Questions_and_Answers_RFP_75N94022R00011_0005.pdf

RFP No. 75N94022R00011

NIAAA Alcohol Policy Information System

Questions & Answers

1. With reference to Activity 1(f)(3) in the SOW, how many remediation requests have been made in the past year and what is the average turnaround time for such requests?

ANSWER:

The number of scan findings to remediate is highly dependent on how well the contractor follows security best practices as outlined by OWAS and is not indicative of a future number of findings. As long as the contractor follows best practices such as outlined in the OWASP Top 10 and keeps up patching within time windows, and CIS Baseline controls on server operating systems, the findings are not likely to exceed an average of 10 a month across different scanning tools.

As to turnaround time, the contractor should anticipate the following remediation timeframes for vulnerabilities, unless superseded by HHS or CISA requirements for emergencies:

Critical within 15 days

High within 30 days

Medium within 60 days

Low within 6 months

2. For Activity 2.c on page 7 of Attachment 3 of the RFP, it states, “…propose, develop, and publish new indicators, measures, and variables to characterize policy status and/or policy change across jurisdictions and/or over time.” Can the government state how many indicators, measures, and variables should be budgeted for?

ANSWER:

For budgeting purposes please assume 2-3 per year (12 total over the 5-year course of the contract).

Please note that these apply to established policy topics, not to the development of any new topics that might be developed under Activity 3.

3. With reference to Activity 3 in the SOW, please confirm if the contractor is expected to support the expansion of at least two new policy areas per year or within the 5-year contract period.

ANSWER:

The expectation is two new policy areas total for the entire 5-year performance period (not two per year).

As it is not possible to anticipate in advance which years the new policy areas will be identified/approved/implemented, for budgetary purposes please follow the instructions contained in ATTACHMENT 6 of the RFP, “Additional Proposal Information and Instructions”, Cost/Effort Assumptions, Item 1b. (In practice, hours can be re-assigned to other performance areas/Activities in those years where a policy topic is not pursued; the budget assumptions provided in ATTACHMENT 6 are to ensure suitable “coverage” for budget estimating purposes only – in practice, the actual hours dedicated to a particular Activity will vary by year).

4. With reference to Activity 5 in the SOW, will the government please define the requirement for "independent" as it applies to the assessment and experts?

ANSWER:

The meaning of “independent” in the context of Activity 5 is “independent of the project staff”.

Qualified employees of the prime contractor may be independent in this sense, if they are not part of the project team carrying out the other activities required under this contract. Note the requirement to “engage input from users and potential users of the site” – these users and potential users must not be employees of the contractor (or any subcontractor).

5. For budgeting purposes, please confirm which year the contractor will prepare and submit the two manuscripts for publication required under Activity 6(a).

For budgeting purposes, please assume a manuscript in Year 3 and the second one in Year 5.

6. For budgeting purposes, please confirm which year the contractor will prepare the three posters and/or oral presentations required under Activity 6(b).

Similar to the new policy topics, it is not possible to anticipate in advance which years the poster presentations will take place. As such, for budgetary purposes please follow the instructions contained in ATTACHMENT 6 of the RFP, “Additional Proposal Information and Instructions”, Cost/Effort Assumptions, Item 1c for travel/poster presentation costs.

7. Please confirm if offerors are required to submit a copy of their Annual Financial Report within the Business Proposal.

ANSWER:

It is confirmed that offerors are required to submit a copy of their most recent Annual Financial Report with the Business Proposal. Please see Item 10 on page 92 of the RFP for details.

8. In reference to Attachment 9 VPAT Template, please clarify if the offeror should submit both “VPAT 2.4Rev 508 (March 2022)” for non-web-based products/services and “VPAT 2.4Rev WCAG (March 2022)” for web-based services). Or would submission of one of the two templates be sufficient?

ANSWER:

The offeror should submit both. One form covers equipment; the other form covers web-based services.

It is admittedly a bit “buried” in the RFP, but the applicable Section 508 standards identified by the NIAAA Section 508 coordinator for this requirement are as follows (from pages 82-83 of the

RFP):

300 – Functional Performance Requirements

400 – Hardware Standards General

500 – Software Standards General

600 – Support Services & Documentation Standards

WCAG Level A Requirements

WCAG Level AA Requirements

The VPAT 2.4Rev 508 (March 2022) form is used for equipment, as applicable to your organization for use on this project (Standards 300, 400, 500, 600 listed above).

The VPAT 2.4Rev WCAG (March 2022) form is used for web services, as applicable to your organization for use on this project (Standards WCAG Level A and WCAG Level AA listed above).

These are somewhat lengthy forms due the instructions, but the parts you would actually complete come toward the end of the documents.

For Standards 300, 400, 500 and 600, you would utilize the VPAT 2.4Rev508 (March 2022) form for equipment. Beginning on page 21, “Functional Performance Criteria", Chapter 3, which corresponds with Standard 300, for the items listed you would respond with "Supports", "Partially Supports", "Does Not Support" or "Not Applicable". (And if anything is identified as

"Does Not Support", would typically include a short statement to the effect of "will be provided on as as-needed basis" [e.g. in the event someone with visual impairment or hearing impairment etc. may need different equipment or an upgrade to utilize the equipment and perform their duties for the project]). Do the same for Standards 400 (Chapter 4), 500 (Chapter

5) and 600 (Chapter 6).

Similarly, for Standards WCAG Level A and WCAG Level AA (for web-based services) utilize form VPAT 2.4Rev WCAG (March 2022). Beginning on page 12, fill out Table 1 (corresponds with WCAG Level A) and Table 2 (corresponds with WCAG Level AA).

The intent of the accessibility requirements is the ensure anyone working on the project that may have a disability will be provided equipment/resources by their institution that will allow them to perform needed duties on the project (and this is a general requirement for Federal contracts).

9. How does a subcontractor submit a sealed package separately to the government?

It is generally expected that any proposed subcontractors submit a complete cost proposal in the same format as the offeror’s cost proposal (see pages 91-92 of RFP) to the prime offeror for inclusion with the prime offeror’s Business Proposal. If, in particular instances, a proposed subcontractor insists that some specific cost information cannot be shared with the prime offeror, that particular proposed subcontractor may contact the Contracting Officer directly to request a secure e-mail that can be used to submit the full subcontract proposal budget details directly to the Government. All information must be received on or before the due date/time for proposals in response to the RFP.

Total subcontract costs must be submitted to the prime offeror for inclusion in the prime offeror’s Business Proposal budget (see Section J, Attachment 11 of RFP – Excel spreadsheet, Subcontracts Tab). Please see pages 91-92 of the RFP for full details on subcontract info for the prime offeror to include in the Business Proposal.

Additionally, in order for the Government to evaluate the prime offeror’s understanding of the project in terms of overall labor and resources needed/proposed, any major subcontractor [in terms of labor hours] should also complete the Technical Proposal Cost Summary (Section J, Attachment 7 of the RFP) for inclusion with the prime offeror’s Technical Proposal. This does not include individual salary info, indirect costs, fee, etc., only assigned roles and associated hours and cumulative subcontractor direct costs – see page 74 of the RFP for full details). The Government is primarily interested in the assigned roles/hours for labor to assess overall labor mix and “coverage”.

This Technical Proposal Cost Summary can be accessed via the below link:

https://oamp.od.nih.gov/sites/default/files/DGS/contracting-forms/Tech-Prop-Cost-Summ.pdf https://oamp.od.nih.gov/sites/default/files/DGS/contracting-forms/Tech-Prop-Cost-Summ.pdf

Please note that, should the prime offeror be awarded the contract, any subcontractor will be submitting invoices and any necessary supporting price information directly to the prime contractor.

NIH does not accept subcontract invoices directly as there is no privity of contract between NIH and subcontractors.