00002 70FA6024R00000002 Question Responses 2.1.24.pdf

Q&A# Question Solicitation Document & Page # Solicitation Paragraph # Response

The designation of a Severe Repetitive Loss property in section 4.3.1 conflicts with the designation in the Flood Insurance Manual (Appendix F page F-1) and other documented definitions. SOO at 12-13, § 4.3.1; SOO at 3, 59, §§ 2.0 (referencing the Flood Insurance Manual), 10.7 (listing Flood Insurance Manual). Is FEMA changing the designation of SRL or will the SOO be updated? SOO p.3, p.12-13, p.59

SOO - 2.0 Background;

SOO - 4.3.1 - NFIP Direct Standard Services - Severe Repetitive Loss Target Group (SRLTG);

SOO - 10.7 - Statutes, Regulations, Policies, Guidelines, and Specifications

Designation of SRL properties is not changing. SRLs are counted based on those properties deemed SRL. It's based on the actual count of SRL policies that begin with the prefix RL.

The SOO states that the contractor shall: “Coordinate and perform parallel testing of systems with FEMA . . .” SOO at 8, § 4.1.1; see also SOO at 31, § 4.10 (“Performing ‘parallel’ operations/runs with the successor.”). Please define or explain the meaning of “parallel testing of systems” and “‘parallel’ operations/runs.” SOO p.8-9, p.31

SOO - 4.1.1 - General Transition-in Activities, The contractor shall…4th Bullet;

SOO - Transition Out, The contractor shall…2nd bullet on page

Parallel testing and parallel operations will be the government’s tool to ensure smooth and complete migration of data and services.

Parallel Testing is the examination assessment of functionally equivalent IT functionally and Business processes of the successor’s target version of NFIP Direct system on against the currently run by the incumbent applied to a testing version of the NFIP Direct and the successor’s target version of NFIP Direct system to validate comparable expected outcomes prior given comparable data and inputs. This parallel testing occurs prior in anticipation of the loading of operational data.

“Parallel” operations/runs occur after the first iteration of operational data has been transferred from the incumbent to the successor through FEMA using a copy of the Government Data residing in both the incumbent system and the successor system. The same IT and Business inputs are processed on both successor and incumbent systems and the results are compared to assess mission readiness. The transition plans are expected to detail the number and timing of parallel operations/runs. Both the incumbent and successor are expected to support a smooth transition of IT and business operation to ensure NFIP Direct Business Continuity.

The SOO states: “The NFIP intends to enable policyholders to pay for their policies either annually or through installment payments. The Contractor shall provide support and service the policies accordingly.” SOO at 13, § 4.3.1.1. Can FEMA provide the requirements or guidelines for servicing policies via installment payments as this is a new requirement? For instance, to implement an installation payment system, the software may need to be revised to maintain and secure the sensitive personally identifiable information (“SPII”) (i.e., credit card and bank account information). Systems that contain such information must meet certain standards, and modifications likely will be required. To implement the changes, there may need to be a testing schedule that impacts the anticipated go-live date. If specifications aren’t available, can FEMA remove this requirement? SOO p.13 SOO - 4.3.1.1 NFIP Policy Servicing, Fifth Bullet

FEMA is in the beginning stages of the Installment Plan process. FEMA will properly work with the appropriate entities to obtain the necessary Privacy Threshold Analysis, Privacy Impact Analysis and other associated documents and processes in line with FEMA/DHS security requirements. FEMA will not remove this requirement.

The RFP states: “The CLINs and applicable pricing tiers specified for Standard Flood Insurance Policies (SFIP), Group Flood Insurance Policies (GFIP), and Severe/Repetitive Loss Target Group Policies (S/RLTGP) shall be paid per policy/per month based on the fixed unit rates. The Contractor shall bill based on the appliable tier (column D below) which applies to the total number of policies in affect at the end of each month or billing period.” RFP at 3, § B.4 (emphasis added). Can FEMA clarify if the number of policies is referring to Contracts in force, or Policies in force? Further this guidance conflicts with SOO p. 13 where it states “Only policies designated with a unique SRL number are eligible for billing/inclusion according to this definition/contract.” SOO at 13, § 4.3.1. Can FEMA please remove the statement in the SOO? SOO p.13; RFP p.3

SOO - 4.3.1 - NFIP Direct Standard Services - Severe Repetitive Loss Target Group (SRLTG), italicized statements;

RFP - B4.Price Schedule;

Designation of SRL properties is not changing. SRLs are counted based on those properties deemed SRL. It's based on the actual count of SRL policies that begin with the prefix RL. FEMA will not remove this requirement.

The SOO states that the Contractor shall “[c]oordinate with local agents to establish NFIP Direct sales goals. Collect and analyze regional sales trend data, report information to the NFIP Direct Project Director, and recognize top sellers.” It will be difficult to require agents to fulfill sales goals if there are no agent agreements. Will FEMA be requiring agent agreements, addressing commission percentages paid to agents, and providing incentives to write additional business? SOO p.22 SOO 4.3.2.10 - NFIP Direct Marketing, entire section FEMA will not be requiring agent agreements or changing commission percentages which are currently dictated in the CFR for the NFIP Direct.

The SOO has additional requirements when compared to the current scope of work for the current NFIP Direct contract. For example, SOO § 4.3.2.10 – Marketing, SOO § 5.0 Performance Requirements, SOO § 6.0 Deliverables, and SOO § IX FedRAMP,) are all new requirements that expand the current NFIP Direct contract’s scope of work. The SOO states that the contractor will have one year to meet all requirements. For the incumbent contractor, will FEMA also allow the one year period to implement all these additional requirements? SOO p.22 , p.32-43, p.43-52, p.86

SOO - 4.3.2.10 - NFIP Direct Marketing, entire section;

SOO - 5.0 - Performance Requirements;

SOO - 6.0 - Deliverables;

SOO - IX. FedRAMP Certified Language

FEMA allows up to one year to transition in, which includes obtaining an Authority To Operate (ATO) and implementing requirements. FEMA expects an incumbent contractor to continue the normal processing of policies and claims. FEMA will work with an incumbent contractor to discuss the new requirements and set realistic timelines.

The SOO requires “[t]he proposed cloud solution [to be] FedRAMP certified.” SOO at 86, § IX; see also SOO at 23, § 4.4.1 (“The contractor shall obtain an Authorization/Authority to Operate (ATO) for the proposed IT solution as a FEMA Major Application designated as NFIP Direct.”). Is this certification required at the time of award? SOO p.23, p.86

SOO - 4.4.1 - Security and Privacy Compliance - Second Bullet;

SOO - IX. FedRAMP Certified Language, First Bullet Any IT solution offered as FEDRAMP certified must present a FEDRAMP certification at time of award.

The RFP and SOO are ambiguous as to whether the Agency seeks an available commercial solution or a customized solution developed for FEMA during contract performance. In RFP Section C, the RFP contemplates a commercial procurement (see, e.g., RFP at 26-34, § C.3 (including terms and conditions for commercial items)), and in the Evaluation and Basis for Award (RFP at 94, § E10), the Government indicates that this is a solicitation for “commercial items.” Additionally, in the oral presentation, the Government contemplates that offerors will be able to “provide a demonstration of their proposed IT solution or a sample system that will be updated[.]” RFP at 92, § E10. These requirements suggest that FEMA seeks a solution developed by the offeror and available in the commercial market. However, the SOO states: “the solution is yet to be determined and will be but[i]lt on the FEMA Moderate level platform.” SOO at 24, § 4.4.1. The SOO also contains several requirements which suggest that FEMA contemplates the contractor developing a new solution during performance. See, e.g., SOO at 24, § 4.4.1 (requiring source code to reside in a DHS/FEMA owned and operated repository); SOO at 25, § 4.4.3 (requiring creation of a database and repository within the FEMA Enterprise Cloud). Can the Agency please clarify whether it seeks an existing, commercially available solution or the development of a new solution built in the FEMA environment? SOO p.23-25; RFP p.26-34 p.34-41, p.92, p.94-96

SOO - 4.4.1 - Security and Privacy Compliance, entire section;

SOO - 4.4.3 - Direct System Database and Document Repository; entire section;

RFP - C.3 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services, entire section;

RFP - C.4 52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders - Commercial Products and Commercial Services, entire section;

RFP - E10. Proposal Instructions, Element 1: System Demonstration & On the Spot Questions, entire section;

RFP - E10. Proposal Instructions, Evaluation and Basis for Award, FAR 52.212-2, Evaluation - Commercial Items, entire section

This RFP is for flood insurance program support wherein the contractor provides all supporting technology overlaid with government sanctioned security to ensure that the government provided data is protected in accordance with FISMA and DHS security requirements. FEMA is seeking a single NFIP Direct servicing agent to provide all the necessary support for the issuance and administration of insurance policies and claims on behalf of the National Flood Insurance Program.

This is a Commercial Items procurement under FAR Part 12 for which “contracts for the acquisition of commercial products or commercial services shall, to the maximum extent practicable, include only those clauses … [d]etermined to be consistent with customary commercial practice.” FAR 12.301(a); see also FAR 12.302(c) (“The contracting officer shall not tailor any clause or otherwise include any additional terms or conditions in a solicitation or contract for commercial products or commercial services in a manner that is inconsistent with customary commercial practice for the item being acquired unless a waiver is approved[.]”). Offerors should not be required to “furnish technical information” “related to commercial computer software” that “is not customarily provided to the public,” FAR 12.212, and the Government should only be acquiring rights in data and software “customarily provided to the public.” FAR 12.211. SOO at 23, § 4.4.1 states that “the contractor shall” “Develop, Test, and Deploy software meeting FEMA and NFIP Direct standards. All source code will reside within a DHS/FEMA owned and approved repository.” (Emphasis added.) It is inconsistent with standard commercial terms to require that code be developed when commercial computer software may be available to meet agency needs which do not normally provide the Government (or any software or data purchaser or licensor) access to or ownership of or to have source code “reside within” a Government “owned and approved repository.” In other words, the Government’s requirement is not consistent with customary commercial practice and should not be required here. Will the Government withdraw this requirement which is inconsistent with a FAR Part 12 Commercial Items procurement? SOO p.23-25; RFP p.26-34, p.34-41 p.94-96

SOO - 4.4.1 - Security and Privacy Compliance, entire section;

RFP - C.3 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services, entire section;

RFP - C.4 52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders - Commercial Products and Commercial Services, entire section;

RFP - E.10, referencing FAR 52.212-2, Evaluation - Commercial Items, entire section SOO Section 4.4.1 Security and Privacy has been revised to include only security and privacy requirements

The RFP seeks a commercial solution (RFP at 26-34, 94, §§ C, E10), while the SOO appears to contemplate the contractor developing a FEMA-specific noncommercial product (SOO at 23, § 4.4.1 referencing requirements that apply to FEMA systems operated by contractors). Can the government clarify whether it is seeking a contractor owned, contractor operated solution; a government owned, contractor operated solution; or something else? SOO p.23-25; RFP p.26-34, p.34-41, p.94-96

SOO - 4.4.1 - Security and Privacy Compliance, entire section;

RFP - C.3 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services, entire section;

RFP - C.4 52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders - Commercial Products and Commercial Services, entire section RFP - E10. Proposal Instructions, Evaluation and Basis for Award, FAR 52.212-2, Evaluation - Commercial Items, entire section

FEMA is seeking for a contractor capable of running the NFIP Direct as the servicing agent operated from a government approved and monitored cloud environment.

The RFP seeks a commercial solution (RFP at 26-34, 94, §§ C, E10), while the SOO appears to contemplate the contractor developing a FEMA-specific noncommercial product (e.g., SOO at 23, § 4.4.1 (referencing requirements that apply to FEMA systems operated by contractors)). Is development of a new, custom-built solution preferred over commercial, currently available software? How will the Agency evaluate proposals for a custom-built approach compared to proposals for commercial software? SOO p.23-25; RFP p.26-34, p.34-41, p.94-96

SOO - 4.4.1 - Security and Privacy Compliance, entire section;

RFP - C.3 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services, entire section;

RFP - C.4 52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders - Commercial Products and Commercial Services, entire section RFP - E10. Proposal Instructions, Evaluation and Basis for Award, FAR 52.212-2, Evaluation - Commercial Items

FEMA has not articulated a preference for either custom built or off-the-shelf solution, nor is pursuing the development of a new custom-built software. The offeror is expected to be equiped with the system and built-in capability throughout the duration of this contract to ensure that NFIP Direct services are rendered in full compliance of NFIP Direct operational requirements.

The SOO states: “All source code will reside within a DHS/FEMA owned and approved repository.” SOO at 24, § 4.4.1. This provision, which requires a contractor to provide its proprietary, privately developed solution to the Government, is inconsistent with commercial terms and customary commercial practice. In commercial contracts, a company would not provide another entity with access, much less control over, the source code underlying the contractor’s technology solution provided under a contract. By providing the source code, a company essentially provides a roadmap to another entity to develop the solution provided by the company. Given that this is a commercial items procurement (RFP at 26-34, 94, §§ C, E10) and the FAR requires such procurements to only include requirements that are “consistent with commercial practice,” will the Agency please remove this requirement? SOO p.23-25; RFP p.26-34, p.34-41, p.94-96

SOO - 4.4.1 - Security and Privacy Compliance, entire section;

RFP - C.3 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services, entire section;

RFP - C.4 52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders - Commercial Products and Commercial Services, entire section;

RFP - E10. Proposal Instructions, Evaluation and Basis for Award, FAR 52.212-2, Evaluation - Commercial Items, entire section

Current Federal Cybersecurity Mandates and Regulations stipulate that federal owned data must reside in a FedRAMP Certified Cloud System in compliance of DHS 4300.

The SOO at 24, § 4.4.1 states that “the contractor shall” “Develop, Test, and Deploy software meeting FEMA and NFIP Direct standards. All source code will reside within a DHS/FEMA owned and approved repository.” (Emphasis added.) Will the Agency please explain the purpose and rationale of this requirement? SOO p.23-25; RFP p.26-34, p.34-41, p.94-96

SOO - 4.4.1 - Security and Privacy Compliance, entire section;

RFP - C.3 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services, entire section;

RFP - C.4 52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders - Commercial Products and Commercial Services, entire section;

RFP - E10. Proposal Instructions, Evaluation and Basis for Award, FAR 52.212-2, Evaluation - Commercial Items, entire section SOO Section 4.4.1 Security and Privacy has been revised to include only security and privacy requirements.

The SOO states: “All source code will reside within a DHS/FEMA owned and approved repository.” SOO at 24, § 4.4.1. As explained above, this provision is inconsistent with commercial practice. In the rare instance that source code is required under a contract, that source code typically will be held in escrow and subject to disclosure under the terms of an agreed-upon escrow agreement. If the Agency determines that the requirement to provide source code is still necessary or appropriate – despite being inapposite to customary commercial practice – will the Agency allow the source code to be provided via escrow and subject to disclosure only in accordance with the terms of the escrow agreement? SOO p.23-25; RFP p.26-34, p.34-41, p.94-96

SOO - 4.4.1 - Security and Privacy Compliance, entire section;

RFP - C.3 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services, entire section;

RFP - C.4 52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders - Commercial Products and Commercial Services, entire section;

RFP - E10. Proposal Instructions, Evaluation and Basis for Award, FAR 52.212-2, Evaluation - Commercial Items, entire section Yes, except for any software developed under contractual direction specifically for FEMA as a FEMA product.

The SOO states: “All deployments will obtain FEMA OCIO Change Advisory Board (CAB) approval. The information system security officer (ISSO) must review and agree to all changes and deployments. The NFIP Direct system owner has the final approval for all users added to the system and all changes within the entire environment from adding new servers, upgrading software, deploying code into production and other changes especially in production.” SOO at 24, § 4.4.1. This provision, which would give the Government control over upgrades and changes to a proprietary software developed at private expense and available in the commercial marketplace, is inconsistent with a commercial items procurement. Commercial software is regularly upgraded and patched in accordance with commercial best practice to ensure functionality and maintenance of the software across all clients. It is unreasonable to expect that all updates, patches, back-up, etc. would be at the discretion of FEMA given the use of the software across public and private sector entities. Given that this is a commercial items procurement, and the FAR requires the Government to only include requirements in such procurements that are “consistent with commercial practice,” will the Agency please remove this requirement? SOO p.23-25; RFP p.26-34, p.34-41, p.94-96

SOO - 4.4.1 - Security and Privacy Compliance, entire section;

RFP - C.3 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services, entire section;

RFP - C.4 52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders - Commercial Products and Commercial Services, entire section;

RFP - E10. Proposal Instructions, Evaluation and Basis for Award, FAR 52.212-2, Evaluation - Commercial Items, entire section SOO Section 4.4.1 Security and Privacy has been revised to include only security and privacy requirements.

The SOO states: “All deployments will obtain FEMA OCIO Change Advisory Board (CAB) approval. The information system security officer (ISSO) must review and agree to all changes and deployments. The NFIP Direct system owner has the final approval for all users added to the system and all changes within the entire environment from adding new servers, upgrading software, deploying code into production and other changes especially in production.” SOO at 24, § 4.4.1. This requirement will prevent or substantially delay the contractor from making routine changes and enhancements to its system to support performance requirements, including those laid out in the SLA. Given that this requirement will hinder the contractor in meeting its performance obligations under the contract, will the Agency consider removing this requirement? SOO p.23-25; RFP p.26-34, p.34-41, p.94-96

SOO - 4.4.1 - Security and Privacy Compliance, entire section;

RFP - C.3 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services;

RFP - C.4 52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders - Commercial Products and Commercial Services;

RFP - E10. Proposal Instructions, Evaluation and Basis for Award, FAR 52.212-2, Evaluation - Commercial Items, entire section SOO Section 4.4.1 Security and Privacy has been revised to include only security and privacy requirements.

The SOO states: “the contractor shall: . . . [provide documentation, including] Standard Operating Procedures including but not limited to: Access management, vulnerability and patch management, user recertification, database backup, separation of duties, etc.” SOO at 25 at § 4.4.1. In the deliverables, ATO documentation is required, including “database backup.” SOO at 49 at § 6.2. This information would provide the Agency the ability to “restore” the proprietary and privately developed solution provided by the contractor. Providing this information to FEMA would be akin to supplying the contractor’s entire proprietary system to FEMA. This is clearly not consistent with commercial practice and must be removed from the requirements. Will FEMA remove this requirement? SOO p.24, p. 25, p.49; RFP p.26-34, p.34-41, p.94-96

SOO - 4.4.1 - Security and Privacy Compliance, 5.The Government will....;

SOO - 6.2 Deliverables Chart-ATO Documentation;

RFP - C.3 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services;

RFP - C.4 52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders - Commercial Products and Commercial Services;

RFP - E10. Proposal Instructions, Evaluation and Basis for Award, FAR 52.212-2, Evaluation - Commercial Items, entire section

FEMA will not remove this requirement. FEMA requires review of procedures and supporting documentation to ensure the cybersecurity of the system. It is a vital part for FEMA security management for any solution.

The SOO states: “the contractor shall: . . . [provide documentation, including] Standard Operating Procedures including but not limited to: Access management, vulnerability and patch management, user recertification, database backup, separation of duties, etc.” SOO at 25 at § 4.4.1. In the deliverables, ATO documentation is required, including “database backup.” SOO at 49 at § 6.2. If FEMA will not remove the requirement (because it is inconsistent with commercial practice), will FEMA clarify what backup it intends to be provided as part of the documentation? SOO p.24, p.25, p.49; RFP p.26-34, p.34-41, p.94-96

SOO - 4.4.1 - Security and Privacy Compliance, 5.The Government will....;

SOO - 6.2 Deliverables Chart-ATO Documentation;

RFP - C.3 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services;

RFP - C.4 52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders - Commercial Products and Commercial Services;

RFP - E10. Proposal Instructions, Evaluation and Basis for Award, FAR 52.212-2, Evaluation - Commercial Items, entire section

SOO Section 4.4.1 Security and Privacy has been revised to include only security and privacy requirements. Review of SOP’s, database backup, separation of duties, etc remain as a vital part of security assessment, maintenance, and contingency planning. The backups must address Federally mandated Continuity Of Operations and Disaster Recovery (DR) requirement; effective backup, data recovery, and contingency planning is part of the security management process.

The SOO states: “the solution is yet to be determined and will be bu[i]lt on the FEMA Moderate level platform.” SOO at 24, §

4.4.1. This procurement is for commercial items under FAR Part 12. RFP at 26-34, 94, §§ C, E10. A commercial item is a product or a service that is customarily used by the general public or available to nongovernmental entities for nongovernmental purposes. FAR 2.101. Here, the SOO appears to require the delivery of a custom-built database for FEMA.

SOO at 50, § 6.2. Given that building a custom solution isn’t consistent with procuring a commercial item, would the Government remove the tasks related to building the database from this commercial item solicitation? Given that the new build is not a commercial item, shouldn’t these requirements be solicited under a separate statement of work with a pricing mechanism consistent with FEMA’s custom database requirements? SOO p.24, p.50; RFP p.26-34 p.34-41, p.94-96

SOO - 4.4.1 - Security and Privacy Compliance, entire section;

SOO - 6.2 - Deliverables Chart; NFIP Direct System Database;

RFP - C.3 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services, entire section;

RFP - C.4 52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders - Commercial Products and Commercial Services, entire section;

RFP - E10. Proposal Instructions, Evaluation and Basis for Award, FAR 52.212-2, Evaluation - Commercial Items, entire section

Neither SOO Section 4.4.1 nor the RFP in general contains requirements to build a custom solution. Further, SOO Section 4.4.1 Security and Privacy has been revised to include only security and privacy requirements.

The SOO states: “the solution is yet to be determined and will be bu[i]lt on the FEMA Moderate level platform.” SOO at 24, §

4.4.1. Can the Agency clarify what solution “is yet to be determined” and built within the FEMA environment? SOO p.24, RFP p.26-34, p.34-41, p.94-96

SOO - 4.4.1 - Security and Privacy Compliance, entire section;

RFP - C.3 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services, entire section;

RFP - C.4 52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders - Commercial Products and Commercial Services, entire section RFP - E10. Proposal Instructions, Evaluation and Basis for Award, FAR 52.212-2, Evaluation - Commercial Items, entire section SOO Section 4.4.1 Security and Privacy has been revised to include only security and privacy requirements

The SOO states: “The Contractor shall create a database to contain all the NFIP Direct IT System’s data to be hosted in the FEMA Enterprise Cloud.” SOO at 25, § 4.4.3. Does FEMA intend for the contractor to develop a new solution to meet this requirement? If so, can FEMA provide the requirements for this new solution and allow for Contractors to properly evaluate scope and cost under a separate CLIN structure? SOO p.25 SOO - 4.4.3 - Direct System Database and Repository, First BulletSection 4.4.3 has been revised to clarify the government intent.

The SOO requires “[t]he proposed cloud solution [to be] FedRAMP certified.” SOO at 86, § IX. The SOO also requires that the database and document repository be hosted in the FEMA Enterprise Cloud. SOO at 25, § 4.4.3. Why must the database and document repository be hosted in the FEMA Enterprise Cloud if the solution already must be hosted on a FedRAMP-certified platform? SOO p.25, p.86

SOO - 4.4.3 - Direct System Database and Document Repository; entire section;

SOO - IX. FedRAMP Certified Language, First Bullet Section 4.4.3 has been revised to clarify the government intent.

The SOO states: “The Contractor shall create a database to contain all the NFIP Direct IT System’s data to be hosted in the FEMA Enterprise Cloud.” SOO at 25, § 4.4.3. Does FEMA intend for the contractor to develop a new solution to meet this requirement? If so, will FEMA be sponsoring the necessary ATOs and funding the development of the database? SOO p.25; RFP p.26-34, p.34-41

SOO - 4.4.3 - Direct System Database and Document Repository; entire section;

RFP - C.3 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services, entire section;

RFP - C.4 52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders - Commercial Products and Commercial Services

FEMA anticipates the Contractor shall create a database to contain a copy of all the NFIP Direct structured data including metadata necessary to establish relationships among the data provided database, not to include applications/reports that comprise NFIP Direct. This activity will be implemented under CLIN 0005 with monthly outputs as a recurring activity. The Government will sponsor the necessary ATO activities.

The SOO states: “The Contractor shall create a database to contain all the NFIP Direct IT System’s data to be hosted in the FEMA Enterprise Cloud.” SOO at 25, § 4.4.3. Does the awarded contractor need to be able to administer NFIP Direct program and covered policies on Day One of performance in addition to supporting the new requirements (e.g., “create a database”) in the SOO? SOO p.25; RFP p.26-34, p.34-41

SOO - 4.4.3 - Direct System Database and Document Repository; entire section;

RFP - C.3 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services, entire section;

RFP - C.4 52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders - Commercial Products and Commercial Services, entire section

The database to be created under SOO section 4.4.3 is identified with a “TBD” date in section SOO section 6.2 for the contractor and government to develop a plan based on the proposed solution.

The SOO states: “The contractor shall provide all the application services to process the NFIP Direct data as a contractor resource accessing the Government owned data.” SOO at 26, § 4.4.4. If the government also has access to the data via SOO at 25 § 4.4.2 (“The Government shall have access to the data at all times.”), can the Agency please explain why the provision in § 4.4.4 is necessary and what its objective is? SOO p.25-26; RFP p.26-34, p.34-41, p.94-96

SOO - 4.4.2 - Data Containers, entire section;

SOO - 4.4.4 - Application Services, entire section;

RFP - C.3 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services;

RFP - C.4 52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders - Commercial Products and Commercial Services;

RFP - E10. Proposal Instructions, Evaluation and Basis for Award, FAR 52.212-2, Evaluation - Commercial Items, entire section Section 4.4.4 has been deleted from the SOO.

The SOO states: “The contractor shall provide all the application services to process the NFIP Direct data as a contractor resource accessing the Government owned data.” SOO at 26, § 4.4.4. Can the Agency please explain what it means when it references “a contractor resource”? Is the “contractor resource” the NFIP Direct contractor or does it also encompass other FEMA contractors? SOO p.26 SOO - 4.4.4 - Application Services Section 4.4.4 has been deleted from the SOO.

The SOO states: “The contractor shall provide all the application services to process the NFIP Direct data as a contractor resource accessing the Government owned data.” SOO at 26, § 4.4.4. Can the Agency please explain what it means by “application services”? SOO p.26 SOO - 4.4.4 - Application Services Section 4.4.4 has been deleted from the SOO.

The SOO states that the Contractor shall "[e]stablish an approach for re-inspecting and re-examining claims, and after FEMA approval, implement the approach." SOO at 28, §4.6.1.1. Can FEMA please explain further as to how this requirement is different from the re-inspections that the General Standard Operations Contractor would perform? SOO p.28

SOO - 4.6.1.1 - Flood Insurance Claim Office (FICO) Operations, Claims 4th Bullet from the bottom

This requirement may be necessary and would be internal. It is separate from the normal Standard Operations General Adjuster reinspection.

Additional information can be found in SOO Section 4.6.1.1.

The SOO requires the contractor, during transition-out, to “[c]onduct detailed overview sessions as needed to provide visibility and insight into the Architecture (Infrastructure/Data/Applications etc.) and business processes that accompany it.”

SOO at 31, § 4.10. It also requires the contractor to “provide FEMA with all data, data files, audit trails, back-ups, electronic imagery, microform, and hard copy forms received, produced, and maintained throughout the life of the contract, along with specifications, documentation, and assistance to assure timely and unfettered access and use by FEMA and successor.” Given that this is a commercial items procurement, and the contractor will be providing a proprietary solution developed at private expense, can FEMA please remove these requirements, which require the contractor to disclose confidential, business proprietary information about the contractor’s privately developed solution? SOO p.31; RFP p.26-34, p.34-41, p.94-96

SOO - 4.10 - Transition Out, Reporting, entire section;

RFP - C.3 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services;

RFP - C.4 52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders - Commercial Products and Commercial Services;

RFP - E10. Proposal Instructions, Evaluation and Basis for Award, FAR 52.212-2, Evaluation - Commercial Items, entire section

SOO Section 4.10 imply no requirement to violate the contractor’s proprietary solution’s architecture, describes government assets created or provided under contract in performance of the contract and as such shall be provided back to the government as part of transition out. Metadata, i.e., data describing data is also included in this list.

The SOO states the contractor shall “[p]rovide FEMA personnel training on all applicable IT solution(s) prior to the transition of operations from the incumbent contractor, including, but not limited to, policy administration system and contact center system.” SOO at 32, § 4.10. By training FEMA personnel on the system, including, but not limited to, the enumerated items, the FEMA personnel would have access to proprietary system information that was developed at private expense which is inconsistent with commercial practice. In addition, the contractor is transitioning out from performance of the contract so it is not clear why FEMA would need training on a system no longer in use. Given that the contractor, and its commercial, proprietary system, are transitioning out from performance, can FEMA please clarify why it is necessary to train FEMA personnel, including by providing them with proprietary information about the system during transition-out? SOO p.32; RFP p.26-34, p.34-41, p.94-96

SOO - 4.10 - Transition Out, IT Continuity During Transition, entire section;

RFP - C.3 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services;

RFP - C.4 52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders - Commercial Products and Commercial Services;

RFP - E10. Proposal Instructions, Evaluation and Basis for Award, FAR 52.212-2, Evaluation - Commercial Items, entire section The requirement has been deleted from SOO Section 4.10.

In the SOO ¶ 5.0 (pages 32-43), under “Incentive/Disincentive,” the SOO states more than 20 times that “[t]he Government may enact a 10% invoice payment deduction in the event the contractor fails to meet the AQL.” The proposed invoice payment deductions of 10% are an improper penalty akin to liquidated damages that could cause (if implemented multiple times) the contractor to have pay more to the Government than the contract price it receives from the Government. The Government requirement is improper for a Commercial Items contract, is not “consistent with customary commercial practice,” and should not be required here. Will the Government withdraw this provision, or substantially reduce the possible invoice payment deductions and the number of times such an invoice payment deduction can be used against the contractor, provide a cap on the payment deduction, and require the failure to be material and allow for a cure period? SOO p.32-43; QASP p.8-18; RFP p.26-34, p.34-41, p.9

SOO - 5.0 - Performance Requirements, entire section;

QASP Appendix A, entire section;

RFP - C.3 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services;

RFP - C.4 52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders - Commercial Products and Commercial Services;

RFP - E10. Proposal Instructions, Evaluation and Basis for Award, FAR 52.212-2, Evaluation - Commercial Items, entire section Removed and replaced in accordance with FAR 52.212-4.

The financial control plan states a Proof of Loss (“POL”) is required to be accepted or rejected within 10 business days, the examiner completes the claim file examination within 7 business days upon receipt of the closing report, and payment is required to be issued within 7 business days from completion of claim file examination. SOO at 35, § 5.0. The performance requirement (1F) states the performance standard is claims check to be mailed within 7 business days from adjustment and examination completion. The AQL for this performance requirement states payment must be mailed 7 business days after receipt of the signed POL, but that doesn’t align with the financial control plan, or the description in this Performance Standard which states that checks must be mailed within 7 business days of "adjustment and examination completion." In addition, the AQL references both average claims check and claims check mailed standard. Can FEMA please clarify the AQL? SOO p.35 SOO - 5.0 - Performance Requirements, Timeliness, 1f

All entities would fall in line with each other. The POL would be a part of the closing report and therefore a part of the completion of the claim file examination. The current process will remain the same.

The SOO performance requirements for Monthly UW/Claims Audit do not include information on the manner in which they will be performed, or the tools that will be used. SOO at 36-37, § 5.0. Will the monthly FEMA audits be performed in the same manner and utilize the same tools as the Operational Review , which allows for responses and acceptance of rebuttals? SOO p.36-37; QASP p.12

SOO - 5.0 - Performance Requirements, Quality of Claims Service, Monthly Review;

QASP Appendix A, Performance Requirements, Satisfactory Review of Claims, Monthly The process and tools will remain the same.

The SOO performance requirements state: “85% of the total number of calls offered on a (daily, weekly, monthly, and yearly basis) should be answered by a live representative.” SOO at 39-40, § 5.0, Customer Experience and Agency Services, 5c1 (Call Center Operations) and 5d1 (Agency Services). Is this service level calculated on a monthly average, or each day, week, month and year? Will FEMA please clarify the requirement? SOO p.39-40, QASP p.14-16

SOO - 5.0 - Performance Requirements, Customer Experience and Agency Services, 5c1;

SOO - 5.0 - Performance Requirements, Customer Experience and Agency Services, 5d1;

QASP Appendix A, Customer Experience and Agency Services, 5c1;

QASP Appendix A, Customer Experience and Agency Services, 5d1

The service level agreement is calculated each day, each week, each month and each year separately and must average 85% of the total number of calls offered and should be answered by a live representative for each of those periods of time.

The SOO performance requirements state: “85% of the total number of calls offered on a (daily, weekly, monthly, and yearly basis) should be answered by a live representative.” SOO at 39-40, § 5.0, Customer Experience and Agency Services, 5c1 (Call Center Operations) and 5d1 (Agency Services). The requirements do not explain the period of time over which these requirements will be measured. Will FEMA consider removing the 30 second requirement to make the performance standard consistent with the proposed calculation? SOO p.39-40; QASP p.14-16

SOO - 5.0 - Performance Requirements, Customer Experience and Agency Services, 5c1;

SOO - 5.0 - Performance Requirements, Customer Experience and Agency Services, 5d1;

QASP Appendix A, Customer Experience and Agency Services, 5c1;

QASP Appendix A, Customer Experience and Agency Services, 5d1 FEMA will not remove this requirement.

The SOO performance requirements state: “No more than 5% of the total number of calls offered on a (daily, weekly, monthly and yearly basis) should be abandoned.” SOO at 39, § 5.0, Customer Experience and Agency Services, 5c2 (Call Center Operations) and 5d2 (Agency Services). Is this service level calculated on a monthly average or each day, week, month and year? SOO p.39-41, QASP p.14-16

SOO - 5.0 - Performance Requirements, Customer Experience and Agency Services, 5c2.Call Center Operations;

SOO - 5.0 - Performance Requirements, Customer Experience and Agency Services, 5d2.Agency Services;

QASP Appendix A, Customer Experience and Agency Services, 5c2. Call Center Operations;

QASP Appendix A, Customer Experience and Agency Services, 5d2. Agency Services This service level is calculated each day, each week, each month and each year separately.

The SOO performance requirements include a requirement related to calls answered by live representatives and not abandoned. SOO at 39, § 5.0, Customer Experience and Agency Services, 5c2 (Call Center Operations) and 5d2 (Agency Services). Are “short calls” (calls that hang up in the first 20 seconds) included in this calculation? SOO p.39-41, QASP p.14-16

SOO - 5.0 - Performance Requirements, Customer Experience and Agency Services, 5c2.Call Center Operations;

SOO - 5.0 - Performance Requirements, Customer Experience and Agency Services, 5d2.Agency Services;

QASP Appendix A, Customer Experience and Agency Services, 5c2. Call Center Operations;

QASP Appendix A, Customer Experience and Agency Services, 5d2. Agency Services No, they are not included in this calculation.

The SOO performance requirements have two calculations for call abandonment rates. SOO at 39-41, § 5.0, Customer Experience and Agency Services, 5c2 (Call Center Operations) and 5d2 (Agency Services). What is the calculation to be used for purposes of determining whether the Acceptable Quality Level was met or fulfilled? SOO p.39-41, QASP p.14-16

SOO - 5.0 - Performance Requirements, Customer Experience and Agency Services, 5c2.Call Center Operations;

SOO - 5.0 - Performance Requirements, Customer Experience and Agency Services, 5d2.Agency Services;

QASP Appendix A, Customer Experience and Agency Services, 5c2. Call Center Operations;

QASP Appendix A, Customer Experience and Agency Services, 5d2. Agency Services

No more than 5% of the total number of calls offered on each day, each week, each month and each year, should be abandoned. That calculation should be used for both Call Center and Agency Services calls. Each section will be calculated separately to ensure the AQL is met or fulfilled.

The SOO performance requirements mandate that “[a]ll voicemails and emails are responded to within 3 business days.”

SOO at 39 & 41, § 5.0. Will FEMA consider an average of 3 business days? It is unreasonable that the contractor could miss just one email or voicemail in an entire month and be subject to a penalty. SOO p.39, p.41; QASP p.14, p.16

SOO - 5.0 - Performance Requirements, Customer Experience and Agency Services, 5b.Customer Communications, 3);

SOO - 5.0 - Performance Requirements, Customer Experience and Agency Services, 5d.Agency Services, 3);

QASP Appendix A, Customer Experience and Agency Services, 5b.Customer Communications, 3);

QASP Appendix A, Customer Experience and Agency Services, 5d.Agency Services, 3) FEMA will not consider an average of 3 business days.

The SOO performance requirements contain three requirements for Administrative Paperwork, Deliverables, and Work Products that require “complete, accurate, and timely” submission of 98% of requirements. SOO at 42-43, § 5.0. Will FEMA please define “Work Products?” SOO p.42-43; QASP p.17-18

SOO - 5.0 - Performance Requirements, Administrative Paperwork, Deliverables, Work Product;

QASP Appendix A, Performance Requirements, Administrative Paperwork, Deliverables, Work Product “Work Product” shall mean all materials, data, documents, presentations and reports.

The SOO performance requirements contain three requirements for Administrative Paperwork, Deliverables, and Work Products that require “complete, accurate, and timely” submission of 98% of requirements. SOO at 42-43, § 5.0. What is the calculation that will be used to determine the Acceptable Quality Level for these three performance requirements? For example, the method of surveillance is stated as “periodic surveillance.” If the Agency is only examining a portion of the Administrative Paperwork, Deliverables, and Work Products, how will the review be conducted in a manner that ensures the 98% is calculated fairly and not unduly weighted to target submissions that do not meet the 98% standard? SOO p.42-43; QASP p.17-18

SOO - 5.0 - Performance Requirements, Administrative Paperwork, Deliverables, Work Product;

QASP Appendix A, Performance Requirements, Administrative Paperwork, Deliverables, Work Product

The Government will conduct periodic surveillance. Based on those results, the Government may conduct additional surveillance for a fair assessment.

FEMA has 15 days to receive deliverables and request corrections/adjustments and the Contractor will have 3 business days to make any requested corrections or adjustments. SOO at 44, § 6.0. The QASP states that the Contractor will have five business days to make requested corrections or adjustments. QASP at 7. Will FEMA confirm that the Contractor has five business days to make the requested corrections or adjustments? SOO p.44; QASP p.7

SOO - 6.0 - Deliverables;

QASP 8.Inspection of Deliverables The Contractor will have 3 business days to make the request corrections or adjustments. QASP has been updated.

The SOO deliverables require a “[s]ummary of all employees by business area and location. Changes and updates must be highlighted.” SOO at 52, § 6.0. This requirement conflicts with the fact that this is a Firm Fixed Price Contract whereby the contractor bears the risk for failing to perform at its proposed cost and the contract price is not subject to adjustment. FAR 16.202-1. As a result, it is not clear why FEMA would need to know the details of employees’ business area and location.

Will FEMA remove this deliverable? SOO p.52 SOO - 6.0 - Deliverables - Staffing Summary FEMA will not remove this deliverable.

The SOO states: “The Contractor shall not perform services or support to both the NFIP Direct and any Write Your Own Company concurrently.” SOO at 53, § 7.1. This conflicts with the nature of a commercial items procurement. Commercial companies competing for this work naturally perform similar services in the commercial space, including for Write Your Own companies. Can FEMA please remove this requirement? SOO p.53 SOO - 7.1 - Personnel Requirements - last Bullet

FEMA will not remove this requirement. FEMA is updating the statement in the SOO to - The Contractor shall not have the same personnel perform services or support to both the NFIP Direct and any Write Your Own Company concurrently.

The SOO states: “The Contractor shall not perform services or support to both the NFIP Direct and any Write Your Own Company concurrently.” SOO at 53, § 7.1. To the extent FEMA retains this requirement, can FEMA clarify whether this requirement means that the contractor may not perform any WYO company work or whether the contractor must internally segregate its work for WYOs and NFIP Direct? For example, while companies may be able to segregate some employees easily (i.e., claims), it will be very difficult and not cost-effective to segregate all employees and personnel that perform services for FEMA from any WYO work (i.e., IT support, corporate and administrative functions, etc.). Can FEMA clarify the extent of the limitation on performing services or support for both NFIP Direct and WYO? SOO p.53 SOO - 7.1 - Personnel Requirements - last Bullet

The Contractor should internally segregate its work and employees for the NFIP Direct and WYOs accordingly. FEMA is updating the statement in the SOO to - The Contractor shall not have the same personnel perform services or support to both the NFIP Direct and any Write Your Own Company concurrently.

The SOO states that FEMA requires at least 7 calendar days to provide notice should an employee leave employment, with an additional 21 days to provide a replacement resume for Key Personnel. SOO at 53, § 7.2. A total of 28 days is not enough time to collect resumes, conduct interviews and the required background checks, hire and onboard Key Personnel, especially for the very specific and unique context of the NFIP Direct…