Final Questions_Answers for DHS Privacy Office - FWaaS_20200813.pdf

# Reference RFP Section Paragraph No. Page No.(s) Question Answer

SECTION ONE

1 Attachment A

1.0 Pricing

Schedule 6

The structure of Contract Line Item Numbers (CLINs) has 4 labor categories: Project Management (PMP), Technical Architect, Technical SME, and Sr. Developer. Does this limit the quanity of staff to 4 total? Yes

2 Attachment A

1.0 Pricing

Schedule 6

The structure of Contract Line Item Numbers (CLINs) has 4 labor categories: Project Management (PMP), Technical Architect, Technical SME, and Sr. Developer. Can the offeror propose a different mixture of labor to achieve the goals of the FWaaS program? For example, could an offeror have .5 Project Management, .5 Technical Architects, 1 Technical SME, and 2 Sr. Developers. No. Contractors are required to respond IAW the RFP.

3 Attachment A

1.0 Pricing

Schedule 6

The structure of Contract Line Item Numbers (CLINs) has 4 labor categories: Project Management (PMP), Technical Architect, Technical SME, and Sr. Developer. If the offeror wants to include a training specialist, may the offeror propose new labor categories? If not, how should the offeror include such a labor resource in the CLINs (e.g., include in the Project Management CLIN)? See response to question #6 above.

4 Attachment A

1.0 Pricing

Schedule 8

There is a note stating "*Personnel are equal to a Full Time Equivalent (FTE) of 1,920 labor hours". Which CLINs does this note apply to? This applies to all labor categories CLINS (0003 - 0006).

5 1.1 Objective 1.1 Objective 12

The Solicitation states, "In addition, the Contractor shall provide project management, data migration and integration activities, and help desk support." How does help desk support map to the CLIN structure? The Technical SME addresses the helpdesk support CLIN structure.

6 1.2 Scope 1.2 Scope 12

The Solicitation states, "The Contractor shall provide a SaaS solution hosted in a FedRAMP authorized cloud provider." Is DHS seeking a true SaaS solution that does not require the use of an Infrastructure as a Service (IaaS) solution? Is there a benefit to DHS to proposing a pure SaaS solution?

No, there is no benefit to DHS proposing a pure SaaS solution because we aren’t seeking a “true SaaS” solution necessarily.

7 1.2 Scope 1.2 Scope 12

The Solicitation states, "The Contractor shall provide a SaaS solution hosted in a FedRAMP authorized cloud provider." Does the SaaS solution itself need to be authorized by FedRAMP by time of proposal submission? If not, then when must the FedRAMP certification be achieved?

The solution would also need to be FedRAMP since it is offered as a packaged solution (I.e. if SaaS then yes it has to be FedRAMP in addition to any provider.

8 1.2 Scope 1.2 Scope 12

The Solicitation states, "The Contractor shall provide a SaaS solution hosted in a FedRAMP authorized cloud provider." Does DHS consider a SaaS solution to be FedRAMP certified if it leverages an Infrastructure as a Service (IaaS) solution cloud provider to be FedRAMP certified? Does the offeror solution need to be FedRAMP certified as a SaaS?

The solution would also need to be FedRAMP since it is offered as a packaged solution (I.e. if SaaS then yes it has to be FedRAMP in addition to any provider.

9 1.3 Background 1.3 Background 12

The Solicitation states, "In addition to the privacy-related mission, it is responsible for DHS-wide disclosure policy development, training, and FOIA processing for senior-level headquarters offices." Would it be of value to DHS if an offeror's solution can also provide a knowledge base to share policy throughout the FOIA and PA stakeholder community? No

10 1.3 Background 1.3 Background 12

The Solicitation states, "In addition to the privacy-related mission, it is responsible for DHS-wide disclosure policy development, training, and FOIA processing for senior-level headquarters offices." Would it be of value to DHS if an offeror's solution can also provide a training system to enable the FOIA and PA stakeholder community? No

11 1.3 Background 1.3 Background 12

The Solicitation states, "The service needs to support: • Configuration to meet specific PRIV needs..." How will DHS discern whether the solution meets the configurability requirement?

DHS will discern whether the solution meets the ease of use requirement by User Acceptance Testing (UAT).

12 1.3 Background 1.3 Background 12

The Solicitation states, "The service needs to support: • Ease of use to ensure rapid and consistent adoption by personnel..." How will DHS discern whether the solution meets the ease of use requirement? DHS will discern whether the solution meets the ease of use requirement by (UAT).

13 2.1.2 Data Exchange 2.1.2.1.10 14

The Solicitation states, "Decryption: During auto load process, the system shall automatically decrypt encrypted files (i.e. route file paths to separate server where password cracker system resides)." Please provide more details on the technical and functional specifications of the password cracker system that DHS will use (e.g., where will the password cracker system reside? What data protocols are used to connect to the password cracker system?). If documentation exists on the password cracker system, will DHS share this information with offerors to allow us to address this requirement? The system should be able to route password enabled files to a government defined server.

14 2.1.8.4 General Document and File Review 2.1.8.4.6 22

The Solicitation states, "Web-Based Application: The system shall have web-based document review. This review shall be available without the need to download and install client system or agent (an exception to this requirement is made for the off-line review functionality specified in section 10.1.7)." Please clarify what the reference to "section 10.1.7" is related to. Please disregard section 10.1.7 it was written in error. Please refer to section 2.1.8.4.7.

15 2.1.8.4 General Document and File Review 2.1.8.4.7 22

The Solicitation states, "Off-Line Document Review: The system shall allow documents and objects subject to review to be downloaded for offline review." Will a mobile application with offlne capability be sufficient to meet this requirement? The real requirement is to download pdfs. This can be done without using a mobile device.

16 2.1.10.8 IT Security 2.1.10.8 29

The Solicitation states, "The system shall be capable of conforming to the NIST 800-53 “Moderate” security requirement." Is DHS interested in an option to store NIST 800-53 "High" security requirement FOIA requests?

Yes, DHS is interested in an option to store NIST 800-53 high security requirement FOIA requests.

However, this is not a real requirement.

17 2.1.10.15 Training 2.1.10.15 31

The Solicitation states, "The offeror shall provide an onsite or web-based training and a user guide to all users in using the system to its full capabilities. This training will be in compliance with DHS technical standards for online training solution." Please provide references to DHS technical standards for online training solutions.

DHS is open to online training solutions such as virtual training as long as it is conforms to DHS' operating system standard and is 508 Compliant.

SECTION TWO

ATTACHMENT A

SECTION I – SCHEDULE B N/A 6

Did DHS perform an indepedent cost estimate based on the four labor CLINS 0003-0006? Yes

ATTACHMENT A

SECTION I – SCHEDULE B N/A 6

The structure of Contract Line Item Numbers (CLINs) has 4 labor categories: Project Management (PMP), Technical Architect, Technical SME, and Sr. Developer. Does this limit the quanity of staff to 4 total? Yes

ATTACHMENT A

SECTION I – SCHEDULE B N/A 6

Can offerors propose a different labor mix to achieve the program objectives? No

4 SECTION II – STATEMENT OF WORK N/A N/A

Can DHS specify what features are required for initial operating capability versus nice to have and/or future?

The requirement is SaaS because DHS does not want to build our own system. DHS wants a system that has everything in it already

5 SUBMISSION REQUIREMENTS 2 86

Can DHS please extend the proposal submission due date by 2 weeks in order to allow respondents to clarify their proposals based on the Q&A that is published after 8/12?

The proposals due date has been extended to August 25, 2020 by 4pm.

6 2.1.2.1.3 Data Ingestion and Processing N/A 14

How long does DHS expect it to take the vendor to reach final operating capacity? "The system shall be able to be used by end-users no later than five business days after final operating capability."

The system shall be able to be used by end-users no later than five business days after final operating capability.

7 2.1.2.1.6 Loading metadata values: N/A 14 What Metadata values need to be extracted and loaded?

The Metadata values that should be extracted and loaded is the Metadata from the originating documents that is being searched.

2.1.5.1 Migrate legacy data (~10 Terabytes of

FOIA data and stored responsive records and history). N/A 16 What software platform is the legacy system based upon? The legacy system the software platform is based on is Windows Server 2016.

9 2.1.7.6.2 System Interfaces N/A 19 Should the vendor assume that files must be scanned for viruses BEFORE upload into the system? Yes

10 2.1.7.6 System Interfaces N/A 19 Do requests need to go through the DHS TIC? Requests for DHS users must go through a TIC. This is not required for the public.

11 2.1.10.15 Training 2 31 What are the DHS Training standards that the offeror must comply with?

DHS is open to online training solutions such as virtual training as long as it is conforms to DHS' operating system standard and is 508 Compliant.

12 2.3.12 Patch Management Terms and Conditio 4 35

Software as a service does not allow contractors to install patches as directed by DHS. SaaS is a pre-built solution. Is DHS looking for a PaaS or IaaS solution?

The requirement is SaaS because DHS does not want to build our own system. DHS wants a system that has everything in it already.

13 2.3.13 Log Retention Terms and Conditions 5 35

The SOW indicates that Logs must be retained offline for three years.

Does DHS have a preferred storage location at DHS for these files (e.g.

SIEM) or should the offeror assume these logs files are stored by the offeror in a location proposed by the offeror? DHS will store the files/data.

14 2.4.4.12.3 2 53 Does the solution need to integrate with DHS's SIEM to facilitate centralized incident response? Yes

15 3 Deliverables N/A 60

The deliverables table indicates that help desk IT Help Desk Instruction and System Points of Contacts are due in Month 7 of the contract and System Training Material for end users is due in Month 8. Does DHS anticipate that the system will go-live by the end of month 8 of the contract?

Once the system reaches final operational capability, the system shall be able to be used by end users no later than 5 business days.

SECTION THREE

1 2.1.2.1 Data Ingestion & Processing 2.1.2.1.10 14 Will the government be providing passwords for the de-encryption process?

Yes, DHS will provide an email with a password

2 2.1.7.7 Unique Identifier 2.1.7.7.2 20 Unique identifiers, or Document Control Numbers (DCN), are usually immutable, because changing the value may impact dependencies associated with that record in the database. Since unique identifiers are used for various e-discovery functionality, such as de-duplication, would the government allow a separate identifier field to be editable to meet this requirement?

Yes

3 2.1.8.3 Redaction Tool/Capabilities 2.1.8.3.4 21 Could the government clarify whether the file size of 1KB to 2TB applies to a single file or a group of files?

This applies to either single or group of files

4 2.1.10.4 Audit Trails 2.1.10.4.6 27 Section 2.1.10.4.6 Audit Trails on page 27 indicates a requirement to process a file ranging in size from several KB to 500GB. This range differs from the range provided in section 2.1.8.3.4 on page 21 of 1KB to 2TB. Could the government please clarify which file size is correct?

The file size should have the ability to upload 1KB to 2TB

5 2.1.10.12 Scalability 2.1.10.12 30 Could the government clarify whether the approximate user count is 400 as stated in this paragraph or 500 as stated in Attachment A, Section I - Schedule B? The correct number is 500.

6 2.1.10.13 Scanning 2.1.10.13 30 Could the governement indicate an approximate volume of paper documents (in pages annually) that will need to be scanned into the platform?

No, it is hard to estimate the approximate volume of pages annually. DHS received and processed over 400,00 requests in 2019

7 2.1.10.19 Video and Audio Redaction 2.1.10.19 31 Section “2.1.10.19 Video and Audio Redaction” requires the offeror to provide video and audio redaction capability. Can the government provide an estimate for number of files, file types, and size of files that will need to be processed and/or redacted on a per year basis?

No

8 FAR 52.212-1 Addendum: Instructions to Offero N/A 91 DHS specifies that a complete Business & Pricing volume will include the Cover Letter, signed SF 1449, and signed SF 30 (if applicable). In Attachment A, Section I - Schedule B (p. 6) DHS specifies a set of CLINs for the Pricing Schedule. Will DHS accept additional CLINs proposed by the offeror, as part of total proposed price? No

9 FAR 52.212-5: Contract Terms and Conditions Required to Implement Statutes or Executive Orders-Commercial Items (Jul 2020)

N/A 65 In regard to the FAR parts cited in the subject RFP, specifically, we note that the combination of FAR parts 12 and 13 have an award threshold limitation of either $7 Million or $13 Million (including all options) depending on the conditions under which the RFQ was issued. An award threshold limitation of $7M does not seem likely given the scope of the RFP and its duration, however, upon review of the RFP, there is no mention of any unique condition under which the RFP was issued. We see that the $13M award threshold applies when one of the following conditions exist:

1) the DHS Secretary determines the effort is to be used in support of a contingency operation;

2) to facilitate the defense against or recovery from cyber, nuclear, biological, chemical, or radiological attack;

3) to support a request from the Secretary of State or the Administrator of the United States Agency for International Development to facilitate provision of international disaster assistance;

4) to support response to an emergency or major disaster (such as

COVID-19).

Will the government please indicate if any of the conditions above exist, and if so, if the $13M award threshold is applicable to this RFQ?

There are no unique conditions that exist for this requirement. Therefore, the $13M threshold is not applicable. The government has confidence that the work is outlined in the requirement and is consistent and falls within the FAR. The difference in the cost is the Government will host our own data.

10 SF1449/OF336 CLIN 0004 2 The Unit for this CLIN is EA, however the Units for the Option CLINs for the Technical Architect is MO. Please confirm the Unit of measure for CLIN 0004 is MO. CLIN 0004 should read MO.

11 SF1449/OF336, Attachment A

FAR 52.217-9 Option to Extend the Term of the Contract (Mar 2000)

2 – 8

The SF1449 and Attachment state the period of performance is for one 12-month Base plus four 12-month Option Periods (a total of 60 months).

However, FAR 52.2170-9 states the total duration of the contract including options shall not exceed 36 months. Please confirm the contract is for up to 60 months, with a 6-month option to extend. The contract is for a base period of 12-months with four 12-month optional periods.

12 Evaluation Factors, Factor 4: Price (Volume II)

Factor 4: Price (Volume II) including Discount Terms (Not Rated)

1 93 Factor 4: Price (Volume II) states discount terms will evaluated, and further states “The evaluation will assess the accuracy, completeness, discounts offered and reasonableness. This process involves verification that prices and/or discounts are included for all RFP requirements,…”.

However, the RFP is not based on an existing contract, schedule or price list to which discounts would be applied. Please remove references to discounts from the RFP.

The language as stated in the RFP will remain. The contractors may offer a discount as they deem appropriate.

13 VOLUME II – BUSINESS & PRICING 2 91 Tab B: 1) f) requires offerors to provide an “Award Number”. Please clarify what information offerors need to provide for this item. Please disregard "Award Number" and provide "Solicitation Number".

SECTION FOUR

The Solicitation is for commercial computer software. Under FAR 12.212, “[c]ommercial computer software or commercial computer software documentation shall be acquired under licenses customarily provided to the public to the extent such licenses are consistent with Federal law and otherwise satisfy the Government's needs.” (See also FAR 12.603(c).)

However, this Solicitation includes several terms that are contrary to standard commercial practice, and not necessary for achieving the Government’s contracting goals:

1. Commitment to pay for notifications and credit monitoring. The Solicitation commits the contractor to pay for notifications and credit monitoring for individuals affected by a breach of PII/SSI. (See Sections 2.3.23, 2.4.4.12.4.3.2, and 4.7). This is contrary to typical commercial practice where the data owner, in this case the Government, retains all liability associated with the collection, processing, and storage of its data, including all notification and remediation liability to affected individuals. For example, Maryland law, where this company is located, provides that a company that is only hosting data, in this case the contractor, is only liable for providing the data owner with notification and reasonable assistance in the event of a breach. (See Maryland Code Commercial Law Section 14-3504 – Security Breach.) Would the Government agree to remove these notification and credit monitoring obligations, and just retain the obligations to notify the Government data owner? No

2. Compensating government for releases of PII and SSI. Sections

2.3.23 and 4.7 state that “[t]he Contractor will be required to compensate the Government for any costs associated with mitigating the release of SSI and PII that are caused by the Contractor (to include its employees, subcontractors, and teaming partners), such as reimbursing the Government for credit bureau checks for individuals affected by the release of PII and SSI.” The Solicitation already includes significant and sufficient security and notification protocols (Sections 2.3 and 2.4) to mitigate the Government’s risk, and this requirement is contrary to standard commercial practice where the data owner retains liability for its usage of the contractor’s systems, and each party typically remains liable for only direct breaches of the agreement and their own costs and liabilities. Will the Government consider removing this extraneous indemnification provision? No

a. Does this indemnification provision include indemnification for the Government’s legal fees? No

With regard to sections 2.3.23, 2.4.4.12.4.3.2, and 4.7, one reason the data owner should remain liable for its own data is because it is in the best position to appreciate and limit the data it maintains, thus reducing harm and limiting its own liability.

1. Can the Government please provide an estimate of PII/SSI volume that it will collect, input, process, store, or otherwise use in connection with the contractor’s solution?

No, it is hard to estimate. DHS received and processed over 400,00 requests in 2019.

1 2.3.23, 2.4.4.12.4.3.2, and 4.7 All 39, 54, and

2 2.3.23, 2.4.4.12.4.3.2, and 4.7 All 39, 54, and

2. Can the Government please provide an estimate of the number of potential affected individuals associated with a potential breach of the Government’s solution?

No, it is hard to estimate. DHS received and processed over 400,00 requests in 2019.

3 2.3.23, 2.4.4.12.4.3.2, and 4.7 All 39, 54, and

In light of the substantial risk involved with the Government’s routine use of the solution, and its attempts to shift its liability to the contractor contrary to commercial practice, would the Government consider a cap on potential damages, either at number of affected individuals, or cost per affected individual (including notification and remediation)?

No

The Solicitation does not have any insurance requirements that would cover a potential breach of PII/SSI. Would the Government consider making insurance coverage mandatory for privacy/security breaches? No

4. Would the Government allow for a separate line item for additional insurance to cover the Government’s use? No

5 Clauses: FAR 52.217-9 C 77

On Page 77, the Solicitation incorporates FAR 52.217-9 Option to Extend the Term of the Contract. Section (c) provides that “the total duration if this contract, including the exercise of any options under this clause, shall not exceed 36 months.” Should this be greater than 60 months (one base year, four option years, plus exercise of the extension)? The contract is for a base period of 12-months with four 12-month optional periods

6 N/A N/A N/A

In order to allow the Government ample time to respond to industry questions, and allow industry ample time to review responses and adjust their proposals accordingly, will the Government please consider extending the submission deadline by at least one week?

The proposals due date has been extended to August 25, 2020 by 4pm.

7 2.3.23, 2.4.4.12.4.3.2, and 4.7 All 39, 54, and

In the commercial sector, third-party cloud service providers typically do not agree to the additional liability under Sections 2.3.23, 2.4.4.12.4.3.2, and 4.7. Moreover, Contractors should not be liable for circumstances outside of their control (for instance, breaches of systems they are not physically hosting), absent fraud, negligence, or breach of contract. If the Government decides to host the solution with a third-party cloud service provider (e.g. AWS or Azure), and that third-party does not agree to these provisions as the data host, will the Government agree to waive Contractor’s liability for the same?

No

SECTION FIVE

1 1.2 1 12 of 96 Does the proposed solution need to be FEDRAMP authorized, and is it just the hosting cloud environment that needs to be FEDRAMP authorized, such as AWS's GovCloud? Yes, the solution must be authorized.

2 2.6.8 1 58 of 96 Does the contractor need to be compliant with all Section 508 standards?

Or, in producing an Accessibility Conformance Report (ACR), by using our Voluntary Product Accessiblity Templates (VPAT's); is the contractor able to provide our mitigaton plan for non-compliant Section 508 standards?

Yes

3 N/A N/A N/A Are the requirements for RFP 70RDAD20R00000014 currently being performed on another incumbent contract vehicle(s)?

No. This is not a recompete.

4 N/A N/A N/A If the RFP 70RDAD20R00000014 requirements are currently being performed on an incumbent contract vehicle(s), what is the contract number for the incumbent contract(s)?

n/a

5 N/A N/A N/A If the RFP 70RDAD20R00000014 requirements are currently being performed on an incumbent contract vehicle(s), what is the end date for the incumbent contract(s)?

n/a

6 N/A N/A N/A If the RFP 70RDAD20R00000014 requirements are currently being performed on an incumbent contract vehicle(s), what is the contract value for the incumbent contract(s)?

n/a

7 N/A N/A N/A If the RFP 70RDAD20R00000014 requirements are currently being performed on an incumbent contract vehicle(s), what is the name of the incumbent contractor(s)?

n/a

N/A N/A N/A Is there a specific contractor currently performing the same or similar work? If yes, can you provide me the basic contract details if available No. This is not a recompete.

4 N/A N/A N/A

Sheet1