QATable-FTA_2019-fbo_73351019C0009-REVISED_3.6.19.docx

Fiscal Transfer Agent (FTA) Services for the SBA 7(a) Loan Guaranty Program 2019 73351019C0009

See Deliverable Seven, page 32 of the SOW.

(servers, storage) and licenses costs required to maintain CAFS operational status.

However, any additional hardware and/or software purchases that may be required throughout the life of the contract due to the Contractor’s growth or new Contractor business requirements are the financial responsibility of the Contractor and must be 100% in accordance with existing CAFS architecture.

7. SOW, Section 1, Paragraph 3 - Information Technology Migration and Enhancements, It states “to the extent that the FTA IT requirements cannot be satisfied within the CAFS infrastructure and software suite, the Contractor shall, at its sole expense, acquire the necessary hardware and software to be installed within the CAFS infrastructure environment, and provide for maintenance and support to cover the life of this contract.”

Please confirm whether, consistent with the policy expressed at FAR Part 51.1, the Administration will grant the Fiscal Transfer Agent the authority to utilize procedures such as those described at FAR 51.103 to purchase or license necessary hardware, software, and maintenance and support via government supply sources (e.g., Federal Supply Schedules).

7. For any hardware or software added to the existing CAFS infrastructure, the Contractor shall procure said hardware and software, to include, maintenance and support, to cover the life of the contract at Contractor’s expense through the Contractor’s suppliers.

All hardware and software added to the existing CAFS infrastructure shall be 100% compatible with the existing CAFS infrastructure. In addition, 100% of all added hardware and software shall meet the Government’s specifications, with SBA/OCA being the registered owner. OCA stands for the SBA Office of Capital Access.

8. The reference in the SOW, Section 1, Paragraph 3 - Information Technology Migration and Enhancements, It states to the extent the Contractor is required to acquire hardware and software to be installed within the CAFS infrastructure environment, that the Contractor shall provide, at its sole expense, for maintenance and support “to cover the life of this contract.”

However, the Statement of Work further provides that: Upon the Government’s acceptance of the migration, the Government assumes full responsibility with regards to: 1) hardware purchases (e.g. servers, storage); 2) enterprise software licenses; 3) hardware upgrade schedule; 4) relevant third-party data center costs; 5) Security monitoring; 6) incident response; 7) vulnerability management; 8) patch management; and 9) penetration testing.

Please confirm that, notwithstanding the requirement that the Fiscal Transfer Agent provide, at its own expense, for maintenance and support “to cover the life of this contract” for hardware and software acquired for installation within the CAFS infrastructure environment, such obligations of the Fiscal Transfer Agent will cease upon the Government’s acceptance of the migration of existing SBA FTA software into the CAFS infrastructure.

8. The language stated under pages 2-3 of the SOW is clear and will not be restated.

9. Regarding the language in the SOW, Section 2, Paragraph 20 - Technology, Page 22, “The contractor shall support the CAFS patch management and configuration management processes and procedures to ensure all identified vulnerabilities rated as ‘critical’ and ‘high’ are addressed within 30 days. To include continuous security scanning and periodic penetration testing. Moderate and low vulnerabilities shall also be addressed as part of the regular software release cycle. Contractor shall support the CAFS efforts to integrate the CAFS IT system and corresponding process and procedures with agency patch management, vulnerability management, audit log management and penetration testing services.”

What vulnerability management and continuous monitoring tools are utilized in CAFS?

9. CAFS currently utilizes TripWire, Nessus, McAfee Endpoint Protection, Event Tracker, and JIRA. However, this list is not meant to be a limitation.

The SOW is performance-based. SBA is interested in Contractor’s recommendation.

10. In the SOW, Section 4, and Section 19 there is reference to a “banking” standard of care. Please clarify what is meant by a “banking” standard of care.

10. In general, the term “banking” standard of care referenced within the SOW refers to a bank remaining in compliance with its own relevant laws, policies, and regulations.

However, this SOW is performance-based. Contractor should address these sections in its proposal if necessary.

11. See. Pricing Schedule, CLIN 0001 – Monthly SBA Rebate. Identifies that a monthly rebate of the FTA float income is payable to SBA “in equal installment amounts over the twelve (12) month POP” based on float income that “does not include income generated from fees”. The offered SBA Rebate Amount should be in U.S. dollars.

However, the Monthly SBA Rebate chart indicates that “Contractors may leave column blank as actual amount will vary.” If the contractor were to leave the column blank, how would SBA determine and evaluate the SBA Rebate Amount being proposed?

11. CLIN 0001 of the Pricing Schedule has been revised to allow the Contractor to fill-in the column for the SBA Rebate Amount in U.S. dollars.

12. See the SOW, for the following references:

20-Technology, “The contractor shall support the CAFS patch management… " 3- Information Technology Migration and Enhancement, "the Government assumes full responsibility after migration".

20-Technology, "Contractor shall support the CAFS patch management.".

If the new FTA resides in existing CAFS infrastructure, who is responsible for OS level patching, application patching, and database patching?

12. With the operation of the FTA, IT applications residing in existing CAFS infrastructure, SBA is responsible for OS level patching, 3rd party software patching, and database patching. The Contractor, in coordination with SBA and under SBA direction, is responsible for modifications to 7(a) application coding and patch development.

13. Regarding the following Clauses & Provisions, the questionnaire made the following statements:

a. Under 13 CFR 120.601, the Administration’s conduct of 7(a) secondary market activities is governed by sections 5(f), (g), and (h) of the Small Business Act (15 U.S.C. 634(f), (g), and (h)), among other authorities.

15 U.S.C. 634(h)(1)(B) authorizes the Administration to “contract with an agent to carry out on behalf of the Administration the central registration functions of this section and the issuance of trust certificates to facilitate pooling.”

15 U.S.C. 634(h)(2) provides that such agents “may be compensated through any of the fees assessed under this section and any interest earned on any funds collected by the agent while such funds are in the control of the agent and before the time at which the agent is contractually required to transfer such funds to the Administration or to the holders of the trust certificates, as appropriate.”

Could the Administration please confirm that the Fiscal Transfer Agent would be engaged pursuant to the statutory authority at 15 U.S.C. 634(h)(1)(B).

b. The solicitation provides: “This is a no-cost contract to the Government in that the Contractor is not compensated by appropriated dollars,” and the contract type description under clause 52.216-1 provides: “The Contractor is not compensated under this contract with appropriated funds. The contract type is a no-cost to the Government. The Contractor is compensated with fees generated by the secondary market activity for the SBA 7(a) guaranteed loans, in accordance with the Performance-Based Statement of Work (SOW), and Contractor’s Pricing Schedule. The Contractor fees are firm, fixed, and fully loaded. Contractor’s fees, as stated on its Pricing Schedule, represent Contractor’s sole compensation pursuant to this Contract.”

c. Could the Administration please confirm that the proposed engagement of the Fiscal Transfer Agent would not be an “acquisition” as defined in FAR 2.101 and that accordingly, the Federal Acquisition Regulations are not applicable to the proposed agreement, consistent with FAR 1.104.

Regarding the Clauses & Provisions, to the extent that the proposed engagement is not subject to the Federal Acquisition Regulations, could the Administrator please confirm that the various FAR clauses incorporated into the solicitation (whether in full text or by reference) are negotiable, and that such FAR clauses that are applicable by their own terms to FAR-covered “acquisitions” or to contractors compensated with appropriated funds, may be considered to be self-deleting.

13. The Clauses & Provisions are SBA’s best effort on this matter. There will be no further clarification or confirmation.

14. See the solicitation, clause 52.216-24, Limitation of Government Liability, provides as follows:

a) In performing this contract, the Contractor is not authorized to make expenditures or incur obligations exceeding zero dollars

b) The maximum amount for which the Government shall be liable if this contract is terminated is zero dollars.

According to FAR 16.603-4(b)(2), this clause is intended for use “in solicitations and contracts when a letter contract is contemplated.” As the proposed engagement does not use appropriated funds and is not a letter contract, could the Administrator please clarify that this clause is not intended to broadly prohibit the “Contractor” from making expenditures or incurring obligations and that clause 52.216-24 should be deleted from the solicitation.

14. Clause 52.216-24 is removed from the Clauses & Provisions.

Solicitation No. 73351019C0009 – FTA SBA 7(a) Loan Guaranty Program - 2019 Page 4 of 5