Attachment L1 with Contractor Questions with Answers.xlsx
XLSX spreadsheet 33 KB Posted
- Attached to
- eDiscovery software, capability and support
- Solicitation number
- 842015609
- Issued by
-
Defense Information Systems Agency
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Attachment L2 Pricing Template Revised 31 Aug 20.xls | XLS spreadsheet | |
| HC108420R0008 0004 amendment.docx | DOCX document | |
| Attachment L3 DD254.pdf | ||
| HC108420R0008 0004 conform.docx | DOCX document | |
| RFQ 842015667 AMD03.docx | DOCX document | |
| HC108420R0008 0002.docx | DOCX document | |
| HC108420R0008 0001.docx | DOCX document | |
| HC108420R0008 Final.docx | DOCX document | |
| Attachment 2 Executive Order 12333.pdf | ||
| Attachment 3 Risk Management Framework by Acquisition Phase.pdf | ||
| Attachment 1 eDiscovery Technical Requirements.xlsx | XLSX spreadsheet | |
| Attachment L1 - Questions and Answers.xlsx | XLSX spreadsheet | |
| Attachment L2 Pricing Template.xls | XLS spreadsheet |
Show all 13
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Q&A
| RFP Page | RFP Section/ Paragraph | CLIN/ Clause/Appendix/Attachment/Other | Questions/Comments/Recommendations | Government Response | |
| 45 | 6.1.2 | One of the requests on page 45 is a monthly report. Can you clarify specific deliverable examples for "Monthly Performance and Progress Report (MPPR) that describes project progress and usage status." | Monthly reports should include, at a minimum, the number of cases in the system, the amount of data per each case, whether the case is actively being worked by government staff, and the number of personnel logged into the system over the past month. | ||
| 46 | 6.2.1, 2nd bullet | eDiscovery Capabilities – we must be capable of “supporting internal agency hardware and software.” Can we get a list of specific hw/sw currently being used at DISA? | The solution must be compatible with Microsoft Internet Explorer, Google Chrome, and Mozilla Firefox. The government will modify the PWS to remove the requirement for internal hardware and software support. | ||
| 46 | 6.2.1, 10th bullet | "• | Provide required subject matter expert points of contact (POCs) to assist DoD personnel with addressing technical and functional issues as necessary." What is the role of the SME POCs (related to item 1 – are these people who are going to help consult on a regular basis?) How does this fall outside of the scope of standard support? Can you clarify? | The government requires technical points of contact from the selected vendor to assist government personnel if there are functional issues or questions about technical features of the solution. | |
| 48 | 6.2.12, 1st bullet | there is a requirement for Presentation display capabilities. Would it be sufficient to export to a format that could be used in Display? | It would be sufficient to export to a format that could be used in Display. | ||
| 52 | 6.4.1 | can you clarify the requirement to be "hosted in a cloud environment FedRAMP (HIGH) supporting unclassified at an Impact Level 5 and a classified Impact Level 6. Specifically, is it acceptable to be hosted in a FedRAMP (HIGH) environment (i.e., AWS GovCloud)? Is operating in a .mil cloud an option? And what will DISA do should there be no viable options for FedRAMP HIGH responses? | The selected application must be hosted in DISA Impact Level 5 certified cloud environment for DoD CUI information and at Impact Level 6 certified cloud environment for information classified up to SECRET. There are several cloud offerings that meet the above impact levels and the government expresses no preference in the selected cloud environment. | ||
| 44 | PWS. #4 | The objective is to provide OGC with a user-friendly Federal Risk and Authorization Management Program (FEDRAMP) approved software as a service (“SaaS”) solution at Impact Levels-5 and 6 that meets the requirements in this document and has the required security controls and data protection Will DOD DISA accept an eDiscovery platform that is not authorized to IL 5+6? would an eDiscovery platform that is authorized to FEDRAMP Moderate be acceptable?? | No, the government will not accept a FedRAMP (MODERATE) instance. | ||
| 44 | PWS. #4 | Would DoD consider on premise licenses to be installed on DoD Infrastructure in stead of SaaS? | No. | ||
| N/A | N/A | N/A | What system(s) is DISA currently using to meet this requirement? | This is a new requirement. | |
| N/A | N/A | N/A | Is DISA planning to augment their existing eDiscovery system or is DISA planning to replace their existing eDiscovery system? | This is a new requirement. | |
| N/A | L | Attachment L2 | Is the total planned data volume for this contract 5TB or is DISA planning to purchase data in 5TB subscriptions? For example, in Year 1 DISA may purchase 15TBs in three 5TB subscriptions? | The planned volume for this contract is for 5TB of active data on each instance. | |
| N/A | L | Attachment L1 | "The delivered solution must be capable of holding and maintaining up to 100 TB of data (OGC databases, images, native documents) with growth of approximately 30% per year. If vendor faces a maximum storage capability, vendor must state that maximum." --- Does DISA anticipate the data hosting volumes will be 100TB per month with the potential to grow an additional 30% per year? If yes, how does this align with the pricing CLIN in (Attachment L2) for 5TB per month annually? | No, the government does not anticipate hosting volumes to be 100TB per month at this time. | |
| 44 | 4. Objectives | "The objective is to provide OGC with a user-friendly Federal Risk and Authorization Management Program (FEDRAMP) approved software as a service (“SaaS”) solution at Impact Levels-5 and 6 that meets the requirements in this document and has the required security controls and data protection functions to comply with all Federal and Department of Defense (DoD) requirements. " ---Is it acceptable for the vendor to install their solution in the milCloud to meet the FedRAMP Impact Levels 5 and 6 requirements? | No. The solution must be installed in IL5 (for the UNCLASS instance) and IL6 (for the SECRET instance) commercial cloud environments. | ||
| N/A | N/A | N/A | What is the clearance level required for all staff working on the DISA contract? | Appropriate facility and personnel clearances will be listed in the DD254, which is pending, for this procurement. | |
| Attachment L2 | The PWS lists several services (i.e. project management, status reporting, functional user support, training, etc.). However, the pricing, Attachment L2, only includes a line item for hosting cost. Can DISA add a CLIN for labor services to the pricing, Attachment L2 and provide more clarity regarding the services required? | This requirement is to be satisfied by a SaaS solution that includes these services in the hosting cost. Attachment L2 has been modified appropriately. | |||
| N/A | N/A | N/A | Did DISA conduct market research prior to issuing this solicitation? If not, we recommend DISA have an industry day and a demo/proof of concept phase as part of the solicitation to ensure DISA procures the right solution that meets both the security and functionality requirements. | The government conducted market research in beta.SAM Notice ID: HQ0034-19-R-2017. | |
| 44 | 3 | Our understanding is there is not presently an IL5 or IL6 environment that includes an eDiscovery solution and therefore this activity will start fresh. Does the government have a desired operational standpoint (e.g. within 120 days of procurement). | The UNCLASSIFIED instance of this application must be operational within 2020. | ||
| 44 | 4 | The RFP covers both an IL5 and IL6 instance which must be separate. Please confirm that the government is requesting a bid for two environments. | Correct. Each instance must be in a separate cloud environment. | ||
| 45 | 6.1.2 | Please clarify what all end user support is anticipated. We provide a SaaS Discovery Solution for our clients and our support services include login issue, technical "how do I …." issues, etc. It is unclear where end user support starts and stops for this effort | End user support includes creating user accounts, assistance with login issues, and technical support. | ||
| 49 | 6.2.7 | The Collection section references that the system needs to be capable of importing ESI and integrating with commonly used applications. Is the technical process of integration included in this procurement scope, or only the ability of the system to support such integration | The solution must be be able to support import of ESI load files from other eDiscovery platforms. | ||
| 45 | 6.1.1 | Subtask 1 references a minimum 99.900% service availability. Is that threshold inclusive of routine maintenance windows, planned upgrade periods, and other scheduled periods of service interruptions? | No. | ||
| 45 | 6.1.1 | Can the government clarify this statement: "From the start time that a service is unavailable to the time the service becomes available, consumers shall not be charged by the Contractor for the use of that service. The contractor shall provide all upgrades, updated cloud versions timely during non-busy times." Is the expectation that fees will be decremented during maintenance windows? Are non-busy times considered outside 0800-1800 M-F and federal holidays? | Yes. The government will decrement fees for maintenance windows during normal operational hours of 0800-1800 EST, Monday through Friday. The government will not decrement fees for maintenance windows outside of operational hours. |
Jacobs, Michael H CIV DISA PLD (US): Jacobs, Michael H CIV DISA PLD (US):
This question had multiple questions, please clarify if "yes" is for both qestions?
| 45 | 6.1.2 | Are vendors expected to provide a dedicated ticketing system or will tickets be managed in a government hosted application via DISA or DSLA? | The contractor shall provide a dedicated ticketing system. |
| 45 | 6.1.3 | Assume all training can be delivered virtually? Will the government access to the collaboration service (DCO, Teams, Zoom, etc.)? | Training shall be conducted virtually. Vendors shall provide access to the training and all materials in accordance with the PWS. |
| 46 | 6.2.1 | Regarding the following requirement: "Permit electronic files processing of any ESI from supporting internal agency hardware and software or provided by third parties pursuant to industry standards." Does this mean there will be integration points with external systems hosted by other agencies? | No. The solution will not need to integrate with external systems hosted by other agencies. |
Jacobs, Michael H CIV DISA PLD (US): Jacobs, Michael H CIV DISA PLD (US):
I don't think this response adequately answers the question. They are obviously unclear on the requirement. If you are going to say their interpretation is incorrect, then provide what the interpretation is
| 46 | 6.2.1 | "Manage various types of ESI from one central point accessible by web browser." What does the government mean by "one central point"? | All of the cases hosted in the software application shall be accessed through one central web-based interface. | |
| 46 | 6.2.1 | "Provide DoD attorneys, Access Professionals, and others that require access in different locations access to each case or cases as necessary." Will the government manage and approve users that require access to the system? | The government will approve the users for the system. The vendor will create accounts for users to access the system. | |
| 46 | 6.2.1 | How should the following services be priced in the proposal: "Provide required subject matter expert points of contact (POCs) to assist DoD personnel with addressing technical and functional issues as necessary." | The government defers to vendors on how to structure pricing. | |
| 46 | 6.2.1 | Can the government define "expeditiously" as used in the following statement: Provide customer support and maintenance so that troubleshooting and errors can be resolved expeditiously. | The government expects responsive and timely service when encountering issues with the software application. | |
| 46 | 6.2.1 | What are the RPO/RTO targets associated with this requirement: Provide routine (e.g. daily) system backups and disaster recovery of all data stored in the Proposed Solution. | Solutions shall maintain a 4-hour RTO target and a 24-hour RPO target. The PWS has been modified to reflect these targets. | |
| 47 | 6.2.4 | Can the government clarify the high availability expectations on the following statement: High Availability - Acts as an enterprise service offering to DoD OGC users, thus requiring high availability through redundancy and effective service restoration capabilities. | Solutions shall maintain a 4-hour RTO target and a 24-hour RPO target. The PWS has been modified to reflect these targets. | |
| 50 | 6.2.9 | Can the government clarify this requirement: "Portal for Non-OGC Users – Proposed Solution allows DoD users to grant access to non-DoD users to access the Proposed Solution via web-based portal for limited review of data on both the NIPR and SIPR platforms. Proposed Solution shall further allow DoD users to tailor role-based access for each non-DoD user to limit the cases available, functionality of the Proposed Solution for the non-DoD user (e.g., limiting the ability to print documents from the Proposed Solution), and to create reports for what the non-DoD user has done while logged into the Proposed Solution." This requirement implies the need for a "high to low" solution that enables unclassified users to access data and services that are hosted in the classified system. | Non-DoD attorneys or personnel (e.g., DOJ personnel) will need access to various cases for coordination on documents. Non-OGC/DoD personnel will have an appropriate security clearance, and will access the portal from computers authorized to process that same level of information. The government requires the ability to create a guest account at the appropriate classification level for these users. There is no need for a cross domain solution as the question contemplates. Rather, non-DoD users will access the instance with pre-existing approved accounts on networks that can support the classification level. | |
| 52 | 6.4.1 | The following statement implies the need for TWO separate systems operating at IL-5 and IL-6: "The contractor shall provide all required DoD RMF Security Control Artifacts necessary to achieve an Authorization to Operate (ATO), to include follow-on continuous monitoring activities. The e-Discovery solution shall be hosted in a cloud environment FedRAMP (HIGH) supporting unclassified at an Impact Level 5 and a classified Impact Level 6." Can the government please clarify? | There shall be two distinct instances. One instance at the IL5 level and a separate and distinct instance at the IL6 level. The IL5 instance would support unclassified information and the IL6 instance would support classified information up to the SECRET classification level. | |
| 52 | 6.4.1 | The government identifies requirements for other non-production environments: "The Contractor shall provide all required integrated implementation environments for all applications included in the SaaS solution and ensure that all environments can be promoted to one another (development to test and test to production).The Contractor shall not host any portion of the environment in facilities outside the contiguous United States, Alaska, Hawaii, and other U.S. Territories." Does the government contemplate any other non-production environments? | No. | |
| 52 | 6.4.2 | Will the government assign a dedicated ISSM to coordinate C&A activities? | The government will assign an ISSM. | |
| 55 | 6.5.3 | Can the government clarify the following requirement: "All information systems shall be considered to be moderate-moderate-low (Confidentiality-Integrity-Availability) for the System Security Plan (SSP) unless otherwise notified in writing. The solution shall comply with the security control requirements documented in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53r4, “Security and Privacy Controls for Federal Information Systems and Organizations.” " M/M/L posture is much lower than what's available in IL-5 or IL-6 regions. | The PWS has been modified. | |
| 56 | 6.5.4 | Does the government expect the vendor to provide physical and cyber security for all end user devices accessing the solution? | No. The contractor will only support cyber security activities for the SaaS software application and not end user computer systems. | |
| 44 | 4 | Will the government consider a phased approach to achieving FedRAMP High certification and a DoD PA at IL5 and IL6? | No. The government will not accept a system accredited at a lower certification or impact level that is upgraded later. | |
| 44 | 4 | Would the government consider an on-premises system for the first year until FedRAMP High certification and a DoD PA is achieved at IL5 and IL6? | No. The government contemplates a SaaS cloud solution. | |
| 44 | 4 | Would the government consider purchasing an on-premises system on a subscription basis? | No. The government contemplates a SaaS cloud solution. | |
| 44 | 4 | Would DISA, OGC, and/or DLSA consider sponsoring the vendor for FedRAMP certification and the DoD PAs at IL 5 and IL6? | The government would consider sponsoring the selected vendor for a PA at IL6. However, the vendor must demonstrate that it meets the enumerated technical requirements. | |
| 45 | 6.1.3 | Is on-line training sufficient to meet the requirement to deliver training where OGC personnel are located ? | Yes. On-line training is the preferred delivery method for this requirement. | |
| 45 | 6.1.3 | Is training required to be delivered on-premises where OGC personnel are located? | On-line training is the preferred delivery method for this requirement. No on-premises training is expected for this requirement. | |
| 45 | 6.1.3 | Where are OGC personnel located? Please provide list of cities/states with number of users in each location. | The requested SaaS software application must be accessible via a single sign-on portal that is not dependent on access from a specific location. | |
| 3 | B | Attachment L2 | What assumptions should vendors make in defining ODCs, to include travel? | Travel is not contemplated under this procurement. |
| 48 | 6.2.5 | Is litigation hold a place-holder or optional requirement? The use of the word "may" could be interpreted that way. | Litigation hold processes are considered essential tasks for this requirement. Offerors integrating third-party litigation hold capabilities are acceptable if they meet the same security requires and the goverment does not need to work with another vendor. | |
| 45 | 6.1.3 | If on-premises training is required, what will the minimum, average, and maximum classroom sizes be? | On-line training is the preferred delivery method for this requirement. No on-premises training is expected for this requirement. | |
| 46 | 6.2.1 | The RFP states a minimum of 200 named users will be supported. How many users and/or what percentage of users will be on IL6? How many users and/or what percentage of users will require access to both IL5 and IL6? | All 200 users shall have access to both UNCLASSIFIED and CLASSIFIED environments. | |
| 3 | B | CLIN 0001 | "The contractor shall provide Software as a Service Cloud 5 TB monthly subscription for the capability, services, and training to support an eDiscovery capability in accordance with (IAW) the Performance Work Statement (PWS) and technical requirements Attachment 1." |
| Please provide a breakdown of how the data will be distributed between the IL5 and IL6 clouds. | Both the IL5 and IL6 instances shall be 5 TB. | ||||
| line 7 | Attachment 1 eDiscovery Technical Requirements | The attachment states the delivered system shall be capable of maintaining classified documents...presumably on a segregated system. Please provide definition of a segregated system and the source document, i.e., NIST FIPS, ISO, etc., for that definition. | There shall be two distinct instances. One instance at the IL5 level and a separate and distinct instance at the IL6 level. The IL5 instance would support UNCLASSIFIED information and the IL6 instance would support CLASSIFIED information up to the SECRET classification level. The IL6 instance must be accessible by SIPRNet. | ||
| 52 and 58 | 6.4.1 and 12 Delivery Schedule, RMF Artifacts and SaaS Solution with ATO IL5 and IL6 | Please clarify schedule for required deliverables. The RFP states RMF artifacts are required and required to be delivered on an as-required basis (in the delivery schedule). Are FedRAMP High and IL5 and IL6 PATO/DoD PA, ATO artifacts required to be delivered at the start of the period of performance? If not then, when are they required to be delivered? The RFP states a SaaS solution with an ATO at IL5 and IL6 is required to be delivered at the start of the period of performance (delivery schedule). Is a SaaS solution with at ATO at IL5 and IL6 required to be delivered at the start of the period of performance? |
| Is the ATO or Artifacts necessary to achieve an ATO required at the start of the period of performance? | No. The artifacts will be gathered and delivered during the implementation phase of the solution in support of system accreditation and periodically after to support continuous monitoring requirements (as artifacts change). | ||||
| general | general | Attachment 1 eDiscovery Technical Requirements | If the SaaS product cannot fully meet a required technical feature, is a scheduled commitment to develop the feature acceptable in this proposal? | No. The government requires the vendor to meet the ITFRs set forth at the time of award. | |
| lines 26-60 | Attachment 1 eDiscovery Technical Requirements | Is a third party solution to implement legal hold functionality an acceptable solution to this RFP? | Yes, provided the third-party solution is integrated with the SaaS solution on the back-end and meets the same security requirements. | ||
| 44 | 4 | Has the government considered requiring/accepting an on-premises system, which DISA will host in their cloud? Would the government accept this as a solution in a proposal response to this RFP? | The government will not accept an on-premises solution for this requirement. | ||
| 44 | 4 | What is the government's plan if there are no bidders capable of delivering a SaaS capability with a FedRAMP High certification and IL 5 and IL6 ATO at the start of the period of performance? | The government will re-evaluate its requirement if this is the case. | ||
| Attachment 1 | Can DoD provide a complete list of data sources that are in scope for data collection? | No. Each individual case has different data sources within its scope. | |||
| How much data (volume and item count) will need to be processed for an average case? | Each individual case is different and has unique data requirements. The government estimates 5TB of active data across all cases. | ||||
| How many cases are typically active at any one time? | Case counts vary greatly at any given time. The government estimates 5TB of active data across all cases. | ||||
| What is the average export size (volume and item count)? | This is a new requirement; the government does not have this information. | ||||
| For granting specific access for non-DoD employees, would DoD be providing credentials, or is DoD looking for the system to be the authentication provider for those users? | The government will develop a work-flow whereby the government approves non-DoD users for account access and then will provide approval to the vendor for account creation. | ||||
| Attachment 1, Line 62 | It was stated that the system needs to ingest audio files - does that audio need to be indexed and searchable? If so, how many hours of audio does DoD anticipate needing to indexed at a given time? | This is a new requirement; the government does not have this information. | |||
| 3 | 1 | It was stated that a 5 TB monthly subscription is needed, but unlimited processing, productions, and exports were included in that. Can DoD clarify what is meant by the 5TB number, and how much active case data DoD intends to have under review? | The government contemplates 5 TB of active data on each instance. | ||
| Attachment 1 | Can DoD provide the number of SharePoint servers are in scope for collection? | The government does not expect to use this software application for collection. | |||
| How many different data centers or office locations have data that will need to be collected? | The government does not expect to use this software application for collection. | ||||
| 44 | 4 | Objective | our solution is FedRAMP and therefore IL 2, but in the process of getting 5, is this acceptable or is the solution provider to be IL 5 or 6 at the time of this award? | The PWS has been updated to require the IL5 (UNCLASSIFIED) instance be operational within 120 days of award and the IL6 (SECRET) instance be operational within one year of award. A FedRAMP (MODERATE) instance is not acceptable for this requirement. |
Jacobs, Michael H CIV DISA PLD (US): Jacobs, Michael H CIV DISA PLD (US):
This seems to walk back the PWS requirement for IL5/6 -- It should be reworded. The PWS does not "desire" a solution for IL5/IL6, it REQUIRES it, correct? If that is the case, then that is the requirement. -- This same note is applicable to Line 71, Column E
Jacobs, Michael H CIV DISA PLD (US): Jacobs, Michael H CIV DISA PLD (US):
| This question had multiple questions, please clarify if "yes" is for both qestions? | 54 | 6.5.2 | Subtask2 - Cybersecurity strengths requirements | Does the vendor need to have two separate networks, one for classified and another for unclassified? | Yes. |
| 51 | 6.4.1 | Subtask1 - Hosting requirements | Does DISA have an incumbent? Is this project being treated as a Pilot? | This is a new requirement. | |
| 51 | 6.4.1 | Subtask1 - Hosting requirements | Which (if any) eDiscovery software applications does DISA currently use as of today? | This is a new requirement. | |
| 1 | 8 | Offer Due Date/ Local Time | Would the Governent consider setting the due date for the response to August 31, 2020 | The RFP deadline has been extended to 31 August 2020. | |
| 44 | 4 | FedRAMP Status: Is FedRAMP HIGH a requirement at the beginning of the solicitation, or will there be an opportunity once awarded the contract to obtain that level of security? | The PWS has been updated to require the IL5 (UNCLASSIFIED) instance be operational within 120 days of award and the IL6 (SECRET) instance be operational within one year of award. A FedRAMP (MODERATE) instance is not acceptable for this requirement. |
Jacobs, Michael H CIV DISA PLD (US): Jacobs, Michael H CIV DISA PLD (US):
This seems to walk back the PWS requirement for IL5/6 -- It should be reworded. The PWS does not "desire" a solution for IL5/IL6, it REQUIRES it, correct? If that is the case, then that is the requirement. -- This same note is applicable to Line 71, Column E
Jacobs, Michael H CIV DISA PLD (US): Jacobs, Michael H CIV DISA PLD (US):
I don't think this response adequately answers the question. They are obviously unclear on the requirement. If you are going to say their interpretation is incorrect, then provide what the interpretation is
Instructions
| Q&A INSTRUCTIONS: The purpose of these specific instructions is to expedite the process of answering questions. Please do not change the format of this document. |
| Complete the spreadsheet tab below named "Q&A" with all questions, comments, and recommendations about the RFP. Examples provided in the spreadsheet. **Please delete the examples before submitting your questions. |
COLUMN A: Complete the "Page" column. This is the page number from the RFP located in the upper right hand corner of the page. Do not include the total page number. Enter only the page number where the topic begins.
COLUMN B: Complete the "Section/Paragraph" column with the applicable section and paragraph number (if applicable) of the RFP. For example: B2, C, or L5.1.2. For a section and paragraph number reference do not place a dot between the letter and the first number. Additional subparagraph references should be separated with a dot regardless of the format in the RFP, for example, L5.1.2.a. Do not including any other extraneous identifiers or other information other then instructed here. If the reference is to a CLIN, Clause, Appendix, or Attachment etc. the entry goes in the next column. At a minimum you will always insert at least the Section letter A through J in this column.
COLUMN C: Complete the "CLIN/Clause/Other" column. Insert the CLIN, Clause, Provision, Appendix, or Attachment number. For example: CLIN 0001, 52.217-8, Appendix A, or Attachment L3. Insert the section letter only in the Column B. This column will be completed only when there is not a more precise RFP reference number. NOTES: CLINs are in Section B. Most sections contain clauses so ensure you reference the correct section.
COLUMN D: Complete the Questions/Comments/Recommendations column. Start the question by referencing the topic. This may help the sort process. For example: Minimum Qualifications Checklist or Performance Area 10. Then insert the question or comment.
Issues must be submitted to the Contracting Officer and Contract Specialist listed in L2.1.1
File details come from the government source that posted it. Updated .