74330226R0044-45 Vendor Questions.xlsx
XLSX spreadsheet 31 KB Posted
- Attached to
- ABMC Global Payroll Services
- Solicitation number
- 74330226R0045
- Issued by
- Not on record
About this file
This is a vendor questions and answers document for ABMC's Global Payroll Services and HRIS procurement efforts, addressing inquiries across two parallel solicitations: 74330226R0045 (Payroll) and a related HRIS contract. The Q&A clarifies critical technical, operational, and compliance requirements for offerors bidding on these services.
Hosting, Security, and Compliance Requirements: Solutions must be hosted in a U.S.-based FedRAMP Moderate authorized environment, with NIST 800-53 controls, FISMA compliance, Privacy Act adherence, Section 508 accessibility, and NARA records management requirements as baseline standards. The system will handle personally identifiable information across U.S. citizens, lawful permanent residents, and foreign national employees with unified record storage and field-level access controls. Data residency must remain in the U.S., and the solution must integrate with ABMC's Entra ID tenant using SAML 2.0 or OIDC for single sign-on with tenant-managed conditional access policies. FedRAMP Moderate is mandatory for HRIS; it is highly preferred but not mandatory for Payroll if alternative security postures meet or exceed Moderate standards.
Scope, Implementation, and Deliverables: The HRIS system covers LES (Locally Engaged Staff) employees across seven countries with distinct payroll systems, requiring support for multiple languages (English, French, Italian, Dutch, Spanish, Modern Arabic, Tagalog/Filipino) and country-specific compensation plans and regulations. Implementation follows a phased approach with a target go-live in January 2027 (or later for payroll), requiring integration with payroll, Entra ID, a future Enterprise Service Management platform, and legacy Activate payroll system. Core modules prioritized are HR, Time and Attendance, Compensation and Benefits, and Performance Management, supported by live training in English and French for up to 10 sessions across administrators, managers, and users. The solution must support custom fields for country-specific tax IDs, exchange rates, multi-currency payroll, and approximately 17 standard reports at launch. Governance includes bi-weekly status meetings with the Contracting Officer and monthly Steering Committee engagement, with joint testing required between awarded HRIS and payroll contractors and at least one parallel payroll cycle before go-live. Pricing may be structured as firm-fixed-price with annual true-ups, per-employee-per-month, or per-transaction models and will be evaluated as total cost of ownership; proposals may be submitted in any local currency with USD proposals evaluated in USD.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
HRIS Questions
| # | Question | Answer |
| 1 | Can you please provide more detail on expectations of the pension payments and what countries your expectations are for the processing of payroll for pensions? | We are not paying pension via the system |
| 2 | What are the expectations of the pension calculations for payment amounts per country? | see answer above |
| 3 | Please describe the investigations related to this requirement. | There are no known investigations. |
| 4 | Is it required that the solution is hosted in the US FedRAMP moderate environment? | Yes. The solution is required to be hosted in a U.S.-based FedRAMP Moderate authorized environment. |
This is a baseline requirement for the procurement. Alternative hosting models would be considered if they meet or exceed this security posture and are clearly justified, but offerors should assume FedRAMP Moderate compliance in a U.S. environment as the expected standard.
| 5 | Is it the Government’s intent to take the responses and convert it into a Statement of Work or Performance Work Statement? | Yes |
| 6 | Per the OMB/OPM memorandum issued last December, all agencies considering a purchase outside of the forthcoming OPM contract are required to obtain a waiver prior to proceeding. Since ABMC is listed as a covered agency under the OPM solicitation, we wanted to confirm whether ABMC has secured the required waiver. Could you please confi rm whether ABMC has obtained the required waiver? | This requirement is not needed as this will be strictly for LES and not Federal civilians |
| 7 | Can you confirm the end date of the current contract with your payroll provider, and any key milestones or constraints associated with its transition? | The POP for the current option year ends 28 February 2027. |
| 8 | Based on our experience, assuming a project kickoff at the end of June, a go-live around January 25th for the defined scope would be achievable. Would this timeline align with your expectations? | Yes. |
| 9 | Who are the current HR technology vendors today? When are those contracts ending? | We do not currently have an HR technology contract. |
| 10 | Are US and/or foreign employees eligible for the FERS? If so, how and where do they enroll in the employee contribution? | US employees are eligible for FERS; LES employees are not. This system is only for LES employees. |
| 11 | Define the types of Absences (ex: vacation/PTO, sick, statutory leave) | Annual leave, sick leave, family leave, administrative leave, holidays, travel, compensation time off in accordance with Agency policy |
| 12 | Do all employees have a work or organizational email address? | No. |
| 13 | Do you need industry-specific competency frameworks or skill tracking? | yes to compentency framefworks or skill tracking |
| 14 | How do you handle globalization and localization governance with your current HCM solutions? Do you have a dedicated team to track and manage governance changes? | this is governed by local laws / country laws and not US Agency |
| 15 | How important is mobile access given your workforce distribution? | Not a priority. Most of them use laptops and most of the workforce will not have access to the system itself nevertheless please clarify your question |
| 16 | How many different systems currently house employee data, and what reconciliation issues exist? | one data base + time system Activate and Employee Express |
| 17 | Is ABMC open to deploying AI as part of the overall solution? If so, are there any limitations? | ABMC supports AI-enabled functionality within the solution, but only where it is secure, governed, transparent, and human-supervised. AI is allowed as an enhancement, not as an autonomous decision-making authority. |
AI capabilities may be proposed where they enhance functionality, efficiency, or user experience within the HR and payroll system, and must be approved by ABMC's AI Governance Board and OCIO oversight.
18 Is ABMC open to employees using mobile devices to accomplish HR-related work, self-service, etc.? ABMC is open to employees using mobile devices for HR-related work and self-service functions, provided the solution operates within a secure, controlled, and compliant architecture.
Mobile access must enforce federal security requirements including strong authentication, encryption, and device management, align with Zero Trust principles, and restrict access based on user roles and least privilege.
PII and payroll data must remain protected and confined to approved environments, with no unauthorized storage or transmission outside FedRAMP-authorized systems. All activity must be auditable, and access must occur through agency-approved applications or secure interfaces.
| 19 | Please describe the downstream/upstream landscape that the HRIS/Talent Management systems will need to interact or integrate with? | It will need to integrate with payroll in at least 7 countries (not the US). |
| 20 | What are the requirements for deploying within a secure environment / sovereign cloud environment. What Impact Level is required? | ABMC expects the solution to operate in a secure, US government-aligned cloud environment, with a strong preference for a U.S.-based FedRAMP Moderate authorized environment. |
If a FedRAMP Moderate deployment is not available, the proposer must demonstrate an equivalent or higher security posture with documented controls, independent assessments, and alignment to federal cybersecurity standards.
The required baseline aligns to a Moderate impact level under NIST guidance, reflecting the sensitivity of HR and payroll data, including PII, with appropriate controls for confidentiality, integrity, and availability. Additional expectations include clear data residency and sovereignty, robust access controls, tenant isolation, and full support for auditability, logging, and continuous monitoring.
| 21 | What collective bargaining agreements are in place, by country? Which, if any, are these statutorily mandated | None. |
| 22 | What is your preferred implementation methodology (phased vs. big bang)? | phased |
| 23 | What is your projected employee growth over the next 3-5 years? | Minimal - less than 5%. |
| 24 | What languages are required for employee/manager users? | English/French/Italian/Dutch/Spanish/Modern Arab/ tagalog or filipino |
| 25 | What languages are required for support services? | English and French |
| 26 | Which modules are highest priority for initial rollout? Can you be specific for each functional area? | 1/ Core HR module 2/ Time and Attendance 3/ Compensation and Benefits 4/ performance management 5 and 1 / Live trainings for managers and uses and administrators |
| 27 | How is FMLA managed today? Who administers the leave and employee relations? | FMLA N/A. Overseas HR staff will administer the leave and employee relations |
| 28 | Will the employees of the 3 additional countries (Philippines, Mexico, Panama) be included in the core HRIS regardless of the payroll decision? | Yes. |
| 29 | How do you administer US Benefits? Are employees on ABMC owned plans or covered by other employer plans? | US benefits are managed through FPPS and EmployeeExpress. |
| 30 | Who are the executive sponsors and key decision-makers for this initiative? | The Contracting Officer must remain the primary industry point of contact during source selection. |
| 31 | What does the evaluation and scoring process look like for this RFP? | Please see RFP instructions |
| 32 | What is the anticipated timeline for down-select and final award? | TBD. By June 2026 |
| 33 | Where are the most significant inefficiencies or risks in the current environment? | Lack of consolidated/coordinated information. |
| 34 | Are there any recent audit findings or compliance gaps driving urgency? | No. |
| 35 | Is there a goal to consolidate HR and payroll systems into a single platform? If so, what is the target future-state architecture? | No. |
| 36 | What is the quality and completeness of current employee and payroll data? | employee data pretty accurate but payroll data there are lots of discrepancies |
| 37 | Are there specific compliance frameworks beyond FedRAMP that must be adhered to (e.g., DFARS, ITAR, SOC requirements)? | FedRAMP serves as the baseline requirement, but additional federal frameworks and controls also apply depending on the system’s functions and data. |
At a minimum, the proposed solution must align with FISMA and NIST 800-53 controls, federal privacy requirements under the Privacy Act and OMB A-130, NARA records management requirements, and Section 508 accessibility standards.
Because the system supports payroll and financial processing, it must also meet applicable internal control and audit expectations tied to federal financial systems.
DFARS and ITAR are not expected to apply for a Federal Executive branch agency. We are not DoD/DoW.
Industry certifications such as SOC 1 or SOC 2 are beneficial to demonstrate control maturity, but they do not replace federal compliance requirements.
| 38 | What is the long-term vision for expanding into adjacent areas (workforce planning, analytics, skills, etc.)? | we are hoping the system already includes those services |
| 39 | Are there budget constraints or funding phases tied to this initiative? | ABMC does not release its budget. All requirements are subject to availability of funds. |
| 40 | Is pricing expected to be evaluated as total cost of ownership over time? | Yes |
| 41 | Section 3 of the PWS lists deliverables but does not enumerate counts. To enable a defensible firm-fixed-price quote, can ABMC provide an estimate of the number of distinct business processes or workflows to be configured at go-live (for example, hire, separation, mid-period salary change, leave request, performance review cycle, position request)? If ABMC does not have a count, can the Commission confirm that vendors should propose a count based on the PWS narrative and document the assumption? | vendors should propose a count based on the PWS |
| 42 | Of those workflows, can ABMC indicate which are substantially country-specific (for example, separate variants for French, Italian, Belgian collective agreements, Italian Trattamento di Fine Rapporto, Filipino 13th-month) versus those that are single global processes? | Each country has his own Local Compensation Plan and local regulations (LES handbook) |
| 43 | Can ABMC estimate the number of role-specific screens or personas the system must support? Our reading of Appendix I and the PWS suggests at minimum HR Administrator, HRIS Administrator, Manager, Cemetery Superintendent, Timekeeper, US GS Employee, LES Employee, Controller, and Commissioner. Does ABMC envision additional personas (for example, a Records Officer aligned to NARA roles, or a country-specific HR Liaison)? | The PWS covers the accurately neverthless a Record Officer main need access to data for audit purpose |
| 44 | Section 4.1.A of the Questions Matrix asks about data structure and supported standards. Can ABMC indicate the expected number of custom fields beyond the platform's standard schema (for example, ABMC-specific employee identifiers, country-specific tax IDs, host-country social-contribution numbers, FCFA-related fields)? | ABMC requires that the HRIS platform be flexible and extensible, with the ability to support ABMC-specific and country-specific data elements as needed. |
Specifically, the system must support custom fields and interfaces, including use cases such as entering a specific exchange rate at the time of payroll disbursement and handling multi-currency payroll data across countries.
Given ABMC’s global workforce footprint across multiple countries with distinct labor, tax, and reporting requirements, offerors should assume the need to support a variable and potentially significant number of custom data elements, including identifiers, country-specific tax and social contribution data, and currency-related fields.
These requirements are expected to be refined during implementation based on country-level needs and integration with payroll systems
| 45 | Can ABMC estimate the number of standard reports required at go-live? Does ABMC have an existing report catalog from current operations that vendors should plan to reproduce, or is the system expected to provide a baseline report library plus an ad-hoc report builder for ABMC to extend? | We have the TDA report. 17 reports that we would need at go live |
| 46 | Are any regulatory or statutory reports required at go-live (for example, EEO reporting, OPM-required reports, host-country social-contribution returns, GDPR data subject access response packages)? If so, can ABMC list them? | no |
| 47 | The PWS references payroll authorization files, Gross-to-Net files, and ITS files per Attachment 3. Beyond these three, are any additional outbound files or feeds required at go-live (for example, GL feed to a financial system, time data feed to a project accounting system, training records feed to an LMS)? | The payroll PWS also requires a GL file. |
| 48 | Section 3 of the PWS calls for "Integration with Agency Service Management solution." Can ABMC name the specific ITSM platform (for example, ServiceNow, Jira Service Management, BMC Helix), the events to be exchanged, and whether ABMC's ITSM team will provide the destination API specifications and a non-production endpoint for integration testing? | ABMC is currently evaluating a new Enterprise Service Management (ESM) as its Service Management solution but has not finalized a single platform at the time of award, so offerors should design integrations that are standards-based and adaptable rather than tightly coupled to a specific vendor implementation. |
The expected integration scope includes common service management events such as incident creation and updates, service requests, user provisioning or deprovisioning triggers, and notification or escalation workflows, though the exact event set may be refined during implementation.
ABMC anticipates that its ESM team will provide the necessary API specifications, authentication requirements, and integration guidance after award, along with access to a non-production environment or test endpoint to support development, validation, and end-to-end testing prior to production deployment.
49 Beyond payroll (74330226R0045) and ITSM, can ABMC provide an enumerated list of in-scope integration targets at go-live? Common candidates include financial system, learning management system, badge or physical access system, time clock devices, benefits administration platform, identity governance, host-country tax authorities, and Treasury endpoints. For each, can ABMC indicate whether the endpoint API is documented and whether ABMC's team or the third-party vendor will provide non-production access? ABMC’s ABMC.gov Entra ID tenant supports modern federation standards, including SAML 2.0 and OIDC, and is the authoritative identity provider for enterprise systems. Conditional access policies, identity governance, and authentication controls will be centrally managed by ABMC within the tenant, not by the HRIS contractor.
The platform is expected to integrate with Entra ID for single sign-on using standard protocols and align with ABMC’s Zero Trust architecture. Authentication should support both employee and contractor identities, with access governed through role-based access controls and least-privilege principles consistent with ABMC policy.
| 50 | Section 1.16.C of the Questions Matrix asks about Entra ID SSO. Can ABMC confirm whether the ABMC.gov Entra ID tenant supports modern federation (SAML 2.0, OIDC), whether conditional access policies will be tenant-managed by ABMC or expected to be managed by the HRIS contractor, and whether the platform should authenticate using employee identities, contractor identities, or both? | ABMC uses Microsoft 365 E5 with Entra ID and SAML 2.0. Access would be tenant-managed by ABMC. |
| 51 | Can ABMC describe the current state of HR data that must be migrated? Specifically: how many source systems (legacy HRIS, spreadsheets, country-specific databases, paper records), the approximate record counts (active employees, terminated employees with retention requirements, position records, leave balances), the history depth to be migrated (transactions for the past N years), and the general data quality condition (clean, mixed, known issues)? | HR data base is up to date and needs to migrate over and data from Activate current payroll system. The HRDB covers 25 years |
| 52 | Is there an incumbent contractor providing HRIS or related HR technology services to ABMC today? If so, can ABMC provide the incumbent's name, contract end date, and confirm whether the incumbent will provide transition-out support and access to source data, configuration, source code, and documentation? If no incumbent exists and ABMC is operating on internal systems or spreadsheets, can the Commission confirm this so vendors can size data migration accordingly? | There is no incumbent HRIS contractor. |
| 53 | Will ABMC provide a data dictionary or sample data extract during the proposal phase, or only after award? Vendors estimating migration effort without sample data will need to assume a complexity tier; documented sample data sharply tightens the estimate. | ABMC can share a sample, anonymized data extract with an NDA. Please contact the Contracting Officer at nerenga@abmc.gov to request. |
| 54 | Has ABMC prepared user stories, process maps, or as-is and to-be diagrams for the workflows the HRIS will support? If so, can ABMC indicate whether these will be made available to the awarded vendor at kickoff, and the approximate scope (a handful of priority processes versus a comprehensive process library)? | can be provided to awarded vendor |
| 55 | Has ABMC developed draft test cases or acceptance criteria for system functionality that vendors should plan to validate against, or will acceptance be defined collaboratively during Phase 1 of the implementation? | defined collaboratively during Phase 1 of the implementation |
| 56 | Has ABMC engaged a business analysis or requirements consultant ahead of this RFP to develop the requirements baseline, or did the PWS draw primarily from internal staff knowledge? | in house |
| 57 | Section 3 of the PWS calls for "Live Training sessions for all Administrators, Managers and Users in all required languages." Can ABMC estimate the number of training sessions anticipated, the expected attendees per session for each persona and country, and whether ABMC requires train-the-trainer delivery or full end-user delivery in every host country? | up to 10 trainings and with different audience. Trainings can be recorded for the future and in multiple languages if possible but at least in English and French |
| 58 | Can ABMC describe the governance cadence expected during implementation (for example, weekly status meetings with the COR, monthly Steering Committee, formal CDRLs and DIDs, written status reports, IPRs)? | bi-weekly status meeting with the COR and the Committee |
| 59 | Will the awarded HRIS contractor be expected to participate in joint testing with the payroll provider awarded under 74330226R0045? If so, can ABMC indicate the cadence of joint testing between contract award and the January 2027 go-live, and whether parallel payroll cycles will be required (one cycle, two cycles, three cycles)? | Yes, joint testing with the payroll provider will be required. At least one parallel payroll cycle will be required. Go-live for the payroll contract may be later than January 2027. |
| 60 | What is ABMC's acceptance and rework provision? Specifically: how many review cycles per deliverable does ABMC anticipate, what is the typical turnaround for ABMC review and feedback, and how does ABMC distinguish between in-scope rework and changes that warrant a contract modification? | ABMC applies a structured acceptance process tied to defined deliverables and measurable criteria, with payment contingent on formal acceptance at each milestone. While a fixed number of review cycles is not prescribed, ABMC generally expects iterative review and refinement during execution, with feedback provided through regular project governance forums such as weekly status meetings and working sessions. |
Deliverables are accepted once they meet the stated requirements and documented acceptance criteria, and contractors are expected to address deficiencies or gaps as part of normal in-scope rework. Changes that alter the agreed scope, introduce new functionality, or impact cost or schedule are treated as out-of-scope and must be formally proposed and approved through the contract change control process by the Contracting Officer.
| 61 | Section 4.8.A of the Questions Matrix asks whether the system is FedRAMP-certified but does not specify a baseline. Is FedRAMP Moderate authorization sufficient for award, or does ABMC require FedRAMP High? | ABMC requires a FedRAMP Moderate baseline. |
| 62 | Per the Privacy Act SORN ABMC-6 and the 2025 Privacy Act Issuance, the HRIS will hold records covering U.S. citizens, lawful permanent residents, and foreign national employees. Will ABMC require the HRIS to support physical or logical segregation of records by Privacy-Act-coverage status, or is a unified record store with field-level controls and access auditing acceptable? | Unified record store with field level access and auditing |
| 63 | Does ABMC have a preference or requirement for U.S.-only data residency, or is EU-hosted data acceptable for personally identifiable information of EU-based LES employees in light of GDPR? | The platform shall be US-hosted. |
| 64 | Given the Treasury announcement referenced in Appendix II that ISO 20022 country code and town name fields will be required effective 1 November 2026, will ABMC issue a formal RFP amendment with the updated Attachment 3 specification once Treasury releases guidance, or will the new specification be handled as in-flight scope under the awarded contract? | The new specification will be handled as in-flight scope under the awarded contract. |
| 65 | Does Section 508 conformance evidence require a current VPAT at proposal submission, or is post-award VPAT delivery acceptable? | ABMC expects current Section 508 conformance evidence at proposal submission, typically in the form of a completed VPAT or equivalent accessibility conformance report. |
Post award VPAT delivery is not sufficient on its own because accessibility is an evaluation factor tied to product selection, not just a compliance activity after award.
66 The RFP states ABMC intends a "predominantly firm-fixed-price" contract but allows alternative structures. For SaaS subscription pricing tied to active headcount, would ABMC accept a firm-fixed-price model with an annual true-up, or does ABMC prefer a strict per-employee-per-month structure? ABMC will accept firm-fixed-price structures provided they are clearly defined, transparent, and support consistent evaluation across offerors. This may include models that incorporate an annual true-up mechanism tied to actual headcount or transaction volumes.
At the same time, ABMC recognizes that SaaS and payroll services are commonly priced on a per-employee-per-month or per-transaction basis, and will also accept these models where they are well-structured and auditable.
| 67 | Vendors are permitted to submit pricing in any preferred local currency. If a vendor submits in USD, what exchange rate will ABMC apply for evaluation purposes, and as of what date? | USD proposals will not be converted to another currency. |
| 68 | In Attachment 2, Section 4 contains two sub-sections numbered 4.2 (Data Residency, then Infrastructure and Operations) and two numbered 4.3 (Security Controls, then Extensibility). Can ABMC confirm that this is a numbering artifact in the checklist and that vendors should respond to all sub-sections under the PWS Part Two numbering (4.16 through 4.22)? | Any duplications in numbers are in error. Please respond to all questions. |
| 69 | The RFP states product demonstrations may be requested at ABMC's discretion following proposal receipt. To facilitate scheduling, can ABMC indicate the expected timeframe for any demonstration window relative to the 29 May 2026 proposal due date, and the typical duration and format ABMC prefers (live web conference, on-site at Arlington, recorded)? | Demonstrations would be via live web conference in June or July 2026. |
| 70 | Do you have to be FEDramp approved to participate? | Please refer to question #37 above for alternative IT security requirements. |
| 71 | Can you tell us what payroll systems are being used now by local providers & if those systems all have exposed API's | Activate payroll |
| 72 | May the required customer service operation be automated by AI or must it be live attendant? If live attendant is required, must they be located within the US or are offshore operators permitted | Please see question #17 above. |
| 73 | Would you be at all interested in a custom-built solution? | if possible if the timeline can be met for implementaiton for 2027. |
Payroll Questions
| # | Question | Answer |
| 1 | Is the FedRAMP certification mandatory to proceed in the evaluation process? | No, however FedRAMP is HIGHLY preferred. Refer to question #37 in the HRIS tab for alternative IT security requirements. |
| 2 | Given the Treasury announcement referenced in Appendix II that ISO 20022 country code and town name fields will be required effective 1 November 2026, will ABMC issue a formal RFP amendment with the updated Attachment 3 specification once Treasury releases guidance, or will the new specification be handled as in-flight scope under the awarded contract? | The new specification will be handled as in-flight scope under the awarded contract. |
File details come from the government source that posted it. Updated .