an existing app on the appropriate "app store"; the contract approach is at the government's discretion.

b) If the Government expects the Contractor to provide a secure database solution for app data, then what are the requirements for this? That is, does the Government have a preference for how a secure database solution from the Contractor would be provisioned and function?

c) If the Government expects the Contractor to provide a secure database solution for app data, would such a solution be required to run in a FISMA-certified data center? Or a FedRamp certified cloud? Or would it be required, for example to run in a Federal Government region of a Commercial Cloud Service Provider, such as AWS's GovCloud region? Commercial Cloud Service Provider, such as AWS's GovCloud region?

d) If the Government expects the Contractor to provide a secure database solution for app data, would such a solution require an Authorization to Operate (ATO)?

e) Even if the Government provides a CBP-managed database or data warehouse to store app data, would the app itself require an ATO because it handles PII of users, including that of Government employees?

f) If the app and/or the secure data storage solution does indeed require an ATO, then since the app data will include PII of users, including that of Government employees, what is the expected security categorization of the app and/or the secure storage solution?

g) If the app and/or the secure data storage solution does indeed require an ATO, will this need to be renewed every three years, or on some other frequency?

h) If the app and/or the secure data storage solution does indeed require an ATO, who will pay for the ATO, for example, for ATO package preparation and the Independent Verification and Validation (IV&V) that is required? Would Government employees and/or other Government contractors be involved in such an ATO process, and if so, please explain.

i) What specific security standards are expected for data encryption, user authentication, access controls, etc?

j) Are there policies regarding data retention periods or deletion requirements? If so, what are they?

k) Please provide API specs for any existing systems the app needs to integrate with, since specific API standards can affect the offeror's price as it could affect the specific technologies used by the Contractor. a) Contractor database solution. No.

b) Just IAW with government privacy technical requirements.

c & d) AWS, in the future the Government will move to CBP phones and then need to move forward with an ATO.

e) See above.

f) See above.

g) Yes.

h) The Government.

i) Industry standards.

j) None.

k) No integration.

24 Regarding "2.2.1-+RFP+ATTACHMENT_70B06C23R00000121_SOO.docx")Questions regarding Development Platform)a) Does the Government have preferred frameworks or languages for iOS and Android app development? React Native, Flutter, Native Java/Kotlin, Swift, etc. That is, does the Government have a preference for framework or language the app uses/is developed in?

b) Will the Government require the use of secure coding practices, or secure coding standards, such as that from Open Worldwide Application Security Project (OWASP)?

c) Will the Government require or provide code review of the app for security vulnerabilities?

d) Does the Government have mobile app development guidelines or UI/UX standards to follow? If so, is use of those guidelines and standards mandatory for this app? Or are those guidelines and standards, advisory? a) This should already be an existing app on the appropriate "app store". Therefore, this question doesn't apply.

b) This should already be an existing app on the appropriate "app store". Therefore, this question doesn't apply.

c) This should already be an existing app on the appropriate "app store". Therefore, this question doesn't apply.

d) This should already be an existing app on the appropriate "app store". Therefore, this question doesn't apply.

25 Regarding "2.2.1-+RFP+ATTACHMENT_70B06C23R00000121_SOO.docx")Questions regarding Deployment & Maintenance) a) Does the Government have an enterprise mobile device management (MDM) solution the app should integrate with? And if it does, is this integration mandatory for this app?

b) For Android, does the app need to be listed on private agency app stores, or public app stores? (Note)The Apple IOS app cannot be listed in private agency app stores and still have it work on normal Apple mobile devices.)

c) Will the Government require access to source code, documentation, dev environments for ongoing maintenance?

d) How should app releases and updates be managed after initial deployment? That is, does the Government have a preference for how app releases and updates are management after initial deployment? a) In the future, the app may interface with the CBP app deployment device.

b) Public.

c) No.

d) No.

26 Regarding "2.2.1-+RFP+ATTACHMENT_70B06C23R00000121_SOO.docx")Other Miscellaneous Technical Questions)

a) Are there existing single sign-on (SSO) or identity management systems to integrate with? And if so, will this integration be mandatory for this app?

b) Are there any required accessibility features beyond Section 508 compliance?

c) Will the Government issue a delivery order under the ID/IQ when the platform version (i.e., IOS and Android operating systems) undergo major revisions/releases, as upgrading the app for a new IOS/Android major release may incur a significant cost to the Contractor? If the answer is no, please explain how the Government wishes to handle such major releases, as they are not completely predictable even from Apple, not to mention Google Android.

d) What are the Government's expected mobile operating system platform versions?

e) Does the Government require the app to support iOS and Android tablets? If so, are these required to be supported in full resolution mode or can they be supported as iPhone/Android phone-compatible devices with phone resolution on the tablets?

f) For IOS, which previous released versions of the IOS operating system must be supported by the app?

g) Related to the previous question of prior releases of IOS, which generations of iPhones (and iPads) must be supported? (As older generations of these devices may not support the latest IOS operating system releases.)

h) For Android, which previous released versions of Android operating system must be supported by the app?

i) Related to the previous question of prior releases of the Android operating system, phone/tablet manufacturers' devices must be supported, and for those manufacturers, which models of devices? (This question is asked because Android phone/tablet manufacturers sometimes make changes to the Android operating system, since it is open source, which make it not compatible, and the Contractor will incur costs to test the app on more Android devices from different manufacturers, not the least of which is acquiring these devices. Also, if older models of Android devices must be supported by the app, similar to the case of Apple, some older devices cannot support the latest Android operating systems releases and others have other incompatibilities, so the Contractor will also need to acquire and test on older devices from multiple manufacturers, which incurs further cost. Although some testing for Android can be done on emulators like BlueStacks, this does not guarantee device compatibility and proper function, so testing on actual hardware will be also required before production releases, incurring costs for the Contractor.)

j) What is the Geographic distribution of the users in the Continental US, Hawaii, Alaska, and US territories? What is the Geographical distribution of any users internationally, outside the Continental US, Hawaii, Alaska, and US territories?

k) Are there any other existing industry or Government technical standards to consider for the app. Are there any such that are mandatory, and not only advisory, for this app?

l) Please confirm that the Contractor must restrict the app users to only Contractor staff and the users specifically designated by the Government as allowed to use the app. In other words, this app is not to be used by non-Government designated users.

m) Since this app is not being paid for directly by the Government, but only through monthly user subscription fees, and because, with respect to II.30 CONTRACT SERVICES NOT REQUIRING A BACKGROUND INVESTIGATION (MAY 2022) in RFQ pp. 26-27, II.31 SECURITY PROCEDURES (AUG 2022) in RFQ pp. 27-31, and II.25 SPECIAL SECURITY REQUIREMENT – CONTRACTOR PRE-SCREENING (AUG 2022) in RFQ pp. 31-32, please confirm that for Contractor's staff that have no access to Government facilities, or Government classified or CUI information, there are no special clearance requirements for those particular Contractor's staff, or restrictions on those particular Contractor's staff, such as requirements of citizenship, permanent residency, H1B, etc.

n) Regarding "2.2.1-+FINAL+RFP_70B06C23R00000121_18Aug2023.pdf")II.14 52.216-19 ORDER LIMITATIONS (OCT 1995), p. 16, states, "Maximum order. The Contractor is not obligated to honor- ... (2) Any order for a combination of items in excess of $20,000,000.00;..." In the context of maximum orders for delivery orders, what will the ceiling value, or approximate ceiling value, for the ID/IQ be?

o) Regarding "2.2.1-+FINAL+RFP_70B06C23R00000121_18Aug2023.pdf")II.22 CONTRACT TYPE (OCT 2008), p. 23, states, "This is an Indefinite Delivery Indefinite Quantity(IDIQ) contract that allows for firm fixed price delivery orders." How can delivery orders be firm fixed price if the pricing is based on a subscription fee with a variable number of users in a given month? Or will the Government set a ceiling value based on the anticipated number of users in a given period, and pay that amount as a firm fixed price? We would expect another contract type to fit variable subscription fee better than firm fixed price. Please explain.

p) Regarding "2.2.1-+FINAL+RFP_70B06C23R00000121_18Aug2023.pdf")II.27 GOVERNMENT CONSENT OF PUBLICATION/ENDORSEMENT (MAR 2003), p. 25, states, "The Contractor agrees not to refer to awards in commercial advertising in such a manner as to state or imply that the product or service provided is endorsed or preferred by the Federal Government or is considered by the Government to be superior to other products or services." This clause is in conflict with the fact that this app will in fact be the official wellness app for CBP, and so is therefore considered by the Government to be indeed superior to other wellness apps for the Government-designated users of this app. Otherwise, why would the Government even order such an app from the Contractor if this is not the case?

q) Regarding "2.2.1-+FINAL+RFP_70B06C23R00000121_18Aug2023.pdf")Factor 5 – Price, p. 42, states, "Unbalanced pricing, which exists when, despite an acceptable total evaluated price, the price within an optional ordering period is significantly over or understated relative to the base ordering period. The Government reserves the right to reject such proposals." There are various reasons why monthly user subscription fees may drop over time, not the least of which is that Commercial Cloud Services Providers, such as AWS, which may serve as the backend of this app, constantly are lowering their prices over time. If an offerors price should decrease with time, in the context of this prohibition against unbalanced pricing, may that offeror explain somewhere, why its pricing over time is the way it is? And if such an explanation is welcomed by the Government, where should this explanation be inserted, as there is only one tab in the "2.2.1-+RFP+ATTACHMENT_70B06C23R00000121+PRICING+WORKSHEET+SCHEDULE.xlsx" file.

r) Regarding "2.2.1-+FINAL+RFP_70B06C23R00000121_18Aug2023.pdf")Factor 5 – Price, p. 43, states, "The unit prices should be per user on an annual basis and be inclusive to encompass full services required by the SOO." However, "2.2.1-+RFP+ATTACHMENT_70B06C23R00000121+PRICING+WORKSHEET+SCHEDULE.xlsx" states in cell C8 "Total Monthly User Fee Per Person". Please clarify whether the unit prices in cells D8, F8, H8, J8, and L8 should actually be monthly as stated in the spreadsheet or annual as stated in the RFQ.

s) We request a one (1) week extension on the submission deadline for Phase 1 to allow offerors to incorporate into the Phase 1 offered, unique solutions, the Government's answers to vendor questions. a) No.

b) No.

c) No. It is expected the apps will be updated through the appropriate app store through the vendor's normal update/release schedule for their published app in the appropriate "app store".

d) iOS and Android.

e) No.

f) Whatever version is currently available in the appropriate "app store" at the time of award is the minimum version compatibility.

g) See response to f.

j) Continental US, Hawaii, Alaska, US territories, and select international locations (preclearance); in addition, a few employees at various embassy locations.

k) No.

l) The version of the app downloaded is the same version available to any user in the appropriate "app store". However, it is expected that the app would allow for some configuration based on the user (or path of registration) to enable CBP-specific URLs to publicly-facing web pages on CBP.gov and a little information on CBP-specific programs for employees (e.g., CBP EAP, etc.).

m) Since this should already be an existing app on the appropriate "app store", confirming no access to government facilities or data.

n) Approximately $20,000,000.00.

o) The price is fixed for the app not-to-exceed 64,000 QTY. (Corrected number in SOO.)

p) The contractor shall not refer to an awarded contract in commercial advertising. If an awardee has a question after award, then the Contracting Officer and CBP Public Relations would need to pre-authorize any potential advertising or marketing by the contractor.

q) Yes, offerors can provide an explanation to their pricing and any assumptions directly into the pricing schedule or in their cover letter.

r) Monthly as in the pricing worksheet. The RFP is corrected.

s) Due to the already tight timeline, a one day extension is granted.

Modified SOO

c) Is the application only focused on healthcare/mental health or are there other areas that the solution could support/coordinate? Example, marital/relationship counseling.

d) Do you imagine being able to use the app to push generic health and wellness content to all users - mass sending? a) Correct.

b) Possible in the future.

c) Yes.

d) No.

b) De-identified data.

b) No.

43 Regarding "Links to mental health resources will also be available from the application)

a) Will CBP-approve content/sources that need to be uploaded into the application?

b) Do all content/sources need to be approved by CBP prior?

c) What is that approval process? What is the expected updating process for mental health resources? a) No.

b) No.

c) To be determined with vendor.

a) Are there CBP internal clinical resources (CBP behavioral health specialists) available to help inform/discuss preventative strategies?

b)Are there “live” behavioral health resources available to CBP that the app can connect the CBP user to?

c) Is CBP currently utilizing a telehealth (live video/asynchronous) provider?

d) Is there additional CBP data (A/L, S/L, LWOP, etc) that our AI engines could pair with the data our solution would gather? a) Yes.

b) No.

c) No.

d) No.

45 Regarding "The application must be compatible across both iOS and Android platforms in phone, tablet, and web-based formats.")

a) Do ALL government issued phones allow the user to have iOS/Android accounts?

b) And, do different levels of agents and officers have different types of phones? a) Initially it will only be personal phones.

b) Primarily iPhones.

b) Will the Union have behavioral health and resources content that they want uploaded? a) No.

b) No.

b) Can you give examples of self-assessment surveys?

c) Can you elaborate; would this be for peer-to-peer communication or the ability for a co-worker to privately share concerns about a fellow staff person? a) No.

b) No.

c) Yes.

58 Page 3 of the solicitation states, “All written technical proposal submissions will be limited to a maximum of 20 pages of content.” Does that include the PWS? The instructions provide a 2-page limit to Tab 1, a 6-page limit to Tab 2, and a 10-page limit to Tab 3. No limit is provided for Tab 4 PWS. No, the PWS does not have a page limit.