The file's text, extracted by GovTribe without its formatting.
Solicitation No. 75N97019R00012 – NIH Software Asset Management Support Services Questions and Answers (SAM RFP, PWS, Terms and Conditions, and Instructions for Offerors)
We would like to confirm the following numbers:
Desktops, laptops, tablets – 50,000
a. Servers (both physical and virtual) – 10,000 Yes, these numbers are correct.
| Would the NIH consider a proposal that includes software and support for SAM but entering the entitlements would be done by NIH staff? |
| Yes. We believe the entitlement data will be entered by NIH staff responsible for the entitlement contracts. |
| Would the NIH be interested in a SaaS solution or should this be on-premises, or both? |
| SaaS is acceptable. In fact, the government has a cloud-first policy and we welcome off-premise implementation. |
| Regarding the language listed below, does this language only pertain to any vendors that currently have a reseller relationship with the NIH (or have in the past) or any reseller that resells licensing as part of their business model? Neither the prime vendor, nor any teaming partners for this requirement may be a software reseller, which NIH considers a conflict of interest when providing optimization advice. |
| Any reseller that resells licensing as part of their business model. |
If the language pertaining to software reseller conflict of interest is applicable to all interested vendors, our position is that excluding software resellers will limit competition and the NIH will not have an opportunity to evaluate all qualified contractors. We request that this requirement be removed.
Additionally, software resellers add value to this process because resellers have a deep knowledge in licensing and use rights, have knowledge in publisher changes to licenses, and have a wealth of data for benchmarking that are all applicable to the NIH’s Software Asset Management endeavor.
If the only products you resell are software asset management tools, then that is not a conflict of interest. If, one the other hand, you or your teaming partner(s) sell Microsoft, IBM, Oracle, Adobe, SAP, SAS, or even smaller-scale COTS software then that would constitute a conflict of interest and this is not permissible since we expect the vendor to be a neutral third party when optimizing licenses and providing negotiation advice.
| If a vendor does not have a federal government approved accounting system at the time of submitting their response, but is willing to go through this process if awarded this RFP – can they still be considered for award? |
| Cost and accounting standards do not apply to Commercial Item Acquisitions. |
| What are the steps to have our accounting system reviewed/approved? |
| N/A |
| Per the solicitation documents, terms were “amended” via ADDENDUM TO TERMS AND CONDITIONS OF PURCHASE ORDER. Please confirm if this document represents all Terms and Conditions. If not, we request a copy the full terms and conditions for this solicitation |
| FAR Clauses applicable to this requirement is FAR Clause 52.212-4, Contract Terms and Conditions, Commercial Item, and FAR 52.212-5, Contract Terms and Conditions Required to Implement Statutes, Commercial Item. Also, FAR Clause 52.227-14, Rights in Data – General (May 2014) will be applicable. |
| What is your estimated percentage of cloud vs on-premise software? (50%-50%, 30%-70%?) |
| This information is not available. |
| Are your employees currently able to expense a software purchase? What is the process? |
| No. |
| Do you use a Single Sign-On solution? |
| Yes, but single sign-on is not a requirement, since we do not expect that there will be an abundance of users who will need access to the SAM tool(s). |
| NIH SAM PWS: Most vendors specializing in asset management have some reseller capabilities. Is the government precluding any bidder who participates in any reselling or just a specific set of software products? |
| If the only products you resell are software asset management tools, then that is not a conflict of interest. If, one the other hand, you or your teaming partner(s) sell Microsoft, IBM, Oracle, Adobe, SAP, SAS, or even smaller-scale COTS software then that would constitute a conflict of interest and this is not permissible since we expect the vendor to be a neutral third party when optimizing licenses and providing negotiation advice. |
| NIH SAM PWS: Besides BigFix, SCCM, and Splunk, are there any other inventory, discovery, security tools being used within NIH to include: SolarWinds, CiscoWorks Lan Management Solution, Tanium, ForeScout, Vmware, Vcenter Protect, ServiceNow Discovery? |
| At the enterprise level; BigFix, Splunk, Forescout and Tenable Security Center have been leveraged for inventory detection. |
| NIH SAM PWS: What data elements can be extracted from PRISM and can this data be directly extracted to a CSV or Excel file type for data manipulation as well as a direct database connection? |
| We do not have a taxonomy of PRISM data fields at this time, nor have we researched how the transfer of information from PRISM to a SAM database will occur, but we will apply resources to the PRISM team to ensure needed data is captured during the procurement process (to include the creation of new data fields) and that the information is exportable. NIH will be responsible for the interconnections between data sources of needed. |
| NIH SAM PWS: Approximately how many software asset contracts are projected to be processed on an annual basis? |
| NIH does not have this information. |
| Instruction to Offerors: Is the intent of NIH to have the offeror provide additional software tools to support and augment BigFix and Splunk? If so, is a cloud-based solution an option? |
| Yes, yes. |
| How many active purchase records does the NIH have in their PRISM system? |
| What is meant by “active”? Not all PRISM records pertain to software and it is not now possible to reliably distinguish COTS software purchases from other purchases in PRISM. |
| Do you want to transfer all these records to the SAM system and if so, in what time frame? |
| We will begin the process of creating connections with PRISM after we have established a reliable inventory on some portion of our software. We originally scheduled that work to begin in FY20. |
| Alternatively, do you want to focus on some of your major software vendors, and if so, which ones and in what time frame? |
| Please propose. |
On page 10 of 21 in the Performance Work Statement it reads: Neither the prime vendor, nor any teaming partners for this requirement may be a software reseller, which NIH considers a conflict of interest when providing optimization advice.
As a Large Global OEM of agile and modern cloud software solutions and services to the US Public Sector, Federal Government and DoD. We leverage companies that are distributors to the government as a channel for our products to be acquired. We have numerous technology contracts and schedules through our key small and larger business partners that co-deliver with us our services within the Federal Government and our DoD customers.
Wanting to confirm with you that we were not violating any requirements with our teaming approach to the NIH Software Asset Management RFP. We have access to numerous technology contracts and schedules through our key small and larger business partners within the Federal Government and DoD. We will work with NIH to identify the most appropriate contracting vehicle to provide a Software Asset Management Solution If the only products you resell are software asset management tools, then that is not a conflict of interest. If, one the other hand, you or your teaming partner(s) sell Microsoft, IBM, Oracle, Adobe, SAP, SAS, or even smaller-scale COTS software then that would constitute a conflict of interest and this is not permissible since we expect the vendor to be a neutral third party when optimizing licenses and providing negotiation advice.
| Are you requiring that the contractor use BigFix for the inventory and usage data or can the contractor use their own tool to gather this data? |
| If there are alternatives or additions to BigFix that you suggest, please propose them. We need to identify all of our software and we realize BigFix may have some blind spots. We need to compensate for that, and NIH is interested in your thoughts on the matter. |
The RFP for NIH for Software Asset Management Services notes no set-aside, but the PWS contained the following comment: Neither the prime vendor, nor any teaming partners for this requirement may be a software reseller, which NIH considers a conflict of interest when providing optimization advice.
As a result of this restriction, my firm would not be able to bid on the RFP, as our expertise in Software Asset Management has contributed to our Gold level Sales and Services partnership with ServiceNow. We are a re-seller and service provider.
My question is to confirm my interpretation. My firm is a re-seller of ServiceNow Software Asset Management, and that prevents us from bidding on this RFP. Is that interpretation correct, and is that the intent of the notation in the PWS?
If the only products you resell are software asset management tools, then that is not a conflict of interest. If, one the other hand, you or your teaming partner(s) sell Microsoft, IBM, Oracle, Adobe, SAP, SAS, or even smaller-scale COTS software then that would constitute a conflict of interest and this is not permissible since we expect the vendor to be a neutral third party when optimizing licenses and providing negotiation advice.
RFP Document
Introduction:
b. States “Proposals that merely offer to conduct a program in accordance with the requirements of the government’s scope of work will not be eligible for award.”
c. But Section 7 states “in conforming to this RFP”
d. These statements disagree. Which applies?
The PWS states the objectives and specific requirements that we would like met. The Instructions to Offerors provides detail about what we are looking for in responses. If you respond to the questions in the Instructions to Offerors, then there is no risk of simply repeating our requirements as your proposed solution (which would not be acceptable).
Section 5 – Evaluation:
e. The second paragraph states that Factors A & B are of equal importance yet the table stating degree of importance is different (35 vs 30). The same applies to Factors C & D. Question: Which statement applies?
Good catch. They are not of equal importance. Use the information in Table 2: Evaluation Factors.
Section 5.2.3 Usability:
f. Can sample data be provided now so that the RFP response appropriately addresses the data and potential report?
The sample data will be provided at some point after we receive proposals.
Section 5.2.4.b – Service Level Agreements:
g. Baseline Entitlement Data and Data Accuracy both contain Remediation statements starting “All data accuracy…”
h. How is it determined that NIH or Contractor is at fault?
That would be based upon a root cause analysis.
PWS Document
Section 7.1
i. States “To achieve this, the contractor must provide services and deliverables as described to meet objectives.”
j. What are tools and supplies considered as the RFP and PWS clearly state that tools should be proposed?
Yes, please propose the tools that we will need to complete an inventory of all software, in addition to the tools we currently have. Our expectation is that the vendor will supply any additional tools and use those in the inventory process that the Offeror implements.
Section 7.4
k. States, “The Contractor shall provide subject matter experts on an as-needed basis to assist NIH in negotiating contracts with software vendors.”
l. Is this considered Time and Materials? Where should it be stated in the Business Proposal?
This is a firm fixed price task, so you may want to establish a level of effort that you believe is reasonable and ensure that effort is balanced to meet the different needs as they arise.
Section 12
m. Does NIH believe that “management staff” will be required to work on site on a full-time basis or on an as needed basis? If the latter, can enough time be provided to schedule the appropriate resources?
We do not believe we will need to interact with management staff at our office on a regular basis, and we can always schedule meetings or talk ad hoc remotely. We will primarily be interested in working with subject matter experts.
Terms and Conditions
| Are FAR Cyber Clauses applicable? |
| The Commercial Item Acquisitions Clauses 52.212-4 and 52.212-5 are applicable to this requirement. |
| Section 1.0 declares FAR Part 13. Why is this considered a simplified threshold acquisition? |
| The requirement is being solicitated in accordance with FAR Part 12.6, Streamlined Procedures for Evaluation and Solicitation for Commercial Items, and under the rules and regulations of FAR Part 13.5, Simplified Procedures for Certain Commercial Items |
| Further, FAR 12.6 is included. Is it NIH’s intent to purchase a tool as part of this acquisition? |
| No. We expect the Offeror to provide any tools and include those costs in their price quote. |
| Will our proposal be considered if we take exceptions to the Terms & Conditions? |
| You must provide the Terms & Conditions that are being excepted or needing to be renegotiated. |
| Will NIH entertain an extension to the due date of the RFP? |
| Yes, the due date has been modified to August 13, 2019. |
| Please explain 5.2.3. Usability (Section 4) – Please describe what’s required in the 2-hour tour and when is it required? When is the demo expected? |
| The demo will be scheduled after the proposals are submitted, and scheduling will most likely begin on the week of August 19th. |
| Are the business units considered individual reporting entities? (e.g. Would 28 ELPs be required for Microsoft and other software publishers or only 1 combined ELP?) |
| I think it depends on many factors, but in general, we would like a single enterprise licenses that apply to all ICs at NIH. |
| Please describe any specific data security or data sovereignty requirements |
| All security related issues are governed by existing IT security policies and practices at NIH for any specific operation. Therefore, this question is too generic. Vendors may propose or showcase any relevant data security or data sovereignty features applicable to this solicitation. |
| In reading the RFP, we have some questions that will help in terms of scoping. When are vendor questions due? I did not see a deadline. |
| The deadline for submission of questions was July 31, 2019. |
| And what is the date that all answers to questions will be posted by? |
| The response to questions was August 2, 2019. |
| Lastly, do we need to partner with a prime contractor on any specific vehicle? On page 10 of the PWS there was a specific reference to a “Prime vendor” and “Teaming partner” but I didn’t see any other guidance or requirements, other than being a small business. |
| A prime vendor or teaming partners are optional and not required. |
| Are the example reports and visualizations referenced in 5.2.3 b, c, d, e expectations and outputs from the demo session or should these be independently included in the response? |
| The visualizations included in the demonstration may be the same or different than those provided in the proposal. |
| In section 5.2.1 section a. the RFP says to include custom or COTS tool that you propose that will augment BigFix capabilities. Does NIH plan to purchase a SAM tool that is recommended by contractor or should contractor propose using existing technologies in NIH environment? |
| NIH does not plan on purchasing any tools separately from this contract. NIH expects that the Offeror’s proposal will include both services and tools that the Offeror provides that augments our native capabilities with BigFix. |
| NIH describes “non-supported” platforms of BFI. Can NIH elaborate on non-supported platforms within the environment? |
| Anything that is a blind spot for BigFix. We expect that you will know more about that than we do. One platform that BigFix does not perform discovery is SaaS. |
| PWS, Section 7.5 and 7.6 - The PWS contains two tasks (NIH Enterprise Software Asset Lifecycle Management Program Support and Audit Readiness) which are not in the Instructions to Offeror or Evaluation Criteria. Should the information provided be limited to what is requested in the PWS? |
| For evaluation purposes, follow the instructions in the Instructions to Offerors. We are not asking any specific information from Offerors about those tasks. Thanks for asking though. |
| Under section 5.2.3 Usability can you provide additional detail as to timeframe when the evaluation of data begins? |
| The demonstrations will occur after August 19th. |
| Can you explain in more detail on Proposed Cost section and how price will be measured and evaluated? |
| We will examine the cost/price elements in your build out of your Firm Fixed Price proposal for Services and for Transition Out (a separate FFP or each). The evaluation will look for completeness, reasonableness, and risk. |
Be sure to show how the FFP is determined, the elements that go into your calculation of the total for Services and the total for Transition Out.
The T&M portion, Software Ordering, includes your fully loaded labor rates for each labor category you propose. Since a level of effort has not been determined as of this point, we will evaluate costs based on the cost realism of your proposed rates for your proposed labor categories needed for achieving the objectives in the PWS for Software Ordering. I hope this helps.
| If answer to questions have not been received, will the government be extending the due date for this RFP? |
| Yes, the due date has been modified to August 13, 2019 |
| Section 1 of RFP mentions hybrid Firm Fixed Price and Time and Materials contract. In section 6 there is mention of Services and Transition Out costs as FFP, but there is no mention of T&M anywhere else in the document besides section 1 (unless we missed it). Can NIH clarify which component(s) should be T&M? |
| PWS Section 7.7 Software Ordering (optional) is the only T&M portions of the contract. The Instructions to Offerors Section 6 Proposed Costs describes which portions are FFP and which are T&M. |
| Are there set project target dates? Any other time limitations/considerations that we should consider in our proposal |
| Nothing is set in stone, but we are interested in beginning the process of connecting with procurement data in FY20. |
| Is NIH under any internal findings (e.g. OIG) that are time-sensitive and related to this proposal? |
| Other than we lack an automated inventory at the enterprise level, no. |
| Do you have an internal change management (OCM)/communications team or is that something your partner will completely own? |
| Change management and communications are out of scope for the Offeror. NIH will own this work. |
| Do you have an outsourcing model that we need to consider or third-party providers you are working with? |
| No. |
| We understand that ServiceNow is currently being used at NIH |
| Yes. |
| What version is NIH currently on? Are there any immediate plans to upgrade? |
| Kingston. Within 6 months to a year we may move to either London or Madrid. The SAM instance is on London soon to be upgraded to Madrid once Fedramp compliant |
| Is NIH licensed for Software Asset Management Professional? |
| Yes. This was licensed for use for managing Microsoft licenses under a separate initiative. There has been no determination about whether that approach will be adopted by the NIH Enterprise Software Asset Lifecycle Management Program. |
| If yes, have you already installed the plugin and publisher packs? If so, which packs? |
| The SAM module includes 7 different publisher packs that are automatically activated (Microsoft, Adobe, IBM, Oracle, Citrix, SAP and VMware). |
| What applications and processes are currently being used? |
| SAM and Knowledge. |
| How many instances will you have in your organization? (example: DEV, TEST, PROD) |
| DEV and PROD |
| Is there any data separation between ICs? |
| Yes, there are several instances of BigFix which are being connected. However, each IC will be accessing the same ServiceNow instance. |
| If yes, is the ServiceNow instance domain separated? |
| No. |
| What tool(s) do you use to manage the Agile process? We typically recommend the use of the Agile instance within ServiceNow can expedite the project. Please let us know if you are open to using that capability. |
| Currently building stories in Agile Development plugin. |
| What type of training is most effective for your organization when rolling out new systems? Should we focus on personalized training for each major application/user group or would we be working with an internal training team on crafting the materials? |
| Training is not in the scope of work, though we do expect that members of ICs will be able to access the inventory to see their software. |
Is NIH willing to separate this into two separate proposals?
#1 – Software Asset Management implementation in ServiceNow (with OCM and training) #2 – Ongoing operational asset management activities (includes processing orders, procurement, on-going license management/compliance, sourcing advisory and negotiations, etc.)
No. We have thought through our needs and reflected those needs in the PWS. If we thought wrong, we will regroup prior to determining next steps.
| How is hardware asset management handled today? How does NIH foresee this project intersecting with existing hardware asset management tools and processes? |
| Same boat as software asset management. We are taking baby steps now, so we will see how they intersect in the future at some point. |
| Can NIH share any network topology visualizations? If not, can you please share the number of data centers and offices that would be included in this implementation? |
| A network topology is sensitive information, which we cannot share prior to an award. NIH has 35 data centers, two of which will close by the end of FY2020. I’m not sure what is meant by “Office”. |
| Can NIH articulate where the "gaps" are in BigFix's software asset inventory and usage data? What are the "BigFix’s unsupported platforms" (5.2.1.a.i) that exist in the NIH environment? |
| SaaS |
| Does NIH currently use ServiceNow Discovery? |
| No. |
| If not, is there any intent to implement it as part of this effort? |
| If it is part of the awarded solution. |
| Does NIH have any software distribution/inventory tools aside from BigFix (i.e. Microsoft SCCM or JAMF) that can collect software usage data or possibly deploy/un-install software? |
| The NIH ICs use a variety of different tools including SCCM, JAMF, Solarwinds, and BigFix. |
| If no, is there any intent to implement these as part of this effort? |
| No. |
| We understand that NIH is using Prism for contracts. Is Prism specifically being used for Purchase Orders as well? Are there any other ERP systems being used other than Prism? |
| PRISM is used for Purchase Orders. PRISM supports Contracts and Simplified Acquisitions. PRISM interfaces with NBS. NBS is an implementation of Oracle Federal Financials. No other ERP systems used. |
| If no, does NIH intent to use ServiceNow for procurement activities or is another tool handling this? |
| There is no plan to use ServiceNow in the procurement process. |
| If another tool, what tool is being used? |
| NIH has a custom developed tool (Purchasing Online Tracking System) which is a centralized ordering system that is comprised of many peripheral components that ties into the NBS accounting system. |
| Is there a desire to integrate systems? |
| We expect to integrate only with Prism. |
| Does NIH have whitelists and blacklists for software? |
| NIH does not maintain a whitelist of software currently. A limited blacklist of items such as Kaspersky or P2P. |
| Known integrations include BigFix (software inventory/usage), Splunk (software inventory/aggregation), Prism (contract/license/entitlement data). Are there any others we should consider including? |
| Not at this time. |
| We understand there will be areas of NIH's environment that cannot be discovered/scanned by BigFix, ServiceNow Discovery or other similar tools. If this is true, can NIH provide more information on these areas and how data would be collected? |
| SaaS |
| In Section 5.2.2.b of the Instructions to Offeror, the Government states “Abbreviated resumes for key personnel and letters of commitment (not included in the page count) are required for all proposed staff.” Can the Government clarify, are resumes and letters of commitment required for key personnel only or for any personal proposed regardless of key vs. non-key? |
| We are asking for letters of commitment for all personnel that are proposed. If there is a resume as part of the proposal, we also expect a letter of commitment. Good question. |
| In Section 5.2.3.a of the Instructions to Offeror, the Government states “Provide a two-hour tour of your analytical capabilities to NIH evaluators, ensuring that you describe how the analytics support NIH PWS objectives.” Can the Government clarify, is the expectation that the Offeror will demonstrate the functionalities of a vendor-selected tool or that the Offeror will demonstrate the analytical capabilities of the team regardless of method? |
| That is interesting. Yes, provide that analytical capabilities of your tool and if those capabilities are augmented by team members, please describe those capabilities further. |
| In Section 5.2.3.a of the Instructions to Offeror, the Government states “Provide a two-hour tour of your analytical capabilities to NIH evaluators, ensuring that you describe how the analytics support NIH PWS objectives.” Can the Government clarify, what information and/or technologies will be Government-provided vs. Offeror-provided for this demonstration |
| Any tools other that BigFix and Splunk will be Offeror provided. We expect that you will demonstrate the tools you are brining to the table as part of the solution. |
| Could the Government please clarify if it has a specific tool preference to accomplish the work outlined in the PWS? |
| No preference, we are seeking your recommendations. |
| Could the Government please clarify what tool(s) are currently implemented to meet the needs of software asset management at NIH? |
| That is not possible to say, since each IC has a different view of what SAM means to them. Their expectations of SAM may not be the same as the OCIO’s expectation for SAM. For instance, some people claim that Splunk is a SAM tool. |
A recently awarded contract with Dell is standing up a ServiceNow solution for the purpose of tracking and managing Microsoft licenses.
This acquisition is interested in attaining the best value for achieving the objectives stated in the PWS for NIH regardless of the ServiceNow solution (which is specifically targeting only Microsoft licenses). This acquisition will be evaluated without regard to any other SAM solutions (planned or otherwise) in the NIH environment. The Offeror-provided solution may eventually replace the Microsoft-only solution.
| Please see page 9 of the RFP and page 10 of the PWS. The Government has stated that “approximately three to five full time equivalents (FTE) will be needed throughout the period of performance (not including optional services).” On page 17 of the PWS, the Government has only defined roles for the Program Manager and Subject Matter Experts. Could the Government please provide more detail about the responsibilities of the Subject Matter Experts? |
| The Subject Matter Experts are responsible for implementing the solution you propose and are part of your staff. |
| Could the Government please clarify how much of our proposed team would be devoted to the implementation and operations and maintenance (O&M) of the SAM tool we propose versus the analysis and recommendations for SAM? |
| We would like you to propose the mix that you think is needed. |
| Please see page 6 of the RFP. The Government states in 5.2.2 (b): “Abbreviated resumes for key personnel and letters of commitment (not included in the page count) are required for all proposed staff.” Could the Government please clarify if it means that Resumes and Letters of Commitment are required only for Key Personnel? |
| I see how that is confusing. We are asking for letters of commitment for all personnel that are proposed. If there is a resume as part of the proposal, we also expect a letter of commitment. |
| Could the Government please confirm that both Resumes, and Letters of Commitment do not count as part of the 30-page limit for Sections 1 to 5 in Volume 1? |
| Only the Letters of Commitment do not apply to the total page count. |
| Please see page 6 of the RFP. The Government states in “5.2.3: Usability (Section 4)” that the following is required: (a) “a two-hour tour of your analytical capabilities” and (e) “a demonstration of how your proposed solution will take BigFix or Splunk data and generate discrete and accurate inventory items”. Could the Government please clarify when we would have to give the tour and demonstration? |
| The demo will be scheduled after the proposals are submitted, and scheduling will most likely begin on the week of August 19th. |
| Audit Readiness in PWS not in RFP. Is this correct or should it be included in the RFP response? |
| Correct. For evaluation purposes, follow the instructions in the Instructions to Offerors. We are not asking any specific information from Offerors about the audit task. We figured we asked you enough already. |
2 | Page
