Vendor_Questions_OE_a7_27_18.docx

RFQ 89603018Q0085 – Audit Management Software

1. Whether companies from Outside USA can apply for this? (like, from India or Canada) Yes, if the prospective vendors are registered in System for Award Management (SAM) and authorized to conduct business with US government agencies.

2. Whether we need to come over there for meetings?

A vendor must be capable of conducting onsite installation and system configuration. Additionally, onsite training is preferred.

3. Can we perform the tasks (related to RFP) outside USA? (like, from India or Canada) A vendor must be capable of performing RFP related task at FERC’s site.

4. Can we submit the proposals via email?

Yes

5. Can you provide me the size of the user community and the roles of the users? This would help determine the configuration and pricing.

There will be 35 to 45 users of the audit management software. The users’ roles include staff auditors, lead auditors, supervisory auditors, and an audit software system administrator. The software must support concurrent use for all users.

6. Appendix A includes the following mandatory requirement: “The solution should offer an on-premises deployment option.” Will FERC consider waiving this mandatory requirement?

No. See also Question #2.

7. Will FERC extend the due date for proposal submission?

Yes. The new proposal due date is 1100 on Tuesday, August 21, 2018.

8. Are there other tools beside WebTA that you would like for the solution to integrate with? If so, can you provide a listing and its purpose?

Not at this time.

9. Within the SOW it states that it is anticipated that the solution support 1.5 TB of audit data. Can you clarify as to the type of audit data. Would this include attachments? If so, can you provide the range of file sizes? Would any data be coming from other data sources? If possible, any breakdown of the types of audit data you are looking to manage within the tool would be greatly appreciated.

The audit data would be in the form of Microsoft Office Suite (e.g., Word, Excel, and PowerPoint), Adobe files, and picture files. The individual file sizes vary but may reach up to multiple GB of data. We anticipate that the data would be uploaded into the audit management software by FERC staff, rather than being connected to another source.

10. Are you looking for the solution to also provide a means to manage FERC Policies and Procedures to ensure compliance when conducting the audit or do you currently have a tool to manage your internal policies?

FERC is seeking a tool to embed relevant controls to support its audit program’s policies and procedures.

11. Would this be an on-prem deployment or are you looking to deploy within the Cloud?

FERC is seeking an on-premises deployment option.

12. Up to how many users are you looking at to use the tool? How many concurrent users?

See Question #5.

13. Can you provide instances or situations in which you would want to utilize offline capabilities?

Offline capabilities would be utilized in instances where connectivity to the FERC network is not available, e.g., during travel time.

14. What is the current product you are using?

Division of Audits and Accounting (DAA) is not currently using any audit management tool.

15. The RFQ Response is due August 7, 2018 at 11:00 am EST. Will you consider extending the response date to August 21, 2018 at 11:00 am EST?

See Question #7.

16. Would you please define the number of software licenses needed for this contract?

See Question #5.

17. RFQ page 10, EVALUATION – PRICE PROPOSAL (Volume 2) Price, Price Completeness and Accuracy paragraph refers to Attachment D. The documents submitted on FBO.gov did not contain an Attachment D (or C). Would you please clarify?

Apologize for the type. There is no Attachment D nor C. Please use Attachment B – Bid Model.

18. Attachment A, Statement of Work, page 3, Figure 1, refers to Monthly and Quarterly AAR. Would you please define the acronym “AAR?”

The Audit Activity Report (AAR) is an internal report summarizing the status and next steps of ongoing audit projects that is shared with certain FERC staff on a monthly or quarterly basis.

19. Attachment A, Statement of Work, SCOPE page 5: The contractor will also need to ensure integration between the proposed solution and how DAA audit process evolves. We are unsure if this is a technical or business concern. Can you please provide an example of what such an evolved process might be, and your expectations about how it must “integrate” with our solution?

The audit management software should be capable to support variations in audit scope, methodology, process, and approach that may exist across audits.

20. Attachment A, Statement of Work, SCOPE page 5, Item 3: “…FERC security guidelines and all FISMA policies, procedures and mandates.” Can you please identify the specific FERC security guidelines and specific FISMA policies, procedures and mandates related to this contract?

FERC security guidelines are consistent with FISMA.

21. Attachment A, Statement of Work, TASKS page 5, Activity 2.1 Requirements Review: Review and assess the current audit business and workflow processes. Do the business and workflow processes exist today in documented form, or is the contractor expected to conduct process mapping sessions in order to create the documentation necessary for implementation?

The business and workflow processes are documented. It is not expected that the contractor will conduct process mapping sessions. However, the contractor must work with FERC staff to review and understand existing processes and sufficiently configure and implement a solution that works best.

22. Attachment A, Statement of Work, TASKS page 6, Activity 2.2 Security: “…all applicable federal and industry security standards.” Can you please identify the specific federal and industry security standards applicable to this contract?

See Question #20.

23. Attachment A, Statement of Work, TASKS page 6, Activity 2.4 Deployment of Baseline Solution: “…hardware or hardware provisioning based on industry best practices and FERC baseline configuration.” Can you please clarify this requirement? Is the contractor expected to install the COTS software on hardware provided by FERC? Does FERC plan to ensure that all the necessary environmental and eco-system related software (e.g., SQL Server) are licensed and installed?

The vendor is expected to install its COTS software on hardware provided by FERC. FERC will prepare virtual servers with the standard FERC baseline software (i.e. antivirus and other standard software). Any necessary environmental or eco-system related software required by the vendor should be specified in the response. If a database or other third party software is required and installed, this should be included in the response and included in the pricing.

24. Attachment A, Statement of Work, TASKS page 7, Task 3: Testing and Acceptance: “…all activities managed under this SOW are defect free.” Our general level of assurance is there will be no Sev1 or Sev2 issues. Will this suffice for this requirement?

The application as installed should meet the acceptance criteria outlined in the SOW to ensure the system is configured and working to meet audit needs. Since Sev1 or Sev2 definitions may vary by respondee, this is not an appropriate benchmark for assessment.

25. Attachment A, Statement of Work, TASKS page 7, Task 3: Testing and Acceptance: Review can be completed both internally and externally. We interpret this requirement to be that reviews are performed inside and outside your firewall. Can you please confirm and/or clarify?

Reviews are to be performed to ensure proper functionality while users are connected to the FERC network and when user are NOT connected to the FERC network. See also Question #13.

26. Attachment A, Statement of Work, TASKS page 7, Activity 4.1 User Documentation: Could you please clarify the requirements for preparing, updating and maintaining user guides? We provide standard product documentation which is updated for each software release. Is the contractor expected to provide custom documentation (e.g., quick reference guides) and update this custom documentation? Regarding business process: because business process is external to the software (i.e., a business decision), could you please clarify how such documentation will apply? Regarding maintenance, is the contractor to maintain the custom documentation over the course of the project? We do maintain all standard documentation, but lifetime maintenance of custom materials is generally a customer responsibility.

FERC expects the vendor to provide initial custom reference guides as part of the training of new users to include how the software should be used within FERCs business processes. Going forward, FERC will be responsible for updating custom documentation for any changes to its business processes.

27. Attachment A, Statement of Work, TASKS page 7, Activity 4.2 Rollout Training: The contractor shall develop training materials for review and approval by the FERC COR. Will FERC assign a qualified internal training expert to the project to provide advice and guidance as to FERC expectations and standards? Are such standards published and available to the contractor?

FERC will provide audit technical experts to ensure that training is sufficient and users are able to navigate the system without much disruption to FERC mission.

28. Attachment A, Statement of Work, TASKS page 8, Activity 5.1 FERC Technical Support: Tools and processes for monitoring solution availability and responding to system and application outages. As this requirement is for an on premise installation, we believe the availability and monitoring of the network and response to network and system outages will be FERC’s responsibility. If the network itself is operable but the application itself is not performing properly, the user can contact the Vendor’s user support help desk as per our normal support channels. Will this response suffice for this requirement?

FERC will assume responsibility for system availability due to network outages. The desired capability is a means to monitor and troubleshoot the health of the COTS application when there are no contributing infrastructure issues.

29. Attachment A, Statement of Work, TASKS page 8, 5. DELIVERABLES: 1. Project Management: Project Plan due date 10 days from Award Date. Due to the uncertainty of the Award process, may we provide a DRAFT project plan at the kickoff meeting, and a FINAL project plan when we submit the Kickoff Meeting notes?

Yes

30. Appendix A, Audit Management Software Detailed Requirements, Mandatory Functional Requirement Row 24, tickmark functionality. Can you please clarify this requirement?

The “tickmark” functionality allows users to overlay electronic work papers with abbreviated comments and notes.

31. Appendix A, Audit Management Software Detailed Requirements, Mandatory Functional Requirement Row 26, bookmark functionality. Can you please clarify this requirement?

The “bookmark” functionality allows users to create shortcuts to access specific work papers or other documents stored within the audit management software.

32. Appendix A, Audit Management Software Detailed Requirements. Mandatory Elements - Architecture Standards request the solution must offer an on premise deployment option. Request this requirement be changed to optional or Highly Desirable No. The on-site premises deployment is a mandatory requirement. See question #2.

33. NAICS Codes listed are 511 and 511210. Request opening this up to include cloud based software solutions #518210 No. The on-site premises deployment is a mandatory requirement. See question #2, 32.

34. Appendix A Audit Management Software Detailed Requirements - Highly Desirable - If offering a true cloud solution do Architectural Standards require supporting SQL Server, Windows Server 2012 R2, Thick Client Solution apply?

See Question #2,32,33.

35. Please provide the number of users at HQ and remote that will require full time and part time access to the solution.

See Question #5.

36. Please provide the number of people that will be manning the service help desk during operational hours.

FERC expects to direct issues related to the audit management tool will to the designated 2 internal administrator and if escalation is required, will contact the vendor for resolution of issue.

37. Request of response submission be extended 21 days to Aug 27, 2018 to allow for comprehensive technical response.

See Question #7, 15

38. Technical Requirements xls row 5 “Architectural Standards” Would FERC consider relaxing this requirement for Cloud providers who do not also have an on-premises deployment option.

See Question #2, 32, 33, 34

39. Technical Requirements xls rows 18 “Architectural Standards” Most cloud providers generally do not have thick client solutions. Can this requirement be relaxed?

See Question #2, 32 ,33, 34,38. An offline client is required.

40. Technical Requirements xls rows 19 and 20 “Architectural Standards” Are cloud providers required to meet these requirements regarding running on Microsoft SQL server and Windows Server if they are able to integrate with those platforms instead?

See Question #2, 32, 33, 34

41. Will FERC consider extending the due date by 2 weeks to allow bidders to appropriately incorporate information needed in Q&A responses?

Yes. See Question #7, 15, 37

42. Can this requirement be amended to consider an SaaS (Software as a Service) model. Basically a charge for each user accessing, working, communicating, and managing the solution.

No. FERC is interested in perpetual user license option.