Attachment 6 - SF-30_QA.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT 1. CONTRACT ID CODE

2. AMENDMENT/MODIFICATION NO. 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQ. NO. 5. PROJECT NO. (If applicable)

7. ADMINISTERED BY (If other than Item 6) CODE

STANDARD FORM 30 (REV. 10-83)

Prescribed by GSA FAR (48 CFR) 53.243

FACILITY CODE

9A. AMENDMENT OF SOLICITATION NO.

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NO.

10B. DATED (SEE ITEM 13)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended, is not extended.

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a)By completing items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE

DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment your desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER

NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15C. DATE SIGNED

15A. NAME AND TITLE OF SIGNER (Type or print)

16C. DATE SIGNED

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

PAGE OF PAGES

6. ISSUED BY CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code) (X)

CODE

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

16B. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

NSN 7540-01-152-8070

Previous edition unusable

ATTACHMENT 6

9531BM20Q00060001

Summary of Changes

Section J - List of Documents, Exhibits, and other Attachments

Amendment specific attachments:

File Attachments:

Title Description File Name Entity Reference

Attachment - 6 Questions and Answers Attachment 6 - QA.pdf Header

Questions and Answers

RFQ 9531BM20Q0006

"Web-Based Incident Management Software Solution"

# Questions Answers

Is the WEB BASED INCIDENT MANAGEMENT SOFTWARE SOLUTION-requirement under solicitation # 9531BM20Q0006 a new requirement or if an incumbent exists? If an incumbent exists, are you able to provide the contract(s) number?

The Web-Based Incident Management Software Solution is currently being provided by ESI, Acquisitions, a subsidiary of Juvare, LLC. The contract number is NTSBP160059.

2 Is FedRAMP authorization a requirement? No

How many contacts are in your current Emergency Notification

System (ENS)?

4 Who is current ENS provider? RAVE

Would NTSB consider pushing notifications out from the Incident

Management Software Solution if was integrated all in the platform?

Yes

6 Is the NTSB looking for custom or off-the-shelf-software? Off the shelf but must be customizable.

Does the investigative data that would feed the Incident

Management System (IMS) all come from the centralized information dashboard the NTSB currently uses, or will some of the information come from the dashboard and some of the information also be entered or updated by ROC agents directly in the (IMS) as time goes forward?

a. If the IMS is just a place to store and disseminate the investigative information, or if it will additionally function in tandem with the NTSB dashboard not just to disseminate but also to update with, for example, task assignments, relevant events and so forth.

b. It seems that one possibility is that an ROC agent initiates a new incident in the IMS and then can pull in investigative data from the

NTSB’s systems? So really the entirety of managing the incident is all

Yes, the ROC Watch officers will be updating the system with information.

a. IMS provides dashboards to the NTSB. Dashboards will have additional functions to allow watch officers to update information as needed during the event(s).

b. Yes

8 When would the ROC require the system to be operational? March 29, 2020.

Where would training for the ROC agents that will use the IMS initially be conducted?

Washington, DC HQ

10 Is there a budget for this at this point? Yes

11 Will the NTSB provide an API to their phone system? No

12 Will the Contractor provide SMS Services via their own provider? Yes

"Web-Based Incident Management Software Solution"

13 Will the contractor provide voice messages services sent over SMS? Yes

14 Will the contractor provide voice messages sent over Email? Yes

Will the contractor provide voice messages playable through the web interface? No

16 How many SMS messages will be sent per month? 50 message per month to Approx. 450 recipients.

17 How many Voice messages be sent over SMS/MMS per month? 50 message per month to Approx. 450 recipients.

18 How many emails will be sent per month? 50 message per month to Approx. 450 recipients.

For the messages to join telecoms, will the telecom be contractor hosted or hosted with a phone number at NTSB?

They will be using NTSB assigned # from our current vendor Century Link. ROC will assign the numbers to use.

20 Will the system require Two Factor authentication? Yes

21 Will the system integrate with PKI/CAC cards? Not at this time.

For 2.1.11 what ‘outside access originations’ are meant? API access and if so what functions?

Typo should read, "Access to outside organizations" API access YES-all functions.

23 For 2.1.12 what is meant by ‘instant messages’? Refers to a chat function built into the software.

24 For 2.1.12 By what method / are ‘Instant Messages’ sent? Refers to a chat function built into the software.

For 2.1.15 what Emergency Management system, and will NTSB provide API access to the system ? No, the functionality required is part of the EMS.

For 2.1.15 is this meant to send broadcast push messages/pre recorded voice calls to a list of predetermined phone numbers ? Yes, but requires the ability to add/delete numbers.

For 2.1.17 is this meant to be a ‘view’ of the current users time zone currently accessing system, and the database can store the UTC timestamp ? i.e. the view is a users profile setting for time zone translation?

Yes, it requires the ability to have a user profile to all adjustment to their specific time zone.

For 2.1.22 is the requirement for ‘end users’ to be able to arbitrarily create fields of data storable in the system? Yes

If the system is to create arbitrary fields of data/metadata are these functions only for use for ‘administrative users’ from a full workstation that is not a mobile device?

Yes, ROC personnel are the only individuals to have administrative rights within the system. This function will be only from desktops or latops; no mobile apps.

Does the NTSB mean to reference a web based platform that is designed in a Responsive Manner for the field incident responders? Yes

"Web-Based Incident Management Software Solution"

For 2.1.22 will the NTSB provide a data definition of fields and capabilities for the referenced case management system, or API access to this system? Yes to both.

For 2.3 and 2.1.13, what reports are required and what are the formats and examples of the referenced reports?

Application should be able to allow NTSB to design and create reports in pdf format. Such reports may include: the ROC Journal, Launch

Checklist/Document, QRC After Action, Messages and others as needed.

For 2.4 has the NTSB researched specific Incident management systems if so what are they?

The purpose of the solicitation is to obtain the most effective software solution that meets the needs of the government at the best value.

Does NTSB have a comparison feature list of itemized, detailed features of the incident management system? Yes

Is the NTSB looking for a COTS SaaS prebuilt or a SaaS system that is specifically built and is configurable/customizable?

The NTSB wants a COTS SaaS software prebuilt that is configurable/customizable.

For 3.2 is the NTSB wanting to be able to invite email accounts of remote arbitrary users to collaborate and login to the main NTSB entry point of the web portal incident system? Yes

For 3.3 Will the NTSB provide the Secure links into the Active

Directory via standard LDAPS (Secure TLS/SSL based URI connections

?) Yes

38 Would integration of Oauth2 support meet the request in 3.3? No

For 3.3 typical ‘multitenant’ SaaS solutions are based on invites via email addresses, which allow for true requirements per 3.2 . What functions of 3.3 and the Active Directory functionality be needed? I.e.

will this only to synchronize allowed emails access to the system? Or will this have functionality to synchronize groups and map those groups to NTSB permission levels?

The active directory will be used only to allow emails access to the system.

For 3.4 what is meant by mobile app? Does this mean a responsive designed mobile website or does this mean a native Mobile applications with similar functions of the site?

Needs a native mobile application.

For 3.4 would a Responsive Designed system accessible via mobile web browser be sufficient to meet the requirement?

No, the NTSB requires an app.

"Web-Based Incident Management Software Solution"

Will Active Directory be used for Authorization or Authentication ?

What functions will the Active Directory integration granularly be provided?

Authorization.

How many data centers / geo-graphic dispersion of the system are requested? At least 2 data centers

44 Are the mileage limits of geo-graphic system dispersion? Minimum 60 miles

45 Will the system be needing to be housed in Fedramp Data centers? No

46 Will the system require Fedramp of the application? No

47 Will NTSB sponsor the application for Fedramp ATO? No

What are the onsite meeting requirements? I.e. monthly, weekly, at defined goals?

Vendors shall provide an estimated level of effort in accordance with Section

B.3 for discovery services. Otherwise, there are no meeting requirements.

49 How many hours and quantity of training will be required?

The vendor shall propose the total number of days required for training on their proposed software solution.

What pricing model is requested? Per email account in system , per function or per incident /case count or other? The pricing structure is outlined in Section B-3 and L.7.

51 For 4.2 does NTSB have an itemized list of referenced modules? Yes

For 4.5 requirements are typically provided by the customer. Does

NTSB have an itemized list of all modules and requirements? Yes

For 4.5 does ‘requirements document’ mean the requirements of the

SaaS to operate? I.e. must be run on Firefox 49 +, Chrome , IE 10+ , Edge or Safari ? Yes

"Web-Based Incident Management Software Solution"

Page 6 Scope of work states that the software shall be able to interface with the NTSB’s current emergency notification system to send SMS text, email messages, and voicemail messages to an individual or Outlook Active Directory group simultaneously through multiple types of devices (Android or Apple devices, email and voicemail).

Page 8 section 2.3 appears to require the software to have this capability internally for all of the above.

Referencing the above scope of work items, is there an existing system that must be used for integration or does the system required to cover these functions internally?

Yes, the NTSB requires a notification software that will work inside the IMS software as part of the IMS. In other words, the NTSB does not want to have to use multiple applications to send an alert.

As part of the transition planning from existing software/methods to the new software is there existing data that must be migrated into the new system for historical purposes

(searching/reporting/analytics)? If yes, can you share with us what the existing software/methods are for storing this existing data?

Yes, and it is stored in WebEOC.

For Page 9 section 3.4 Software shall have a mobile application that will work on Apple or Android OS. Does this mobile application need to be capable of operating on the mobile device when there is no wireless or cell phone service? Or does it need to be able to operate on a mobile environment when these services are available?

No, the application does not need to operate on mobile devices when there is no wireless or cell phone services. Yes, the software needs to be able to operate on a mobile environment when these services are available.

For Page 7 section 2.1.6 Ability for a select group of users to update all users’ contact data. Does the agency allow the integration of the application to the agency HR or payroll system to obtain this information automatically? Yes

For Page 6 Scope of work for the training of the 15 NTSB users can this be provided in one location and the agency will be responsible for getting the 15 trainees to the location for the training being proposed, or alternatively can the trainees travel to one of our offices for this training? Training is required at the NTSB HQ or via remote training. Staff cannot travel.

"Web-Based Incident Management Software Solution"

For Page 6 Scope of work due to the mission critical nature of this software would you require redundancy in the hosted configuration in more than one geographic location to prevent SaaS hosted environment interruption? i.e. Redundancy switching time requirements (15 minutes) to the redundant location?

NTSB requires a true Multi-Tenant Software as a Service (SaaS) that incudes built in fault tolerance with high availability using multiple zones.

Line items are provided for Discovery Services, Implementation

Services, Training and Travel for the base period but not for Options

Years 1-4. Should these line items be priced for the option periods?

If so, will the NTSB revise the tables or should the offeror create new tables?

No, the stated line items will only be required for the base year to ensure a properly function software solution for the NTSB's needs. Subsequent option years will only require the price of the license and any maintenance/support associated with the use of the software. In accordance with Section L.7, Part III, Price Quote states, "At a minimum, contractors shall provide a price quote in accordance with the pricing structure provided in Section B.3. Additionally, contractor shall provide firm-fixed price hourly rates to provide additional module development and/or contractor assistance to NTSB personnel to develop independent modules as requested by various offices within the agency based on mission need for the base year and all option years. "

"Web-Based Incident Management Software Solution"

RFQ Attachment 2, Item #3, paragraph 6 on page 1 states:

The contractor shall provide the following firm-fixed price hourly rates to provide additional module development and/or contractor assistance to NTSB personnel to develop independent modules as requested by various offices within the agency based on mission need.

a. Additional module customization by contractor for the base year and option years 1 through 4.

b. Additional module customization assistance by contractor to NTSB personnel for the base year and option years 1 through 4.

1. Are these FFP hourly rates to be proposed on the “Discovery

Services” and “Implementation Services” lines?

2. If the answer to Question 1 is yes, because these FFP rates are to be utilized for undetermined future requests, should the hours/quantity be listed as zero?

3. If the answer to Question 1 is no, where in the Price Quote should these FFP rates be provided?

There are two pricing requests being asked in the solicitation. In Section B.3, the NTSB requires to understand the total firm-fixed price hourly rate and total estimated number of hours it will take to complete discovery and implementation for the base year requirement. Additionally, for potential future customization or development of various modules, the NTSB would like the vendor to provide the firm-fixed price hourly rates for future work. The hourly rates for future work will not be evaluated; however, the hourly rates and quantities in Section B.3 will be evaluated to determine an overall estimate of the project. The firm-fixed hourly rates for the potential additional work does not require a quantity at this time. The selected awardee will provide separate price quotes with quantities using the established firm-fixed price hourly rates for the subsequent task order requests. The additional firm-fixed price hourly rates shall be provided in the vendor's submitted price quote as requested in Section L.7, Part III, Price Quote.

RFQ Attachment 2, Item #2, subparagraph 3) on page 14 states:

Include all information requested under section L #5 Part III “Price,” as well as completed solicitation Sections A, J, and K.

1. Please confirm that Section J – List of Attachments is not required.

2. Please confirm that reference to “section L #5” should be “Section

L #7”.

1. Completing all attachments listed under Section J is required. Attachment 1, Request for Quote - SF-18, page 1 is Section A, which numbers 13-16 must be completed and submitted with the quote. Section K of Attachment 1 is only required if the vendor does not have an active account in the System for Award

Management (SAM).

2. Yes, the reference to L.5 should be L.7.

"Web-Based Incident Management Software Solution"

Requirement 2.1.12 (p. 7) states, "Ability to provide an instant messaging system that does not maintain a permanent record of the messages." Can you provide clarification of this requirement, specifically the longevity of the messages? Do you have a specific time limit in mind that these messages would remain active? Messages need to remain active for 30 days.

Regarding Security Requirements (p. 9), is FISMA Moderate certification enough for this project? Yes

2.1.8 Ability to allow limited (read only) to others depending on the nature of the event.

A word appears to be missing here…allow limited what to others?

Ability to allow limited (read only) access to system entries based on the nature of the event.

2.1.11 Ability to allow the NTSB to provide portal access to outside originations who are not operating the same software/solution.

Please elaborate with additional details, as we are unclear as to the

NTSB’s intent. Does the NTSB want to provide logins to its WebEOC system to non-NTSB individuals outside the firewall? Or perhaps it envisions the creation of a web portal that allows non-WebEOC systems to connect to its WebEOC system via API or other connective means? It’s unclear whether this is a question about external user access or external organizational system connectivity. Yes, there is a requirement to allow outside agencies access as needed.

3.3 Ability to integrate with Active Directory.

Is Active Directory Single Sign-on a hard requirement? NTSB does not currently license the Single Sign-on module for WebEOC, so that would require procurement of the module. Not required.

Attachment 4 – Non-Disclosure

Is the NDA due along with the RFQ response on January 17, 2020, or should it be submitted earlier? The NDA is required at the time of quote submission on January 17, 2020.

Attachment 1 – RFQ (Clause 52.252-2 Clauses Incorporated by

Reference Page 8)

Please send a copy of the full text that is applicable to this RFQ.

Vendors may find the full text for those clauses that are listed by reference at www.acqusition.gov as stated in clause 52.252-2.

490 L'Enfant Plaza East SW Washington, DC, 20594-0003, US