HC108420R0008 0004 amendment.docx

HC108420R0008

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

The following have been modified:

SECTION L

SECTION L

INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS OR RESPONDENTS

LIST OF SECTION L ATTACHMENTS

Attachment L1 - Question & Answer Template Attachment L2 - Pricing Template Attachment L3 – DD254

L1 – INFORMATION TO OFFERORS

L1.0 Program Title and Objectives: eDiscovery software, capabilities and support. The objective is to provide OGC with a user-friendly Federal Risk and Authorization Management Program (FEDRAMP) approved software as a service (“SaaS”) solution at Impact Levels-5 and 6 that meets the requirements in this document and has the required security controls and data protection functions to comply with all Federal and Department of Defense (DoD) requirements.

L2.0 General Instructions

L2.0.1. This section of the Information to Offerors provides general guidance for preparing proposals as well as specific instructions on the format and content of the proposal. The offeror's proposal must include all data and information requested by the RFP and must be submitted in accordance with these instructions. The offer shall address all aspects of the Performance Work Statement (PWS). The offeror also must complete Attachment 1 eDiscovery Technical Requirements by confirming they can meet all technical capabilities listed. Non-conformance with the instructions provided in this Information to Offerors may result in removal of the proposal from further evaluation.

L2.0.2. The proposal shall be clear, concise, and shall include sufficient detail for effective evaluation and for substantiating the validity of stated claims. The proposal should not simply rephrase or restate the Government's requirements but rather shall provide convincing rationale to address how the offeror intends to meet these requirements. Offerors shall assume that the Government has no prior knowledge of their capabilities and experience and will base its evaluation on the information presented in the offeror's proposal.

L2.0.3. Elaborate brochures or documentation, binding, detailed art work, internet hyperlinks, or other embellishments are unnecessary and are not desired.

L2.0.4. The offeror shall make a clear statement in Volume I cover page that the proposal is valid for a minimum of 120 days from the proposal due date.

L2.0.5. In accordance with (IAW) FAR Subpart 4.8 (Government Contract Files), the Government will retain one digital copy of all unsuccessful proposals.

L2.0.6. Portions of the successful offeror’s proposal may be incorporated into the contract as an attachment in Section J.

L2.1 General Information

L2.1.1. Point of Contact.

The contracting officer (KO) and the contract specialist (CS) are the sole points of contact for this procurement. Address any questions or concerns to the Contracting Officer, Lisa O. Cravens, lisa.o.cravens.civ@mail.mil, 618-418-6295 or Contract Specialist, Michael H. Jacobs, michael.h.jacobs1.civ@mail.mil, 618-418-6707. Written requests for clarification must be sent to the KO at the email address located in clause G1.

L2.1.2. Debriefings.

The KO will notify unsuccessful offerors of the source selection decision in accordance with FAR 15.503. Upon such notification, unsuccessful offerors may request and receive a debriefing. Offerors desiring a debriefing must make their request in accordance with the requirements of FAR 15.505 or 15.506, as applicable. Excluded offerors are only entitled to one debriefing for each proposal.

L2.1.3. Discrepancies.

If an offeror believes that the requirements in these instructions contain an error, omission, or are otherwise unsound, the offeror shall immediately notify the KO in writing. The offeror is reminded that the Government reserves the right to award this effort based on the initial proposal, as received, without discussions.

L2.1.4. Electronic Reference Documents.

All referenced documents for this solicitation are available on the beta SAM web site at https://beta.sam.gov. Potential offerors are encouraged to subscribe for real-time e-mail notifications when information has been posted to the website for this solicitation. The eDiscovery capability FedBizOpps web page is https://beta.sam.gov.

L2.1.5. Communications.

Exchanges of source selection information between Government and offerors will be controlled by the Contracting Officer, Lisa O. Cravens or Contract Specialist, Michael H. Jacobs. Evaluation notices and responses will be transmitted as emails and will be treated as source selection information. The subject line of the email shall be titled: “RFP HC1084R0008, Contractor Name, Source Selection Information See FAR 2.101 and 3.104.” Questions/comments are due no later than 8:00 PM (CT) on July 29, 2020. Questions submitted after the deadline may not be answered. The email address for the KO and CS are contained in para L2.1.1, Point of Contact, above. Questions/comments will only be responded to if received in email and only when submitted on Attachment L1, Solicitation Questions and Answer Template in Section L.

L2.1.6. Award without Discussions.

The Government intends to award without discussions. Therefore, the offeror’s initial proposal should contain the offeror’s best approach/terms for technical, management, past performance, and price; however, despite this intent, the Government reserves the right to conduct discussions if the Source Selection Authority (SSA) determines they are necessary. If the SSA determines that discussions are necessary, a competitive range will be established. In the event issues pertaining to a proposed contract cannot be resolved to the SSA's satisfaction, the Government reserves the right to withdraw and cancel the solicitation. In such event, offerors will be notified in writing.

L2.1.7. Organizational and Consultant Conflict of Interest (OCCI).

Each offeror shall specifically identify in its proposal whether or not any potential or actual OCCI, as described in Federal Acquisition Regulation (FAR) Subpart 9.5, exists for this procurement. If the offeror believes that no OCCI exists, the OCCI response shall set forth sufficient details to support such a position. If an offeror believes that an actual or perceived OCCI does exist on this procurement, the offeror shall submit an OCCI plan with the proposal, explaining in detail how the OCCI will be mitigated and/or avoided.

L2.1.8. Joint Venture/Partnership Agreement (if applicable).

Contractor Team Arrangements (“CTA”), as defined in FAR 9.601(1), may submit a proposal in response to this RFP.

An offeror may submit a proposal as a CTA in response to the solicitation subject to the following conditions:

1) The Joint Venture or Partnership is registered in the System of Award Management (SAM.gov) and has a corresponding DUNS Number.

2) The Joint Venture or Partnership meets the definition of a Joint Venture for size determination purposes (FAR 19.101(7)(i)).

3) The offeror must submit a complete copy of the Joint Venture or Partnership agreement that established the CTA relationship.

L2.1.9. DD254, DoD Contract Security Classification Specification.

Offerors must complete Block 6 of the attached DD254 with the appropriate information for their companies. Completed DD254’s must be submitted with proposals provided in Section J, Attachment 5. Security classification requirements must be met at time of proposal submission.

L2.2. Organization/Number of Copies/Page Limits.

The offeror shall prepare the proposal as set forth in the Proposal Organization Table (Table 1 below). The titles and contents of the volumes shall be as defined in this table, all of which shall be within the required page limits and with the number of copies as specified in Table 1. The contents of each proposal volume are described in the information to offerors paragraph as noted in the table below.

Table L 2.2 - Proposal Organization

Number

L2.2.1. Page Limitations.

Page limitations shall be treated as maximums. If exceeded, the excess pages will not be read or considered in the evaluation of the proposal. Page limitations may be placed on responses to Evaluation Notices (ENs). The specified page limits for EN responses will be identified in the letters forwarding the ENs to the offerors. Page limitations shall not be circumvented by including inserted text boxes/pop-ups or internet links to additional information; such inclusions are not acceptable and will not be considered part of the proposal. The Government reserves the right not to consider for award any proposal that does not adhere to the administrative requirements of this solicitation. Each page shall be counted except resumes, blank pages, or those identified in Table L2.2, Proposal Organization, as having no limit.

L2.2.2. Page Size and Format.

L2.2.2.1. A page is defined as each face of a sheet of paper containing information. When both sides of a sheet display printed material, it shall be counted as two pages. Page size shall be 8.5 x 11 inches, not including foldouts. Pages shall be single spaced typed with 1.5 line spacing. Except for the reproduced sections of the solicitation document, the text size shall be no less than 10 point Ariel, Times New Roman, or Courier New font for all text. The technical volume of the proposal shall be submitted as both an MSWord 2007 or newer file and as an Adobe PDF document. Tracking, kerning, and leading values shall not be changed from the default values of the word processing or page layout software. Use at least 1 inch margins on the top and bottom and ¾-inch side margins. Pages shall be numbered sequentially by volume. These page format restrictions shall apply to responses to ENs. These limitations shall apply to both electronic and hard copy proposals. It is the sole responsibility of the Offeror to ensure that the electronic files submitted are virus free and can be opened and read by the Government. Proposal submissions shall not be locked, encrypted, or otherwise contain barriers to opening. The Government is under no obligation to seek clarification regarding electronic proposal submissions if submissions cannot be opened or accessed.

L2.2.2.2. Legible tables, charts, graphs and figures shall be used wherever practical to depict organizations, systems and layout, implementation schedules, plans, etc. These displays shall be uncomplicated, legible, and shall not exceed 11 by 17 inches in size. For tables, charts, graphs and figures, the text shall be no smaller than 10 point Ariel, Times New Roman, or Courier New font for all text included in a table. These limitations shall apply to both electronic and hard copy proposals.

L2.2.3. Cost or Pricing Information All cost or pricing information shall be addressed ONLY in the Cost/Price Proposal Volumes. Cost tradeoff information, workhour estimates, and material kinds and quantities may be used in other volumes only as appropriate for presenting rationale for alternatives or design and tradeoff decisions.

L2.2.4. Cross-Referencing To the greatest extent possible, each volume shall be written on a standalone basis so that its contents may be evaluated with a minimum of cross referencing to other volumes of the proposal. Information required for proposal evaluation which is not found in its designated volume will be assumed to have been omitted from the proposal. Cross-referencing within a proposal volume is permitted where its use would conserve space without impairing clarity.

L2.2.5. Indexing.

Each volume shall contain a more detailed table of contents to delineate the subparagraphs within that volume. Tab indexing shall be used to identify sections.

L2.2.6. Glossary of Abbreviations and Acronyms.

Each volume shall contain a glossary of all abbreviations and acronyms used, and with an explanation for each.

L2.3. Electronic Offers.

Submitting proposals via email: In order to respond to this solicitation, the offeror shall email a copy of its proposal to the KO and CS not later than the time and date specified in this solicitation. In accordance with FAR 52.215-1, ALT, Instructions to Offerors, the offeror's proposal submission will be considered complete when all volumes are received.

L2.4. Distribution.

Proposals shall be addressed to the KO with a copy to the CS at the following email addresses: lisa.o.cravens.civ@mail.mil and michael.h.jacobs1.civ@mail.mil.

L3.0. Volume I Executive Summary.

In the executive summary volume, the offeror shall provide the following information:

L3.1. Narrative Summary.

The narrative summary of the entire proposal should be concise, to include addressing the significant risks, and highlighting any key or unique features, excluding cost/price. The salient features should tie in with Section M evaluation factors/subfactors. Any summary material presented here shall not be considered as meeting the requirements for any portions of other volumes of the proposal.

L3.2. Table of Contents.

Include a master table of contents of the entire proposal.

L3.3 Cross Reference Matrix. The offeror shall prepare a Cross Reference Matrix cross referencing all RFP requirements to the location of the offeror’s responses in their proposal. The Cross Reference Matrix provides reference information but is not evaluated. The offeror’s format is acceptable.

L4.0. Volume II – Technical/Management Volume.

L4.1. General.

The Technical/Management Volume should be specific and complete. Responses will be evaluated against the technical/management subfactors defined in Section M, Evaluation Factors for Award. Using the instructions provided below, provide as specifically as possible the actual methodology to be used for accomplishing/satisfying these subfactors. Do not merely reiterate the objectives or reformulate the requirements specified in the solicitation.

L4.2. Format and Specific Content.

L4.2.1. Technical/Management (Evaluation Factor 1).

In the Technical/Management volume, address the proposed approach to meeting or exceeding the minimum performance or capability requirements of each technical/management subfactor, as well as the risks in the proposed approach in terms of technical/performance, cost, and/or schedule.

L4.2.2. Volume Organization.

The Technical/Management volume shall be organized according to the following general outline:

(1) Table of Contents

(2) List of Table and Drawings

(3) Glossary

(4) Subfactor One

(5) Subfactor Two (etc.)

L5.0. Volume III - Cost/Price.

L5.1. General Instructions.

L5.1.1. Price Reasonableness and Completeness.

This section is to assist in submitting information other than pricing data that is required to evaluate the reasonableness and completeness of the proposed price. The Government will verify that all solicitation requirements have been priced, figures are correctly calculated, and prices are presented in a clear and useful format. Note that unreasonably high proposed prices, initially or subsequently, may be grounds for eliminating a proposal from competition. Additionally, unbalanced pricing poses an unacceptable risk to the Government and may be a reason to reject an offeror’s proposal. Price submissions should be sufficiently detailed to demonstrate their reasonableness and be adequate enough to support and sustain a DCAA audit.

L5.1.2. Price Information.

Pricing submitted for the base period and all option periods as well as surge pricing in Section M will be evaluated. The total evaluated price will consist of the proposed price for the base period and all option periods. Pricing will be incorporated into Schedule B and related B-Tables upon contract award and used for all orders placed post-contract award.

L5.1.3. Cost/Price Information.

Information beyond that required by this instruction shall not be submitted, unless considered essential to document or support the cost/price position. All information relating to the proposed price, including all required supporting documentation must be included in the section of the proposal designated as the Cost/Price Volume. Under no circumstances shall this information and documentation be included elsewhere in the proposal.

L5.1.4. Cost or Pricing Information Requirements.

In accordance with FAR 15.403-1(b) and 15.403-3(a), data other than certified cost or pricing data may be required to support price reasonableness. Information shall be provided in accordance with FAR 15.403-5. If, after receipt of proposals, the KO determines the required conditions of adequate competition do not exist that there is insufficient information available to determine price reasonableness and none of the exceptions in FAR 15.403-1 apply, the offeror may be required to certify its submitted cost or pricing data (see: FAR 15.406-2 -- Certificate of Current Cost or Pricing Data).

L5.2. Volume Organization.

The Cost/Price volume shall consist of the following sections:

SECTION 1 Table of Contents; summary descriptions of estimating, purchasing, and accounting systems; changes to estimating, accounting practices, or Cost Accounting Standards (CAS) Disclosure Statement.

SECTION 2 Cost or pricing information and supporting data, to include estimating methodology. The final pricing must be submitted on Attachment L2 Pricing Template.

L6.0. Volume IV –Contract Documentation.

L6.1. The purpose of this volume is to provide information to the Government for preparing the contract document and supporting file. The Offeror's proposal must include a signed copy of the solicitation and completion of the Standard Form (SF) 1449.

L6.1.1. Solicitation/Contract Form.

Completion of blocks 30A/ B of the SF 1449. Signature by the Offeror on the SF1449 constitutes an offer, which the Government may accept. The "original" copy should be clearly marked under separate cover and should be provided without any punched holes.

L6.1.2. Supplies or Services and Costs/Prices.

Completed pricing information in the SF1449 of the RFP.

L6.1.3. Deliveries or Performance.

Proposed Delivery Schedule. The offeror shall propose the delivery schedule by completing the blanks of the SF 1449 of the RFP.

L6.2. Other Information Required.

L6.2.1. Authorized Offeror Personnel.

Provide the name, title, and telephone number of the company/division point of contact regarding decisions made with respect to your proposal and who can obligate your company

L6.2.3. Company/Division Address, Identifying Codes, and Applicable Designations.

Provide company/division's street address, county and facility code; CAGE code; DUNS code; TIN; size of business (large or small); and labor surplus area designation. This same information must be provided if the work for this contract will be performed at any other locations. List all locations where work is to be performed and indicate whether such facility is a division, affiliate, or subcontractor, and the percentage of work to be performed at each location.

L6.2.4. Required Submittals.

The Offeror must provide the following submittals in response to the RFP:

1. Transmittal Letter, Form SF1449, Solicitation, Offer and Award

1. On-Line Representations and Certifications)

1. Pricing Template (Attachment L-2)

1. OCCI Mitigation Plan

1. Cross Reference Matrix (if applicable)

1. Copy of the Joint Venture or Partnership Agreement that established the Contractor Team Arrangement relationship (if applicable)

1. Attachment 1 eDiscovery Technical Requirements

ATTACHMENT L1

SOLICITATION QUESTIONS AND ANSWERS TEMPLATE

ATTACHMENT L2

Pricing Template

ATTACHMENT L3

DD254

(End of Summary of Changes) image2.emf

Attachment L1 with Contractor Questions with Answers.xlsx Q&A

RFP Page RFP Section/ Paragraph CLIN/ Clause/Appendix/Attachment/Other Questions/Comments/Recommendations Government Response

45 6.1.2 One of the requests on page 45 is a monthly report. Can you clarify specific deliverable examples for "Monthly Performance and Progress Report (MPPR) that describes project progress and usage status." Monthly reports should include, at a minimum, the number of cases in the system, the amount of data per each case, whether the case is actively being worked by government staff, and the number of personnel logged into the system over the past month.

46 6.2.1, 2nd bullet eDiscovery Capabilities – we must be capable of “supporting internal agency hardware and software.” Can we get a list of specific hw/sw currently being used at DISA? The solution must be compatible with Microsoft Internet Explorer, Google Chrome, and Mozilla Firefox. The government will modify the PWS to remove the requirement for internal hardware and software support.

46 6.2.1, 10th bullet "• Provide required subject matter expert points of contact (POCs) to assist DoD personnel with addressing technical and functional issues as necessary." What is the role of the SME POCs (related to item 1 – are these people who are going to help consult on a regular basis?) How does this fall outside of the scope of standard support? Can you clarify? The government requires technical points of contact from the selected vendor to assist government personnel if there are functional issues or questions about technical features of the solution.

48 6.2.12, 1st bullet there is a requirement for Presentation display capabilities. Would it be sufficient to export to a format that could be used in Display? It would be sufficient to export to a format that could be used in Display.

52 6.4.1 can you clarify the requirement to be "hosted in a cloud environment FedRAMP (HIGH) supporting unclassified at an Impact Level 5 and a classified Impact Level 6. Specifically, is it acceptable to be hosted in a FedRAMP (HIGH) environment (i.e., AWS GovCloud)? Is operating in a .mil cloud an option? And what will DISA do should there be no viable options for FedRAMP HIGH responses? The selected application must be hosted in DISA Impact Level 5 certified cloud environment for DoD CUI information and at Impact Level 6 certified cloud environment for information classified up to SECRET. There are several cloud offerings that meet the above impact levels and the government expresses no preference in the selected cloud environment.

44 PWS. #4 The objective is to provide OGC with a user-friendly Federal Risk and Authorization Management Program (FEDRAMP) approved software as a service (“SaaS”) solution at Impact Levels-5 and 6 that meets the requirements in this document and has the required security controls and data protection Will DOD DISA accept an eDiscovery platform that is not authorized to IL 5+6? would an eDiscovery platform that is authorized to FEDRAMP Moderate be acceptable?? No, the government will not accept a FedRAMP (MODERATE) instance.

44 PWS. #4 Would DoD consider on premise licenses to be installed on DoD Infrastructure in stead of SaaS? No.

N/A N/A N/A What system(s) is DISA currently using to meet this requirement? This is a new requirement.

N/A N/A N/A Is DISA planning to augment their existing eDiscovery system or is DISA planning to replace their existing eDiscovery system? This is a new requirement.

N/A L Attachment L2 Is the total planned data volume for this contract 5TB or is DISA planning to purchase data in 5TB subscriptions? For example, in Year 1 DISA may purchase 15TBs in three 5TB subscriptions? The planned volume for this contract is for 5TB of active data on each instance.

N/A L Attachment L1 "The delivered solution must be capable of holding and maintaining up to 100 TB of data (OGC databases, images, native documents) with growth of approximately 30% per year. If vendor faces a maximum storage capability, vendor must state that maximum." --- Does DISA anticipate the data hosting volumes will be 100TB per month with the potential to grow an additional 30% per year? If yes, how does this align with the pricing CLIN in (Attachment L2) for 5TB per month annually? No, the government does not anticipate hosting volumes to be 100TB per month at this time.

44 4. Objectives "The objective is to provide OGC with a user-friendly Federal Risk and Authorization Management Program (FEDRAMP) approved software as a service (“SaaS”) solution at Impact Levels-5 and 6 that meets the requirements in this document and has the required security controls and data protection functions to comply with all Federal and Department of Defense (DoD) requirements. " ---Is it acceptable for the vendor to install their solution in the milCloud to meet the FedRAMP Impact Levels 5 and 6 requirements? No. The solution must be installed in IL5 (for the UNCLASS instance) and IL6 (for the SECRET instance) commercial cloud environments.

N/A N/A N/A What is the clearance level required for all staff working on the DISA contract? Appropriate facility and personnel clearances will be listed in the DD254, which is pending, for this procurement.

Attachment L2 The PWS lists several services (i.e. project management, status reporting, functional user support, training, etc.). However, the pricing, Attachment L2, only includes a line item for hosting cost. Can DISA add a CLIN for labor services to the pricing, Attachment L2 and provide more clarity regarding the services required? This requirement is to be satisfied by a SaaS solution that includes these services in the hosting cost. Attachment L2 has been modified appropriately.

N/A N/A N/A Did DISA conduct market research prior to issuing this solicitation? If not, we recommend DISA have an industry day and a demo/proof of concept phase as part of the solicitation to ensure DISA procures the right solution that meets both the security and functionality requirements. The government conducted market research in beta.SAM Notice ID: HQ0034-19-R-2017.

44 3 Our understanding is there is not presently an IL5 or IL6 environment that includes an eDiscovery solution and therefore this activity will start fresh. Does the government have a desired operational standpoint (e.g. within 120 days of procurement). The UNCLASSIFIED instance of this application must be operational within 2020.

44 4 The RFP covers both an IL5 and IL6 instance which must be separate. Please confirm that the government is requesting a bid for two environments. Correct. Each instance must be in a separate cloud environment.

45 6.1.2 Please clarify what all end user support is anticipated. We provide a SaaS Discovery Solution for our clients and our support services include login issue, technical "how do I …." issues, etc. It is unclear where end user support starts and stops for this effort End user support includes creating user accounts, assistance with login issues, and technical support.

49 6.2.7 The Collection section references that the system needs to be capable of importing ESI and integrating with commonly used applications. Is the technical process of integration included in this procurement scope, or only the ability of the system to support such integration The solution must be be able to support import of ESI load files from other eDiscovery platforms.

45 6.1.1 Subtask 1 references a minimum 99.900% service availability. Is that threshold inclusive of routine maintenance windows, planned upgrade periods, and other scheduled periods of service interruptions? No.

45 6.1.1 Can the government clarify this statement: "From the start time that a service is unavailable to the time the service becomes available, consumers shall not be charged by the Contractor for the use of that service. The contractor shall provide all upgrades, updated cloud versions timely during non-busy times." Is the expectation that fees will be decremented during maintenance windows? Are non-busy times considered outside 0800-1800 M-F and federal holidays? Yes. The government will decrement fees for maintenance windows during normal operational hours of 0800-1800 EST, Monday through Friday. The government will not decrement fees for maintenance windows outside of operational hours.

Jacobs, Michael H CIV DISA PLD (US): Jacobs, Michael H CIV DISA PLD (US):

This question had multiple questions, please clarify if "yes" is for both qestions?

45 6.1.2 Are vendors expected to provide a dedicated ticketing system or will tickets be managed in a government hosted application via DISA or DSLA? The contractor shall provide a dedicated ticketing system.

45 6.1.3 Assume all training can be delivered virtually? Will the government access to the collaboration service (DCO, Teams, Zoom, etc.)? Training shall be conducted virtually. Vendors shall provide access to the training and all materials in accordance with the PWS.

46 6.2.1 Regarding the following requirement: "Permit electronic files processing of any ESI from supporting internal agency hardware and software or provided by third parties pursuant to industry standards." Does this mean there will be integration points with external systems hosted by other agencies? No. The solution will not need to integrate with external systems hosted by other agencies.

Jacobs, Michael H CIV DISA PLD (US): Jacobs, Michael H CIV DISA PLD (US):

I don't think this response adequately answers the question. They are obviously unclear on the requirement. If you are going to say their interpretation is incorrect, then provide what the interpretation is

46 6.2.1 "Manage various types of ESI from one central point accessible by web browser." What does the government mean by "one central point"? All of the cases hosted in the software application shall be accessed through one central web-based interface.

46 6.2.1 "Provide DoD attorneys, Access Professionals, and others that require access in different locations access to each case or cases as necessary." Will the government manage and approve users that require access to the system? The government will approve the users for the system. The vendor will create accounts for users to access the system.

46 6.2.1 How should the following services be priced in the proposal: "Provide required subject matter expert points of contact (POCs) to assist DoD personnel with addressing technical and functional issues as necessary." The government defers to vendors on how to structure pricing.

46 6.2.1 Can the government define "expeditiously" as used in the following statement: Provide customer support and maintenance so that troubleshooting and errors can be resolved expeditiously. The government expects responsive and timely service when encountering issues with the software application.

46 6.2.1 What are the RPO/RTO targets associated with this requirement: Provide routine (e.g. daily) system backups and disaster recovery of all data stored in the Proposed Solution. Solutions shall maintain a 4-hour RTO target and a 24-hour RPO target. The PWS has been modified to reflect these targets.

47 6.2.4 Can the government clarify the high availability expectations on the following statement: High Availability - Acts as an enterprise service offering to DoD OGC users, thus requiring high availability through redundancy and effective service restoration capabilities. Solutions shall maintain a 4-hour RTO target and a 24-hour RPO target. The PWS has been modified to reflect these targets.

50 6.2.9 Can the government clarify this requirement: "Portal for Non-OGC Users – Proposed Solution allows DoD users to grant access to non-DoD users to access the Proposed Solution via web-based portal for limited review of data on both the NIPR and SIPR platforms. Proposed Solution shall further allow DoD users to tailor role-based access for each non-DoD user to limit the cases available, functionality of the Proposed Solution for the non-DoD user (e.g., limiting the ability to print documents from the Proposed Solution), and to create reports for what the non-DoD user has done while logged into the Proposed Solution." This requirement implies the need for a "high to low" solution that enables unclassified users to access data and services that are hosted in the classified system. Non-DoD attorneys or personnel (e.g., DOJ personnel) will need access to various cases for coordination on documents. Non-OGC/DoD personnel will have an appropriate security clearance, and will access the portal from computers authorized to process that same level of information. The government requires the ability to create a guest account at the appropriate classification level for these users. There is no need for a cross domain solution as the question contemplates. Rather, non-DoD users will access the instance with pre-existing approved accounts on networks that can support the classification level.

52 6.4.1 The following statement implies the need for TWO separate systems operating at IL-5 and IL-6: "The contractor shall provide all required DoD RMF Security Control Artifacts necessary to achieve an Authorization to Operate (ATO), to include follow-on continuous monitoring activities. The e-Discovery solution shall be hosted in a cloud environment FedRAMP (HIGH) supporting unclassified at an Impact Level 5 and a classified Impact Level 6." Can the government please clarify? There shall be two distinct instances. One instance at the IL5 level and a separate and distinct instance at the IL6 level. The IL5 instance would support unclassified information and the IL6 instance would support classified information up to the SECRET classification level.

52 6.4.1 The government identifies requirements for other non-production environments: "The Contractor shall provide all required integrated implementation environments for all applications included in the SaaS solution and ensure that all environments can be promoted to one another (development to test and test to production).The Contractor shall not host any portion of the environment in facilities outside the contiguous United States, Alaska, Hawaii, and other U.S. Territories." Does the government contemplate any other non-production environments? No.

52 6.4.2 Will the government assign a dedicated ISSM to coordinate C&A activities? The government will assign an ISSM.

55 6.5.3 Can the government clarify the following requirement: "All information systems shall be considered to be moderate-moderate-low (Confidentiality-Integrity-Availability) for the System Security Plan (SSP) unless otherwise notified in writing. The solution shall comply with the security control requirements documented in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53r4, “Security and Privacy Controls for Federal Information Systems and Organizations.” " M/M/L posture is much lower than what's available in IL-5 or IL-6 regions. The PWS has been modified.

56 6.5.4 Does the government expect the vendor to provide physical and cyber security for all end user devices accessing the solution? No. The contractor will only support cyber security activities for the SaaS software application and not end user computer systems.

44 4 Will the government consider a phased approach to achieving FedRAMP High certification and a DoD PA at IL5 and IL6? No. The government will not accept a system accredited at a lower certification or impact level that is upgraded later.

44 4 Would the government consider an on-premises system for the first year until FedRAMP High certification and a DoD PA is achieved at IL5 and IL6? No. The government contemplates a SaaS cloud solution.

44 4 Would the government consider purchasing an on-premises system on a subscription basis? No. The government contemplates a SaaS cloud solution.

44 4 Would DISA, OGC, and/or DLSA consider sponsoring the vendor for FedRAMP certification and the DoD PAs at IL 5 and IL6? The government would consider sponsoring the selected vendor for a PA at IL6. However, the vendor must demonstrate that it meets the enumerated technical requirements.

45 6.1.3 Is on-line training sufficient to meet the requirement to deliver training where OGC personnel are located ? Yes. On-line training is the preferred delivery method for this requirement.

45 6.1.3 Is training required to be delivered on-premises where OGC personnel are located? On-line training is the preferred delivery method for this requirement. No on-premises training is expected for this requirement.

45 6.1.3 Where are OGC personnel located? Please provide list of cities/states with number of users in each location. The requested SaaS software application must be accessible via a single sign-on portal that is not dependent on access from a specific location.

3 B Attachment L2 What assumptions should vendors make in defining ODCs, to include travel? Travel is not contemplated under this procurement.

48 6.2.5 Is litigation hold a place-holder or optional requirement? The use of the word "may" could be interpreted that way. Litigation hold processes are considered essential tasks for this requirement. Offerors integrating third-party litigation hold capabilities are acceptable if they meet the same security requires and the goverment does not need to work with another vendor.

45 6.1.3 If on-premises training is required, what will the minimum, average, and maximum classroom sizes be? On-line training is the preferred delivery method for this requirement. No on-premises training is expected for this requirement.

46 6.2.1 The RFP states a minimum of 200 named users will be supported. How many users and/or what percentage of users will be on IL6? How many users and/or what percentage of users will require access to both IL5 and IL6? All 200 users shall have access to both UNCLASSIFIED and CLASSIFIED environments.

3 B CLIN 0001 "The contractor shall provide Software as a Service Cloud 5 TB monthly subscription for the capability, services, and training to support an eDiscovery capability in accordance with (IAW) the Performance Work Statement (PWS) and technical requirements Attachment 1."

Please provide a breakdown of how the data will be distributed between the IL5 and IL6 clouds. Both the IL5 and IL6 instances shall be 5 TB.

line 7 Attachment 1 eDiscovery Technical Requirements The attachment states the delivered system shall be capable of maintaining classified documents...presumably on a segregated system. Please provide definition of a segregated system and the source document, i.e., NIST FIPS, ISO, etc., for that definition. There shall be two distinct instances. One instance at the IL5 level and a separate and distinct instance at the IL6 level. The IL5 instance would support UNCLASSIFIED information and the IL6 instance would support CLASSIFIED information up to the SECRET classification level. The IL6 instance must be accessible by SIPRNet.

52 and 58 6.4.1 and 12 Delivery Schedule, RMF Artifacts and SaaS Solution with ATO IL5 and IL6 Please clarify schedule for required deliverables. The RFP states RMF artifacts are required and required to be delivered on an as-required basis (in the delivery schedule). Are FedRAMP High and IL5 and IL6 PATO/DoD PA, ATO artifacts required to be delivered at the start of the period of performance? If not then, when are they required to be delivered? The RFP states a SaaS solution with an ATO at IL5 and IL6 is required to be delivered at the start of the period of performance (delivery schedule). Is a SaaS solution with at ATO at IL5 and IL6 required to be delivered at the start of the period of performance?

Is the ATO or Artifacts necessary to achieve an ATO required at the start of the period of performance? No. The artifacts will be gathered and delivered during the implementation phase of the solution in support of system accreditation and periodically after to support continuous monitoring requirements (as artifacts change).

general general Attachment 1 eDiscovery Technical Requirements If the SaaS product cannot fully meet a required technical feature, is a scheduled commitment to develop the feature acceptable in this proposal? No. The government requires the vendor to meet the ITFRs set forth at the time of award.

lines 26-60 Attachment 1 eDiscovery Technical Requirements Is a third party solution to implement legal hold functionality an acceptable solution to this RFP? Yes, provided the third-party solution is integrated with the SaaS solution on the back-end and meets the same security requirements.

44 4 Has the government considered requiring/accepting an on-premises system, which DISA will host in their cloud? Would the government accept this as a solution in a proposal response to this RFP? The government will not accept an on-premises solution for this requirement.

44 4 What is the government's plan if there are no bidders capable of delivering a SaaS capability with a FedRAMP High certification and IL 5 and IL6 ATO at the start of the period of performance? The government will re-evaluate its requirement if this is the case.

Attachment 1 Can DoD provide a complete list of data sources that are in scope for data collection? No. Each individual case has different data sources within its scope.

How much data (volume and item count) will need to be processed for an average case? Each individual case is different and has unique data requirements. The government estimates 5TB of active data across all cases.

How many cases are typically active at any one time? Case counts vary greatly at any given time. The government estimates 5TB of active data across all cases.

What is the average export size (volume and item count)? This is a new requirement; the government does not have this information.

For granting specific access for non-DoD employees, would DoD be providing credentials, or is DoD looking for the system to be the authentication provider for those users? The government will develop a work-flow whereby the government approves non-DoD users for account access and then will provide approval to the vendor for account creation.

Attachment 1, Line 62 It was stated that the system needs to ingest audio files - does that audio need to be indexed and searchable? If so, how many hours of audio does DoD anticipate needing to indexed at a given time? This is a new requirement; the government does not have this information.

3 1 It was stated that a 5 TB monthly subscription is needed, but unlimited processing, productions, and exports were included in that. Can DoD clarify what is meant by the 5TB number, and how much active case data DoD intends to have under review? The government contemplates 5 TB of active data on each instance.

Attachment 1 Can DoD provide the number of SharePoint servers are in scope for collection? The government does not expect to use this software application for collection.

How many different data centers or office locations have data that will need to be collected? The government does not expect to use this software application for collection.

44 4 Objective our solution is FedRAMP and therefore IL 2, but in the process of getting 5, is this acceptable or is the solution provider to be IL 5 or 6 at the time of this award? The PWS has been updated to require the IL5 (UNCLASSIFIED) instance be operational within 120 days of award and the IL6 (SECRET) instance be operational within one year of award. A FedRAMP (MODERATE) instance is not acceptable for this requirement.

Jacobs, Michael H CIV DISA PLD (US): Jacobs, Michael H CIV DISA PLD (US):

This seems to walk back the PWS requirement for IL5/6 -- It should be reworded. The PWS does not "desire" a solution for IL5/IL6, it REQUIRES it, correct? If that is the case, then that is the requirement. -- This same note is applicable to Line 71, Column E

This question had multiple questions, please clarify if "yes" is for both qestions? 54 6.5.2 Subtask2 - Cybersecurity strengths requirements Does the vendor need to have two separate networks, one for classified and another for unclassified? Yes.

51 6.4.1 Subtask1 - Hosting requirements Does DISA have an incumbent? Is this project being treated as a Pilot? This is a new requirement.

51 6.4.1 Subtask1 - Hosting requirements Which (if any) eDiscovery software applications does DISA currently use as of today? This is a new requirement.

1 8 Offer Due Date/ Local Time Would the Governent consider setting the due date for the response to August 31, 2020 The RFP deadline has been extended to 31 August 2020.

44 4 FedRAMP Status: Is FedRAMP HIGH a requirement at the beginning of the solicitation, or will there be an opportunity once awarded the contract to obtain that level of security? The PWS has been updated to require the IL5 (UNCLASSIFIED) instance be operational within 120 days of award and the IL6 (SECRET) instance be operational within one year of award. A FedRAMP (MODERATE) instance is not acceptable for this requirement.

This seems to walk back the PWS requirement for IL5/6 -- It should be reworded. The PWS does not "desire" a solution for IL5/IL6, it REQUIRES it, correct? If that is the case, then that is the requirement. -- This same note is applicable to Line 71, Column E

I don't think this response adequately answers the question. They are obviously unclear on the requirement. If you are going to say their interpretation is incorrect, then provide what the interpretation is

Instructions

Q&A INSTRUCTIONS: The purpose of these specific instructions is to expedite the process of answering questions. Please do not change the format of this document.

Complete the spreadsheet tab below named "Q&A" with all questions, comments, and recommendations about the RFP. Examples provided in the spreadsheet. **Please delete the examples before submitting your questions.

COLUMN A: Complete the "Page" column. This is the page number from the RFP located in the upper right hand corner of the page. Do not include the total page number. Enter only the page number where the topic begins.

COLUMN B: Complete the "Section/Paragraph" column with the applicable section and paragraph number (if applicable) of the RFP. For example: B2, C, or L5.1.2. For a section and paragraph number reference do not place a dot between the letter and the first number. Additional subparagraph references should be separated with a dot regardless of the format in the RFP, for example, L5.1.2.a. Do not including any other extraneous identifiers or other information other then instructed here. If the reference is to a CLIN, Clause, Appendix, or Attachment etc. the entry goes in the next column. At a minimum you will always insert at least the Section letter A through J in this column.

COLUMN C: Complete the "CLIN/Clause/Other" column. Insert the CLIN, Clause, Provision, Appendix, or Attachment number. For example: CLIN 0001, 52.217-8, Appendix A, or Attachment L3. Insert the section letter only in the Column B. This column will be completed only when there is not a more precise RFP reference number. NOTES: CLINs are in Section B. Most sections contain clauses so ensure you reference the correct section.

COLUMN D: Complete the Questions/Comments/Recommendations column. Start the question by referencing the topic. This may help the sort process. For example: Minimum Qualifications Checklist or Performance Area 10. Then insert the question or comment.

Issues must be submitted to the Contracting Officer and Contract Specialist listed in L2.1.1 image3.emf

Attachment L2 Pricing Template Revised 31 Aug 20.xls eDiscovery Capability

CONTRACTOR REQUIRED INFORMATION

Contractor Contract # (SEWP / GSA):

CONTRACTOR POC Name:

POC Email:

POC Phone #:

CAGE Code

DUNS #

ITEM # (Proposed CLIN) Manufacturer Name Manufactuer Part Number Description QTY UNIT OF ISSUE UNIT PRICE EXTENDED AMOUNT Promised Delivery (ARO) Covered by OEM Warranty (type and duration) HW Serial Number/Key Code

0001 eDiscovery Cloud - 5 TB - Monthly Subscription and Support 12 Months $ - 0

1001 Option Year One - eDiscovery Cloud - 5 TB - Monthly Subscription and Support 12 Months $ - 0

2001 Option Year Two - eDiscovery Cloud - 5 TB - Monthly Subscription and Support 12 Months $ - 0

3001 Option Year Three - eDiscovery Cloud - 5 TB - Monthly Subscription and Support 12 Months $ - 0

4001 Option Year Four - eDiscovery Cloud - 5 TB - Monthly Subscription and Support 12 Months $ - 0

Subtotal $ - 0

9999 Surge Support of 30% $ - 0

Total Lifecycle $ - 0

Period of Performance: Date of award through one year, with four, 1-year options

DELIVER ITEMS TO:

Office Name/Symbol

Address

City, State and Zip+4

POC Name, Phone, Fax and Email To be provided at award

&L

&CEncl 2a, Consolidated Product List 4Jun2018/v2 image4.emf

Attachment L3 DD254.pdf

CLASSIFICATION (When filled in): Unclassified

PREVIOUS EDITION IS OBSOLETE. Page 1 of 3

AEM LiveCycle Designer

DD FORM 254, APR 2018

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

May 31, 2022

The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED (See Instructions)

Secret

b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/

MATERIAL REQUIRED AT CONTRACTOR FACILITY

Secret

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

a. PRIME CONTRACT NUMBER (See instructions.)

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER

HC108420R0008

DUE DATE (YYYYMMDD)

20200831

3. THIS SPECIFICATION IS: (X and…