Attachment 05 TOS_DTS 2.0 RFI Vendor Question Response Template_Finalized 10.20.xlsx
XLSX spreadsheet 56 KB Posted
- Attached to
- FEMA's Deployment Management Solution
- Solicitation number
- 70FA3126I00000008
- Issued by
-
Federal Emergency Management Agency
About this file
This is a Questions and Answers document for FEMA's Deployment Management Solution (DTS 2.0) Request for Information (RFI), containing 141 vendor inquiries and FEMA responses dated September 29 through October 7, 2026. The RFI seeks market research on commercial off-the-shelf (COTS), configurable COTS, custom, or hybrid solutions to replace FEMA's legacy Deployment Tracking System with an estimated value of $50 million to $100 million over five to ten years.
Key operational requirements include supporting approximately 15,000 to 20,000 active users with 15,000 daily concurrent users and 32,000 responder records, with potential for all employees to access during major activations. The solution must manage personnel availability and deployment tracking, qualifications and training management, event and incident staffing, force package management, and equipment assignment through integration with external systems including learning management systems, travel systems, and property management platforms. The system must operate within a FEMA-provided, government-owned FedRAMP High cloud environment, likely Microsoft Azure or AWS, and support role-based access for both FEMA personnel using PIV-based DHS identity services and non-FEMA users via Login.gov. Data migration requirements include over 10 years of historical DTS data encompassing personnel, deployment, qualification, training, incident, and equipment records. The solution must achieve 99.92 percent operational availability with 24-hour recovery from catastrophic failure and provide 24/7/365 production support. FEMA has not finalized the acquisition vehicle, contract type, award structure, or set-aside determination; these will be identified in a future solicitation. Specific integrations, detailed requirements, and implementation schedules will be refined during the requirements-definition and solution-design phases.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Attachment 02_TOS_RFI_Survey_DTS_2.0_Finalized.xlsx | XLSX spreadsheet | |
| Attachment 4 TOS_DTS_2.0 RFI Consolidated Responses and Review_Finalized.pdf | ||
| Attachment 3 RFI-Sources Sought Vendor Responses Profile Summary Template.xlsx | XLSX spreadsheet | |
| Attachment 01_TOS_DTS_2.0_RFI_Overview_9.23.2026.pdf | ||
| RFI-Sources Sought Vendor Responses Profile Summary Template.xlsx | XLSX spreadsheet | |
| TOS_RFI Survey DTS 2.0_Finalized.xlsx | XLSX spreadsheet | |
| TOS_DTS 2.0 RFI Overview_9.23.2026.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Questions & Answers Final
| Question # | Offeror | Topic | Date Added | Document | Page No. | TOR/PWS Section Reference | Question | Program Office Response |
| 70FA3126I00000008 — FEMA's Deployment Management Solution | ||||||||
| 1 | Precision Delivery Federal LLC | Users and Scale | 9/29/26 | Conditions & Assumptions | The Conditions & Assumptions state that "the number of simultaneous users, number, frequency, and size of deployments—will continue to grow," and Section 4 asks for cost at 1, 5 and 10 years. Would FEMA share the current number of DTS user accounts, the peak number of concurrent users during a major disaster, and the approximate number of responder records? | For planning purposes, respondents should assume approximately 15,000 to 20,000 active users, approximately 15,000 daily users, approximately 32,000 responder records, and potentially all employees accessing the system during a major activation. Detailed population, transaction, and growth metrics will be refined during requirements development. | ||
| 2 | Precision Delivery Federal LLC | Learning Management and Training | 9/29/26 | Overview | The Overview lists "learning management system (LMS) integration" under Training Management, while Section 2 subtasks 1.2 and 1.3 describe course delivery, testing and gradebooks. Should the DTS replacement deliver online training itself, or integrate with an existing FEMA LMS? If it integrates, which system? | This is to be determined if you have a learning management system please describe or if the ability to build and interconnections to an external LMS is possible please describe. In your experience what is the best approach to LMS. | ||
| 3 | Precision Delivery Federal LLC | Integrations | 9/29/26 | Subtask 5.3 and Overview item 8 | Subtask 5.3 and Overview item 8 call for data exchange with "FEMA/DHS systems, legacy DTS, and relevant personnel, identity, training, qualification, deployment, incident, property, reporting, and enterprise data systems." Which systems must the replacement interface with at Minimum Viable Product, and which at full deployment? | The replacement will need to interface with Government systems to support required functionality at MVP and full deployment. The specific integration inventory, authoritative systems, data exchanges, interface standards, API specifications, volumes, and test-environment access will be refined during requirements definition and solution design. Respondents should describe their integration architecture and approach for Government systems. | ||
| 4 | Precision Delivery Federal LLC | Data Migration | 9/29/26 | Section 4 asks for data-migration cost drivers | Section 4 asks for data-migration cost drivers. What database platform does DTS 2.0 run on, roughly how many years of records and what data volume would migrate, and will a data dictionary or schema be provided to the implementation contractor? | The final migration scope, including data types, volumes, historical periods, attachments, retention requirements, archival constraints, data quality, and extract methods, will be defined during requirements definition and solution design. For planning purposes, respondents should assume more than 10 years of historical DTS data, including personnel, deployment, qualification, training, incident, equipment, and related records. Respondents should identify assumptions, dependencies, and cost drivers for data extraction, cleansing, validation, migration, archival, and phased transition. | ||
| 5 | Precision Delivery Federal LLC | RFI Response Instructions | 9/29/26 | Section 3, the Architecture response cell (C13) | In Section 3, the Architecture response cell (C13) carries a dropdown limited to "ServiceNow, SalesForce, Microsoft Dynamics, Other," while the question asks for a written description of hosting, security boundary, identity, Zero Trust and recovery. May respondents select "Other" in C13 and place the written description in the adjacent cell, D13? | Yes you are able to select other in C13 and use the adjacent cell for a written response. | ||
| 6 | Precision Delivery Federal LLC | Cloud Hosting | 9/29/26 | Conditions & Assumptions | The Conditions & Assumptions state that "the solution must operate within the government owned cloud environment." Which cloud service provider environment or environments host FEMA's FedRAMP High workloads for this system? | FEMA’s FedRAMP High workloads for this system are hosted in Microsoft Azure or AWS. |
| 7 | ALGOCHAINS INCORPORATED | RFI Administration | 9/29/26 | The notice requires the response directly in the supplied Excel survey. Please confirm that TOS_RFI Survey DTS 2.0_Finalized.xlsx is the current controlling workbook and whether a respondent whose SAM registration is still completing external validation may participate in this market-research RFI | CO Answered use the one in SAMs |
| 8 | Suvi Global Services, LLC | Current DTS Technical Environment | 9/29/26 | Please provide:Details on the primary technical components (technical stack) | Please refer to the "Necessary Capabilities" tab in the workbook |
| 9 | Suvi Global Services, LLC | Users and Scale | 9/29/26 | The approximately number of people that use the current system | See response to questions 3 |
| 10 | Suvi Global Services, LLC | Current DTS Growth | 9/29/26 | The historical growth of the current system | Accepted deployments have doubled over the past 10 years and growth is expected to grow overtime with the frequency of incidents increasing in volume and severity. |
| 11 | Suvi Global Services, LLC | Data Migration | 9/29/26 | The amount of data that would need to be migrated to the new system | The final migration scope, including data types, volumes, historical periods, attachments, retention requirements, archival constraints, data quality, and extract methods, will be defined during requirements definition and solution design. For planning purposes, respondents should assume more than 10 years of historical DTS data, including personnel, deployment, qualification, training, incident, equipment, and related records. Respondents should identify assumptions, dependencies, and cost drivers for data extraction, cleansing, validation, migration, archival, and phased transition. | |
| 12 | Suvi Global Services, LLC | Transition and Cutover | 9/29/26 | Whether FEMA is planning for a phased transition or specific cutover data from the current system to the new system. | The coexistence period and scope of parallel operations will be determined during requirements definition and implementation planning. Legacy DTS is expected to remain operational during transition to support continuity of operations. Respondents should describe their proposed phased rollout, parallel operations, data migration, cutover, rollback, and continuity approach. | |
| 13 | Envisage; ACADIS | Personnel Availability | 9/29/26 | 2.2 Update, maintain, and track personnel availability | 2.2 Update, maintain, and track personnel availability |
1. (2.2.1) Should availability be captured as date ranges, a current status, or both?
2. (2.2.1) Which availability or non-deployable changes require supervisor approval before taking effect? Both, dependent on employee type and YTD amount available within the calendar year.
The solution should be able to provide data ranges and statuses for availability The solution should provide the capability to manage and approve availability 14 Envisage; ACADIS Deployment Management 9/29/26 2.3 Update, maintain, and track personnel deployment and travel 2.3 Update, maintain, and track personnel deployment and travel
3. (2.3.5, 2.3.7) What typical and maximum deployment lengths should respondents assume, and can a responder hold more than one active deployment at a time?
4. (2.3.8, 2.3.9) Should the solution calculate cumulative time at a location (for example the 50-week rule), or record duty stations and dates for reporting? Maximum lengths could last years but in person deployments typically last 2-50 weeks. Responders cannot currently hold multiple deployments but that requirement is still to be determined in the new solution Yes the 50-week rule will need to be tracked for tax implications and records of duty stations and dates should easily be identified. Based on current recurring legal inquiries, the system would absolutely need to retain records of duty stations and dates, not just cumulative time.
15 Envisage; ACADIS Event and Incident Management 9/29/26 3.1 Create events and manage associated data 3.1 Create events and manage associated data
5. (3.1.2) What data elements define an event or incident record (for example unique ID, type, location, dates, hazard)?
6. (3.1.1) Does "time-phasing information" mean staffing levels over the life of an event (on site, arriving, departing by date)? These data elements will be determined during design based on the proposed solution The solution should contain a deployment capability that supports incremental staffing to a disaster 16 Envisage; ACADIS Force Packages and Evaluations 9/29/26 3.2 Manage event and incident 3.2 Manage event and incident
7. (3.2.2, 2.3.4) Should force package definitions (positions, quantities, proficiency levels) be maintained in the solution or received from another FEMA system?
8. (3.2.1) Is the supervisor evaluation period fixed, or configurable by position or deployment type? The solution should have the capability to receive data from other systems that could contribute to force packages The supervisor evaluation period will align to the deployment period - the solution should provide the ability to meet policy requirements for supervisor-subordinate relationship in the field
| 17 | Carahsoft.com | Workforce Categories | 9/30/26 | Which workforce categories should the solution support (e.g., Reservists, CORE, PFT, Surge Capacity Force, other federal agencies, contractors, state/local partners)? | All |
| 18 | Carahsoft.com | Users and Scale | 9/30/26 | What are the approximate user counts by role (coordinators, cadre managers, deployers, leadership/viewers)? | Select “YES: Custom Solution available; customization required.” |
Use the comments field to identify which elements are available out of the box, configurable, or require customization.
| 19 | Carahsoft.com | Users and Scale | 9/30/26 | What is the expected peak concurrent usage during a major incident, including surge personnel? | See response to questions 3 |
| 20 | Carahsoft.com | User Access and Identity | 9/30/26 | Will non-FEMA personnel need access? If so, how are they currently credentialed? | non-FEMA personnel will need access. Crendentially is based on DHS cyber security standards. |
| 21 | Carahsoft.com | Personnel Availability | 9/30/26 | How do personnel report availability today, how often, and what policy rules apply (rotation, availability windows, rest periods)? | Daily accountability takes place for all deployed personnel. Rotation can be applied for and availability windows can be adjusted on an annual basis to meet availability requirements. Unavailability is approved/denied by the supervisor based on policy. There is evolving policy for rotation, availability, and rest periods with that said the system should be able to acoomodate those statuses |
| 22 | Carahsoft.com | Resource Request and Staffing Workflow | 9/30/26 | Can FEMA describe the resource request lifecycle, from identified need to on-site arrival, including the organizational levels involved (e.g., NRCC, RRCC, JFO)? | Event with resource need occurs, FEMA Regions request pre-declared events from Deployment Operations Section (DOS) or DOS establishes event based on presidential declaration, event staff request resources to fill position needs, event staff and DOS adjudicate requests with a planned arrival date. Some variations to this process can occur such as sensitive positions requiring an additional approval level from the Primary Program Area leadership. |
| 23 | Carahsoft.com | Responder Selection | 9/30/26 | How are candidates selected today (manual search, cadre manager discretion, rules-based)? Which selection criteria are required by policy? | Deployment selection is based on an algorithm and responder availability in the system. The system should be able to accommodate name-requests based on specific training and qualifications needed as well. For sensitive positions, responders are selected by cadre coordinator. |
| 24 | Carahsoft.com | Notifications and Communications | 9/30/26 | How are deployment notifications delivered today, and what response timeframe is expected from personnel? | Notifications are delivered via email, phone, and text. Response is typically required within 12 hours. |
| 25 | Carahsoft.com | Deployment Lifecycle Management | 9/30/26 | How are extensions, reassignments, and demobilizations handled? How does handling differ between Stafford Act and non-Stafford Act events? | Extensions, reassignments, and demobilizations are handled by system functionality and overseen by designated teams. The deployement functionality is the same for stafford and non-stafford events. Non-stafford requires more customization. |
| 26 | Carahsoft.com | Qualifications and FQS | 9/30/26 | Is the FEMA Qualification System (position task books, qualification levels, evaluator sign-offs) managed within DTS, in a separate system, or manually? | This is to be determined if you have a learning management system please describe or if the ability to build and interconnections to an external LMS is possible please describe. In your experience what is the best approach to LMS. |
| 27 | Carahsoft.com | Qualifications and Recertification | 9/30/26 | What events trigger qualification expiration or recertification, and who approves each stage? | The solution should support configurable qualification periods, expiration notifications, recertification requirements, approval workflows, audit trails, and role-based access so FEMA can implement and update these requirements as policies evolve. |
| 28 | Carahsoft.com | Learning Management and Training | 9/30/26 | Which system is the training record of truth? Should the replacement display training data only, or also support registration and scheduling? | At this stage DTS should be able to assume the designation of the training system of record and should support registration, scheduling, and curriculumn |
| 29 | Carahsoft.com | Force Package Management | 9/30/26 | How are force packages defined, activated, and filled? Are they standardized templates? | Force packages may be defined using standardized templates and configured to reflect incident-specific staffing needs. The solution should support creation, activation, modification, and tracking of force packages, including required positions, quantities, qualifications, and associated deployment information. |
Detailed force-package business rules, approval workflows, and authoritative data sources will be refined during requirements definition and solution design.
| 30 | Carahsoft.com | Equipment and Property Management | 9/30/26 | What is the system of record for equipment and property? Should equipment tracking occur within the solution or through integration? | Sunflower Asset Management System (SAMS) is currently the system of record for equipment. Equipment tracking should be able to handled within the new solution. |
| 31 | Carahsoft.com | Travel, Lodging, and Timekeeping Integration | 9/30/26 | Which travel, lodging, and time-and-attendance data must flow into or out of deployment records? | All data must be able to flow into the new deployement solution |
| 32 | Carahsoft.com | Reporting and Dashboards | 9/30/26 | Can FEMA share the most-used current DTS reports and dashboards and identify their primary consumers? | This is sensitive and not for distribution at this point in the market research. PII and SPII are contained in reports. Specific dashboards and reports will be defined in the development phase of this project. |
| 33 | Carahsoft.com | Current DTS Technical Environment | 9/30/26 | What technology is DTS built on? What are the approximate record volumes, and how much historical data must be migrated? | 32,000+ responder records |
Currently the system is hosted in the Microsoft Azure Cloud
| 34 | Carahsoft.com | Enterprise Data and Analytics | 9/30/26 | Is there an enterprise data or analytics platform the new solution must feed? | Yes |
| 35 | Carahsoft.com | Security, Identity, and Access | 9/30/26 | What FedRAMP impact level is required? What are the identity requirements (e.g., PIV, DHS ICAM)? Must users access the system from non-GFE devices or low-connectivity field locations? | PIV (Personal Identity Verification) DHS (Dept. of Homeland Security) OKTA (Company) login for FEMA devices and yes the sysem must be accessible from non-GFE (Government Furnished Equipment) devices and/or in low-connectivity field locaitons using login.gov |
| 36 | Carahsoft.com | Enterprise Data and Analytics | 9/30/26 | Is there an enterprise data or analytics platform the new solution must feed? | Yes. The solution should support integration with FEMA enterprise data and analytics environments, as required. Specific source and target systems, data elements, formats, refresh frequencies, and governance controls will be defined during requirements development and solution design. |
37 Carahsoft.com Security, Identity, and Access 9/30/26 What FedRAMP impact level is required? What are the identity requirements (e.g., PIV, DHS ICAM)? Must users access the system from non-GFE devices or low-connectivity field locations? The solution must operate in a FedRAMP High environment. FEMA users will use PIV-based DHS identity services, and the solution must support authorized access from non-GFE devices and low-connectivity field locations. Login.gov is currently used for non-FEMA device access management.
| 38 | Carahsoft.com | Transition and Cutover | 9/30/26 | What coexistence period with DTS is expected? Are there operational blackout windows (e.g., hurricane season) for cutover? | The coexistence period and scope of parallel operations will be determined during requirements definition and implementation planning. Legacy DTS is expected to remain operational during transition to support continuity of operations. Respondents should describe their proposed phased rollout, parallel operations, data migration, cutover, rollback, and continuity approach. | |
| 39 | Carahsoft.com | Acquisition Strategy | 9/30/26 | What is the anticipated acquisition approach and timeline following this RFI? | FEMA has not determined the acquisition vehicle, contract type, award structure, or whether the requirement will be competed as a stand-alone contract or through an existing vehicle. FEMA also has not made a final small-business or socioeconomic set-aside determination. The acquisition approach and any set-aside determination will be identified in a future solicitation or related notice, consistent with applicable acquisition regulations, market-research results, and acquisition planning. | |
| 40 | Deloitte Services LP | Users and Scale | 10/7/26 | Business Scope, Users, and Release Priorities | What user groups and FEMA organizations must the solution support, and what are the approximate user volumes for each? | All user groups and organizations as well as potential for non-FEMA users. 32,000 current users. |
| 41 | Deloitte Services LP | MVP and Release Planning | 10/7/26 | Business Scope, Users, and Release Priorities | Which business and system capabilities are required for the minimum viable product (MVP), and which capabilities are planned for subsequent releases? | At MVP, the solution should support core deployment-management workflows, including authorized user access, role-based permissions, personnel availability and deployment status updates, event and incident creation, basic assignment and tracking, essential notifications, audit logging, and basic reporting. |
Additional capabilities, integrations, advanced analytics, training and curriculum functions, expanded communications, and other enhancements may be delivered in subsequent releases. The final release plan and capability prioritization will be defined during requirements definition and solution design.
| 42 | Deloitte Services LP | Users and Scale | 10/7/26 | Business Scope, Users, and Release Priorities | What transaction volumes must the solution support during normal operations and disaster-surge conditions? | See response to questions 3 |
| 43 | Deloitte Services LP | Current DTS Technical Environment | 10/7/26 | Current-State Environment | Please describe the current Deployment Tracking System (DTS) architecture, hosting model, technology stack, and operations and maintenance support model. | The current DTS is a custom, cloud-hosted application operating in Microsoft Azure and supported through an operations and maintenance model. |
Detailed architecture, technology-stack, interface, and support-model documentation is not being provided at the RFI stage. Information needed to support the selected solution will be addressed during requirements definition, acquisition planning, and implementation.
| 44 | Deloitte Services LP | Current DTS Functional Scope | 10/7/26 | Current-State Environment | What are the primary operational, functional, technical, and user-experience challenges associated with the current DTS 2.0 solution? | The RFI’s Necessary Capabilities worksheet identifies the functional areas FEMA seeks to improve. Detailed current-state technical and operational documentation is not being provided at this stage. |
| 45 | Deloitte Services LP | Integrations | 10/7/26 | Integrations and Interfaces | Which FEMA, Department of Homeland Security (DHS), and external systems must integrate with DTS 2.0, and what interfaces, data exchanges, protocols, or integration methods are required? | See response to question 5 |
| 46 | Deloitte Services LP | Data Migration | 10/7/26 | Data Migration and Transition | What legacy data must be migrated, including estimated volume, historical period, data quality, attachments, records-retention requirements, and any archival constraints? | The final migration scope, including data types, volumes, historical periods, attachments, retention requirements, archival constraints, data quality, and extract methods, will be defined during requirements definition and solution design. For planning purposes, respondents should assume more than 10 years of historical DTS data, including personnel, deployment, qualification, training, incident, equipment, and related records. Respondents should identify assumptions, dependencies, and cost drivers for data extraction, cleansing, validation, migration, archival, and phased transition. |
| 47 | Deloitte Services LP | Transition and Cutover | 10/7/26 | Data Migration and Transition | Will the legacy DTS and DTS 2.0 be required to operate concurrently during the transition? If so, what is the anticipated duration and scope of parallel operations? | The coexistence period and scope of parallel operations will be determined during requirements definition and implementation planning. Legacy DTS is expected to remain operational during transition to support continuity of operations. Respondents should describe their proposed phased rollout, parallel operations, data migration, cutover, rollback, and continuity approach. |
| 48 | Deloitte Services LP | Security, Privacy, and Compliance | 10/7/26 | Security and Compliance | What security, privacy, identity and access management, authorization, accreditation, auditing, and FEMA or DHS compliance requirements must DTS 2.0 satisfy? | DTS 2.0 must operate in a FEMA-provided, Government-owned FedRAMP High environment and meet applicable FEMA and DHS cybersecurity, privacy, identity and access management, auditing, records-management, accessibility, and supply-chain risk-management requirements. |
The solution must support authorized access, role-based permissions, multifactor authentication, encryption, logging, monitoring, incident response, and FEMA authorization requirements. Specific control requirements, inherited controls, identity services, and authorization artifacts will be defined during requirements definition and solution design.
| 49 | Ernst & Young LLP | Integrations | 10/7/26 | Technical | The RFI references integration and data interoperability with other FEMA/DHS systems. How many integrations will be required? Please provide more detail on the FEMA/DHS systems with which the new system must be integrated? | See response to question 5 |
| 50 | Ernst & Young LLP | Data Migration | 10/7/26 | Technical | The RFI references data migration. Please quantify how much data will need to be migrated and from which systems the data will need to be migrated? For a future RFQ/RFP, who will be responsible for data cleansing - the Government or the vendor? | The final migration scope, including source systems, data types, volumes, historical periods, and data-quality requirements, will be defined during requirements definition and solution design. |
For planning purposes, respondents should assume more than 10 years of historical DTS data, including personnel, deployment, qualification, training, and related records. Responsibilities for data cleansing, validation, and migration will be defined in any future solicitation. Respondents should identify their assumptions, dependencies, and cost drivers.
| 51 | Ernst & Young LLP | Users and Scale | 10/7/26 | Technical | How many users must be supported by the new system? What are the typical transaction volumes by month or year? | See response to question 3 |
| 52 | Ernst & Young LLP | Solution Architecture and Platform | 10/7/26 | Technical | Is it the Government’s goal to have a solution built on Salesforce, Dynamics, or ServiceNow only? If so, does the Government have licensing for all three platforms? | No. FEMA is not limiting respondents to Salesforce, Microsoft Dynamics, ServiceNow, or any other specific platform. Respondents may propose COTS (Commercial-Off the Shelf), configurable COTS, custom, or hybrid solutions that meet the RFI requirements and operate within the required Government-owned cloud environment.s |
FEMA (Federal Emergency Managment Agency) is not providing platform-specific licensing assumptions at this stage. Respondents should identify any licensing, subscription, or Government-furnished-service assumptions used in their response.
| 53 | Ernst & Young LLP | Requirements Development | 10/7/26 | Scope | Is the Government planning to provide more detailed requirements (beyond the “necessary capabilities” in the RFI survey spreadsheet)? Providing additional requirements enables bidders to provide higher quality RFQ/RFP responses. | The RFI provides the current level of detail needed for market research. FEMA may develop and provide more detailed requirements, performance standards, and implementation information in any future solicitation, as appropriate. |
| 54 | Shaheem & Shafin Corporation (SSC) | Performance Location and Onsite Support | 10/7/26 | Remote / Onsite Performance | Does FEMA anticipate that the majority of implementation, development, integration, testing, and sustainment activities may be performed remotely? | FEMA has not established performance-location requirements at this stage. Respondents should describe their proposed delivery model, including any remote, hybrid, or onsite assumptions, and identify activities that may require onsite participation. Any future solicitation will define applicable performance-location requirements. |
| 55 | Shaheem & Shafin Corporation (SSC) | Performance Location and Onsite Support | 10/7/26 | Remote / Onsite Performance | Is there any anticipated requirement for full-time or recurring onsite personnel in Washington, DC or other FEMA locations? | FEMA has not established onsite staffing requirements at this stage. Respondents should identify any proposed onsite or travel assumptions. Any future solicitation will define applicable performance-location and staffing requirements. |
| 56 | Shaheem & Shafin Corporation (SSC) | Performance Location and Onsite Support | 10/7/26 | Remote / Onsite Performance | If onsite participation is expected, what roles and approximate frequency of travel does FEMA anticipate? | FEMA has not established onsite staffing requirements at this stage. Respondents should identify any proposed onsite or travel assumptions. Any future solicitation will define applicable performance-location and staffing requirements. |
| 57 | Shaheem & Shafin Corporation (SSC) | Solution Approach | 10/7/26 | Solution / Acquisition Model | Since FEMA is considering COTS, configurable COTS, custom, and hybrid solutions, does FEMA have a current preference among these approaches? | FEMA does not have a current preference among COTS, configurable COTS, custom, or hybrid approaches. Respondents should describe the approach that best meets the DTS 2.0 requirements, including relevant cost, schedule, risk, scalability, security, integration, and sustainment considerations. |
| 58 | Shaheem & Shafin Corporation (SSC) | Solution Approach | 10/7/26 | Solution / Acquisition Model | Would FEMA consider an integrator-led custom or hybrid solution deployed within a FEMA/DHS government-owned cloud environment? | Yes. FEMA will consider integrator-led custom or hybrid solutions deployed within a FEMA-provided, Government-owned FedRAMP High cloud environment, provided they meet the RFI requirements and applicable FEMA and DHS security, authorization, integration, and sustainment requirements. |
| 59 | Shaheem & Shafin Corporation (SSC) | Cloud Hosting | 10/7/26 | Government Cloud / Hosting | Does FEMA anticipate providing the AWS GovCloud, Azure Government, or other government-owned cloud environment for the future solution? | Respondents should assume deployment in a FEMA-provided, Government-owned FedRAMP High cloud environment for the operational solution. |
Vendor-managed FedRAMP High SaaS offerings may be described as part of a proposed solution, but would require FEMA approval and must meet applicable security, integration, authorization, and data requirements.
60 Shaheem & Shafin Corporation (SSC) Cloud Hosting and Contractor Responsibilities 10/7/26 Government Cloud / Hosting Would the contractor primarily be responsible for application architecture, configuration/development, deployment, integration, DevSecOps, and security implementation within that environment, or would the contractor also be responsible for procuring and operating the underlying cloud infrastructure? For planning purposes, respondents should assume FEMA will provide the underlying Government-owned FedRAMP High cloud environment. The contractor would be primarily responsible for application architecture, configuration or development, deployment, integration, Development Security Operations, and security implementation within that environment.
Specific Government-furnished services, inherited controls, and responsibilities will be defined during requirements development and acquisition planning.
61 Shaheem & Shafin Corporation (SSC) FedRAMP and ATO Responsibilities 10/7/26 FedRAMP / ATO Responsibility For a custom or hybrid solution deployed within a FEMA/DHS government cloud environment, would the contractor be expected to hold a separate FedRAMP authorization, or would the application operate within FEMA’s existing authorized boundary? For planning purposes, respondents should assume a custom or hybrid solution will operate within FEMA’s Government-owned FedRAMP High cloud environment and be authorized through FEMA’s authorization process.
A separate FedRAMP authorization for the contractor or application is not required at the RFI stage. Respondents should identify their current FedRAMP or ATO status, authorization dependencies, and approach to supporting FEMA authorization activities.
62 Shaheem & Shafin Corporation (SSC) FedRAMP and ATO Responsibilities 10/7/26 FedRAMP / ATO Responsibility What level of contractor responsibility does FEMA anticipate for ATO documentation, security control implementation, assessment support, POA&M remediation, and continuous monitoring? For planning purposes, respondents should assume the contractor will support ATO documentation, implementation of applicable non-inherited security controls, security assessment activities, POA&M remediation, and continuous monitoring for the application.
FEMA will identify available inherited controls, Government-furnished security services, and the final division of responsibilities during requirements definition and acquisition planning.
| 63 | Shaheem & Shafin Corporation (SSC) | Data Migration | 10/7/26 | Legacy DTS / Data Migration | Will FEMA provide detailed legacy DTS architecture, interfaces, data models, data volumes, reports, workflows, and historical data-quality information to the selected contractor? | The final migration scope, including data types, volumes, historical periods, attachments, retention requirements, archival constraints, data quality, and extract methods, will be defined during requirements definition and solution design. For planning purposes, respondents should assume more than 10 years of historical DTS data, including personnel, deployment, qualification, training, incident, equipment, and related records. Respondents should identify assumptions, dependencies, and cost drivers for data extraction, cleansing, validation, migration, archival, and phased transition. |
| 64 | Shaheem & Shafin Corporation (SSC) | Data Migration | 10/7/26 | Legacy DTS / Data Migration | What approximate volume of historical personnel, deployment, qualification, training, incident, and equipment data should vendors assume for migration planning? | See response to questions 3 |
| 65 | Shaheem & Shafin Corporation (SSC) | Integrations | 10/7/26 | Integration Environment | Approximately how many FEMA/DHS systems does FEMA anticipate integrating with the replacement solution? | The replacement will need to interface with Government systems to support required functionality at MVP and full deployment. The specific integration inventory, authoritative systems, data exchanges, interface standards, API specifications, volumes, and test-environment access will be refined during requirements definition and solution design. Respondents should describe their integration architecture and approach for Government systems. |
| 66 | Shaheem & Shafin Corporation (SSC) | Integration Testing and Test Environments | 10/7/26 | Integration Environment | Will FEMA provide existing API/interface specifications and lower/test environments for these systems? | Information and access needed to support the selected solution, including available API or interface specifications and appropriate non-production environments, will be provided during requirements definition and implementation, as appropriate. |
Respondents should identify any information or access assumptions that materially affect their estimates or proposed approach.
| 67 | Shaheem & Shafin Corporation (SSC) | Users and Scale | 10/7/26 | Users and Surge Volumes | What is the approximate current number of DTS users, including normal and peak concurrent users? | See response to question 3 |
| 68 | Shaheem & Shafin Corporation (SSC) | Users and Scale | 10/7/26 | Users and Surge Volumes | During major disaster or surge events, what transaction volumes, concurrency, and performance levels should vendors assume? | See response to question 3 |
| 69 | Shaheem & Shafin Corporation (SSC) | Operations and Production Support | 10/7/26 | Operations, Support, and SLAs | Does FEMA anticipate 24x7x365 production support for the future system? | Yes |
| 70 | Shaheem & Shafin Corporation (SSC) | Service Levels and Recovery | 10/7/26 | Operations, Support, and SLAs | Are there currently contemplated availability, incident-response, recovery-time, recovery-point, or problem-resolution SLAs? | FEMA is considering availability and recovery requirements, including an operational-availability threshold of 99.92 percent and recovery from catastrophic failure within 24 hours. Specific incident-response, recovery-point, problem-resolution, and other service-level requirements will be defined in any future solicitation. |
| 71 | Shaheem & Shafin Corporation (SSC) | Service-Level Remedies | 10/7/26 | Operations, Support, and SLAs | Does FEMA anticipate service credits, liquidated damages, or other financial penalties tied to SLA performance? | Undertermined at this time. This information is not needed to effectively respond to the RFI. |
| 72 | Shaheem & Shafin Corporation (SSC) | Help Desk and Support Model | 10/7/26 | Help Desk Responsibility | Does FEMA anticipate that the contractor will provide Tier 1 end-user help desk support, or primarily Tier 2/3 application, integration, and engineering support? | FEMA anticipates an internal team will manage help-desk tickets and issues in coordination with contractor support. Respondents should describe their proposed approach for Tier 1 end-user support and Tier 2/3 application, integration, and engineering support, including assumptions, coverage hours, escalation procedures, and surge support. |
| 73 | Shaheem & Shafin Corporation (SSC) | Help Desk and Support Model | 10/7/26 | Help Desk Responsibility | If Tier 1 support is contractor-provided, approximately how many users and monthly support requests should vendors assume? | FEMA anticipates that internal staff will provide Tier 1 end-user support and manage help-desk tickets. The contractor should provide escalated Tier 2/3 application, integration, and engineering support, as needed. Respondents should identify assumptions for support volumes, coverage, escalation, and surge support. (Users 15,000-20,000 monthly) |
| 74 | Shaheem & Shafin Corporation (SSC) | Staffing and Key Personnel | 10/7/26 | Staffing / Key Personnel | Does FEMA anticipate specific mandatory key personnel or minimum staffing levels? | FEMA has not established mandatory key personnel or minimum staffing levels at this stage. Respondents should propose a staffing approach appropriate to their solution and identify key roles, relevant experience, and any assumptions. Any specific requirements will be addressed in a future solicitation. |
| 75 | Shaheem & Shafin Corporation (SSC) | Teaming and Subcontractors | 10/7/26 | Staffing / Key Personnel | Will the contractor be permitted to use qualified subcontractors or staffing partners for development, testing, cybersecurity, accessibility, training, and specialized FEMA domain expertise while retaining overall prime contractor responsibility? | Yes. Respondents may propose qualified subcontractors or staffing partners, while the prime contractor remains responsible for overall contract performance. |
Respondents should identify proposed partners, their roles, relevant experience, and any material dependencies. Specific teaming requirements will be addressed in any future solicitation.
| 76 | Shaheem & Shafin Corporation (SSC) | Section 508 Accessibility | 10/7/26 | Section 508 / Accessibility | Does FEMA anticipate requiring a formal Voluntary Product Accessibility Template/Accessibility Conformance Report VPAT/ACR at initial deployment, or may accessibility validation and remediation be completed as part of the implementation and ATO process? | FEMA expects the solution to comply with applicable Section 508 accessibility requirements. |
| 77 | Shaheem & Shafin Corporation (SSC) | Contract Type and Pricing Structure | 10/7/26 | Pricing / Contract Structure | Does FEMA currently anticipate a predominantly FFP, T&M/Labor Hour, hybrid, or performance-based contract structure? | Respondents should provide separate ROM estimates for implementation, licenses or subscriptions, data migration, operations and maintenance, cybersecurity and ATO support, training, surge support, and any cloud-related costs not covered by FEMA. Respondents should clearly distinguish recurring and non-recurring costs and state all pricing assumptions. |
FEMA has not determined the contract type or pricing structure at this stage. Any future solicitation will identify the applicable contract structure, which may include fixed-price, time-and-materials/labor-hour, hybrid, or performance-based elements, as appropriate.
78 Shaheem & Shafin Corporation (SSC) Pricing and Cost Estimates 10/7/26 Pricing / Contract Structure For market-research purposes, should vendors assume separate pricing for implementation, cloud/hosting, licenses/subscriptions, migration, O&M, cybersecurity/ATO, training, and surge support? Respondents should provide separate ROM estimates for implementation, licenses or subscriptions, data migration, operations and maintenance, cybersecurity and ATO support, training, surge support, and any cloud-related costs not covered by FEMA. Respondents should clearly distinguish recurring and non-recurring costs and state all pricing assumptions.
FEMA expects to provide the operational cloud environment. Respondents should identify any cloud-related costs not covered by FEMA and clearly state all pricing assumptions.
| 79 | Shaheem & Shafin Corporation (SSC) | Implementation Schedule | 10/7/26 | Implementation Schedule | Does FEMA have a target timeframe for MVP, initial production deployment, full operational capability, and retirement of the legacy DTS? | Specific target dates for MVP, initial production deployment, full operational capability, transition, and decommissioning will be defined during acquisition planning and in any future solicitation. |
| 80 | Shaheem & Shafin Corporation (SSC) | Transition and Cutover | 10/7/26 | Implementation Schedule | Does FEMA anticipate a phased rollout and coexistence period between DTS and the replacement solution? | The coexistence period and scope of parallel operations will be determined during requirements definition and implementation planning. Legacy DTS is expected to remain operational during transition to support continuity of operations. Respondents should describe their proposed phased rollout, parallel operations, data migration, cutover, rollback, and continuity approach. |
| 81 | GovSignals | Cloud Hosting | 10/7/26 | The RFI's Conditions and Assumptions require the solution to operate within the Government-owned cloud environment. Will FEMA accept a FedRAMP High authorized SaaS environment under a FEMA-issued ATO, or does FEMA require deployment into a FEMA-managed cloud tenant? | Respondents should assume deployment in a FEMA-provided, Government-owned FedRAMP High cloud environment for the operational solution. |
Vendor-managed FedRAMP High SaaS offerings may be described as part of a proposed solution, but would require FEMA approval and must meet applicable security, integration, authorization, and data requirements.
82 GovSignals System Boundary and Integrations 10/7/26 Which capabilities should DTS 2.0 deliver natively, and which should it meet by integrating with existing FEMA systems, particularly the learning management system (subtasks 1.2 and 1.3), notification and audio/video tools (subtask 5.7), and personnel, travel, and equipment records? We will scope our solution to the boundary FEMA identifies. Respondents should describe how their proposed solution will meet all functional tasks and necessary capabilities in the RFI, whether through native functionality, integration with Government systems, or a hybrid approach.
FEMA has not finalized the system boundary or required integration inventory for learning management, notifications and communications, personnel, travel, equipment, or related records. The final allocation of native capabilities and integrations will be defined during requirements definition and solution design.
| 83 | GovSignals | Acquisition Strategy | 10/7/26 | Does FEMA anticipate a single award for the full scope, or a modular approach that separates deployment management from training delivery and communications? | FEMA has not determined the acquisition vehicle, contract type, award structure, or whether the requirement will be competed as a stand-alone contract or through an existing vehicle. FEMA also has not made a final small-business or socioeconomic set-aside determination. The acquisition approach and any set-aside determination will be identified in a future solicitation or related notice, consistent with applicable acquisition regulations, market-research results, and acquisition planning. |
| 84 | GovSignals | Users and Scale | 10/7/26 | What scale should respondents plan for, including user populations beyond FEMA employees (such as the Surge Capacity Force and state, local, tribal, and territorial partners), peak concurrent users during surge, and the volume of legacy DTS data to migrate? | See response to questions 3 |
| 85 | Permuta Technologies | Users and Scale | 10/7/26 | Please provide the anticipated total user population for the replacement DTS. If FEMA anticipates a phased rollout, please identify the expected MVP/pilot population and enterprise population. | See response to question 3 |
| 86 | Permuta Technologies | Government-Furnished Cloud and Identity Services | 10/7/26 | Does FEMA currently maintain an Azure Government and/or Microsoft Power Platform environment that the replacement DTS may leverage? If so, please identify any applicable enterprise entitlements for Power Platform, Power Apps, Dataverse, Entra ID, or related Microsoft services that respondents should assume are Government furnished. | Azure Government with Entra ID |
| 87 | Permuta Technologies | Cloud Hosting | 10/7/26 | Does FEMA have a preferred deployment model for the replacement DTS, such as vendor hosted SaaS, Government hosted cloud, Government furnished Azure, private cloud, or another model? | Respondents should assume deployment in a FEMA-provided, Government-owned FedRAMP High cloud environment for the operational solution. |
Vendor-managed FedRAMP High SaaS offerings may be described as part of a proposed solution, but would require FEMA approval and must meet applicable security, integration, authorization, and data requirements.
| 88 | Permuta Technologies | Cloud Hosting | 10/7/26 | Does FEMA expect the contractor to provide and manage the hosting environment, or does FEMA intend to provide the cloud environment? If contractor hosted solutions are acceptable, are there preferred cloud service providers, FedRAMP baselines, impact levels, or hosting constraints that respondents should assume? | See response to question 88 |
| 89 | Permuta Technologies | Integrations | 10/7/26 | Please identify the FEMA/DHS systems expected to interface with the replacement DTS and, where available, indicate authoritative source/target system, direction of data exchange, interface method, API availability, data frequency, approximate volume, and security requirements | The replacement will need to interface with Government systems to support required functionality at MVP and full deployment. The specific integration inventory, authoritative systems, data exchanges, interface standards, API specifications, volumes, and test-environment access will be refined during requirements definition and solution design. Respondents should describe their integration architecture and approach for Government systems. |
| 90 | Permuta Technologies | Data Migration | 10/7/26 | Please provide available information regarding the current DTS data model and migration scope, including approximate data volume, number of records, historical retention requirements, attachments/documents, data quality, extract methods/APIs, and the amount of historical data FEMA expects to migrate. | See resposne to question 4 |
| 91 | Permuta Technologies | COTS and CCOTS Classification | 10/7/26 | For purposes of the survey, how should respondents classify a commercially released COTS capability where the underlying functionality exists in the product but FEMA specific workflows, roles, business rules, templates, terminology, or other administrative settings must be established during implementation? Should this be classified as “YES: CCOTS Solution available; configuration required,” provided no new product functionality or core code customization is required? | Yes. Select “YES: CCOTS Solution available; configuration required” when the capability exists in the commercially released product and FEMA-specific workflows, roles, business rules, templates, terminology, or administrative settings can be established through supported configuration without new functionality or core-code customization. |
Use the comments field to identify the configuration assumptions and any material implementation effort.
| 92 | Permuta Technologies | COTS and CCOTS Classification | 10/7/26 | CCOTS Configuration Persistence Across Product Updates: FEMA defines CCOTS configuration as changes made within established COTS product parameters by an authorized Government user, without engineering services, that remain compatible with future versions of the software. If a COTS product allows Government users to create configuration changes using supported administrative tools without engineering services, but those customer specific configurations must be preserved as a separate managed solution and subsequently reapplied, validated, or updated following vendor patches or new product releases, would FEMA still consider the solution to meet the definition of “YES: CCOTS Solution available; configuration required”? Or does FEMA interpret “compatible with future versions” to require that customer configurations automatically persist through all product updates without Government action? | A solution may be classified as “YES: CCOTS Solution available; configuration required” if the configuration is created using supported administrative tools, requires no new product functionality or core-code customization, and remains compatible with future product releases. Respondents should disclose any configuration that must be reapplied, validated, or updated after patches or releases. |
| 93 | Concurrent Technologies Corporation | Solution Approach | 10/7/26 | Does FEMA have a preference among COTS, configurable COTS, custom, or hybrid approaches, or will all approaches be evaluated equally based on capability, risk, schedule, and lifecycle cost? | FEMA does not have a current preference among COTS, configurable COTS, custom, or hybrid approaches. Respondents should describe the approach that best meets the DTS 2.0 requirements, including relevant cost, schedule, risk, scalability, security, integration, and sustainment considerations. |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .