9531BM25Q00140001 - Incident Management SW.pdf

9531BM25Q00140001, Page 2 of 11

National Transportation Safety Board (NTSB) RFQ: 9531BM25Q0014 – Amendment 0001

The purpose of this amendment is to:

1) respond to all questions received to date, and

2) incorporate into the solicitation a revised Statement of Work as of Amendment 0001, replacing the previous version, and

3) extend the due date and time for receipt of offers to 4pm EST on Friday, 9/5/2025.

1. I am reaching out with a question regarding RFP 9531BM25Q0014 - Web Based Incident Management Software Solution. Is this RFP based on the RFI for "Commercial Off the Shelf (COTS) Incident Management System (IMS) & Case Management System (CMS)" issued by NTSB in February 2025?

While the incident management requirements are similar between the two documents, there appears to have been a very substantial shift in the requirements from Case Management capabilities to Risk Management capabilities. Is this correct and there is no longer a case management component of the project?

NTSB Response:

The requirement described in RFP 9531BM25Q0014 is strictly for an Incident Management System. The Case Management portion that was included in the RFI is no longer part of the NTSB’s requirement.

2. Reserved.

3. Reserved.

4. Does 4.7 apply to a vendor who is already FedRAMP authorized?

NTSB Response:

There is a requirement that the awardee obtain FedRAMP authorization within 12 months of award. As part of the authorization, the vendor will have to produce a customer responsibility matrix (CRM) which is required for any cloud service offering under said program.

5. Section C, 7. Period of Performance. Does the NTSB also expect an ATO be received within the two months after date of award requirement that is mentioned in the SOW?

NTSB Response:

The ATO shall be completed within the first six months of the base year.

9531BM25Q00140001, Page 3 of 11

6. Section L, 5.0 Past Performance. Can copies of CPARS reports be submitted with the proposal in lie of signed Past Performance Questionnaires (PPQs)?

NTSB Response:

Completed PPQs are requested. The NTSB has access to CPARS.

7. Section L, 5.0 Past Performance. Will NTSB accept completed PPQs demonstrating performance by a subcontractor, or must all past performance references be that of the prime offeror?

The past performance record of a subcontractor will be considered if it is relevant.

8. Table A/Page 41. Can you clarify which services are grouped under Implementation Services

vs. Professional Services? Shouldn't module customization fall under Implementation Services?

NTSB Response:

Implementation services should include time and effort to implement a solution that meets the requirements listed in the SOW. Module customization should be handled under professional services only when the platform requires specific tailoring that is not supported by its standard features.

9. Table A/Page 41. Can you clarify what the quantity of 15 represents for Professional Services?

15 Hours

10. Table A/Page 41. Are the 250 simultaneous users all internal users or a combination of internal (e.g., back-office) and external users (e.g., external users who will log in from a portal)?

Can you provide an approximate count of internal (back-office) and external user?

NTSB Response:

All users will be internal.

11. 2.1.7 /Page 46. Can you confirm that the prerecorded messages will be in audio format?

NTSB Response:

Yes, prerecorded messages will be audio format.

12. 2.1.17/Page 46. Which web-based emergency notification system is used by NTSB currently?

Virtual Emergency Operations Center Software (VEOCI)

9531BM25Q00140001, Page 4 of 11

13. 2.2/Page 48. Integration with SAFTI - Will there be a bi-directional exchange of data between the new solution and SAFTI?

NTSB Response:

Yes. SAFTI has API capability for these data exchange. However, SAFTI is the authoritative system of records for any investigation

14. 2.2/Page 48. Of the 25 NTSB users to be trained, how many will require System Administration training?

NTSB Response:

Up to 15 users.

15. 3.2/Page 49. Ability to collaborate and share data with outside entities. How many entities does NTSB anticipate interfacing within the base year and in the option years?

NTSB Response:

Initially, a total of 5 for the base year and the same number for subsequent option years.

16. Section C/ Subsection 8/Page 51. Investigative line of business application -SAFTI. There appears to be some functional overlap with SAFTI. Is the new solution replacing some functions that are currently performed by SAFTI?

NTSB Response:

No.

17. B #2 (a)/Page 40. Could the government please clarify the $500,000 listed as the Maximum amount under Section B, 2 (a)? Does this mean the firm fixed price for this project cannot exceed $500,000?

NTSB Response:

The NTSB anticipates, over a base year and 4 option years, the maximum contract ceiling to be $500,000.

18. K/Page 21. If the offeror is registered in SAM, can it include a statement indicating that all representations and certifications are up to date in SAM, in lieu of submitting Section K?

NTSB Response:

Offerors may state that its Representations and Certifications are current and contained in

SAM.

19. L/Factor 2/Page 55. Data Migration Plan - What is the expected volume of data (number of records and total size) to be migrated?

9531BM25Q00140001, Page 5 of 11

This information will be shared during the discovery phase of the contract.

20. L/Factor 2/Page 55. Training - How many end-users and administrators will require training?

NTSB Response:

The total end user and administrator population requiring training will be up to 20 personnel.

21. Section C/Subsection 7/Page 51. The RFP states, "The software solution shall be fully implemented and operational no later than 2 months after date of award." Is "2 months" perhaps a typo?

NTSB Response:

As a result of this amendment, Section C, Statement of Work is revised to read, “The software solution shall be fully implemented and operational no later than three (3) months after date of award.”

22. Section C – Statement of Work, Item 5.1(Page 6 of 8) – Has a FIPS-199 (impact level assessment) been completed for this project, and can the results be shared? If not, shall vendors assume that the FedRAMP Impact Level requirement is “High”, due to the nature of this project (project includes critical safety, risk, hazard, 24x7 operations, and “critical support”)?

NTSB Response:

The FedRAMP Impact Level should be moderate.

23. Section C – Statement of Work, Item 5.2 (Page 6 of 8) – The FedRAMP Program has deprecated the use of NIST SP800-53 “Rev 4”, in favor of SP800-53 “Rev 5” in most instances.

Can the government confirm compliance with Rev 5 is required?

NTSB Response:

Yes. NIST SP-800-53 Rev 5 controls are required.

24. Is NTSB willing to sponsor FedRAMP authorization for vendors who are not yet FedRAMP authorized? If so, will the internal costs for NTSB to sponsor authorization be factored into the “best value” determination for award? (Note: GAO has evaluated agency sponsorship costs ranging between $69,000 and $400,000, with some as high as $706,000, per https://www.gao.gov/assets/d24106591.pdf)

NTSB Response:

The NTSB is willing to sponsor the awardee to attain FedRAMP Authorization; however, the vendor will be responsible for covering all associated costs. While current FedRAMP Authorization status or progress in attaining FedRAMP authorization may be considered https://www.gao.gov/assets/d24106591.pdf

9531BM25Q00140001, Page 6 of 11 in determining the best value offeror, the NTSB will not make the consideration based on anticipated costs in dollars that may be incurred to sponsor authorization.

25. Section C – Statement of Work, Items 5 and 7 – The system must be “fully implemented and operational no later than 2 months after date of award” and vendors “shall obtain FedRAMP authorization within 12 months”. Does this mean that NTSB use a “non-FedRAMP” version for up to a year? Will any discrepancy in cost for presumably lower “non-FedRAMP” base year prices be factored into the “best value” determination?

NTSB Response:

Yes, the solution can be non-FedRAMP compliant while in the process of obtaining FedRAMP certification, which must be completed within a year from the award date.

26. Section C – Statement of work, Item 7 Period of Performance – Has the NTSB established detailed criteria for “fully implemented and operational” status, to meet the 2-month deadline, and can those criteria be shared? Does this goal include adequate time for NTSB to evaluate and issue a software/cloud Authority to Operate (ATO), and/or would existing FedRAMP Authorization be deemed sufficient in lieu of an NTSB ATO?

NTSB Response:

We have captured some detailed criteria and will be shared during the discovery phase of the contract.

27. Is there an active incumbent contract supporting this effort for NTSB? If so, what is the contract number and/or Period-of-Performance? Per USASpending.gov, the incumbent mentioned in the prior RFI appears to have expired/lapsed.

NTSB Response:

The current NTSB contract for Incident Management Software is 9531BM20D0001 with a period of performance through 11/19/2025.

28. Given this requirement is for “cloud-based” and “SaaS Hosting” and “implementation, installation and configuration of software”, will the government accept small business designation in those NAICS codes such as 518210, or 541511, or 541519, etc.?

NTSB Response:

Offerors must be small businesses in accordance with the NAICS selected under the solicitation. The NAICS selected is consistent with the NAICS associated with the expiring NTSB contract for Incident Management Software.

9531BM25Q00140001, Page 7 of 11

29. Section C, Item 10.0 and Attachment C, Secure Software Development Attestation Form – Will the NTSB accept completed forms accessible/submitted via the CISA RSAA (CISA’s repository/system of record for SSDA forms)?

NTSB Response:

Vendors must complete the attestation form and submit it to NTSB for review as part of the solicitation response in accordance with the solicitation.

30. Is there an incumbent contractor for this requirement?

a) If so, what is their name and contract number?

b) If so, what is the name of the current system NTSB is using (i.e. brand/model of software/system)?

c) Is the current system meeting all the requirements of this SOW, and if not, what requirements is the current system not meeting?

NTSB Response:

Questions a & b have been previously addressed.

31. Factor 2 requires offeror to provide a transition plan.

a) What is the required transition period?

NTSB Response:

3 months as of this amendment.

b) Does the incumbent have responsibility for providing the system and services described in the SOW during the transition period, or is the incoming contractor?

NTSB Response: The incumbent will provide the system and services during the transition.

NTSB expectation is that both vendors will collaborate during the transition period to ensure proper knowledge transfer.

c) What are the requirements for data migration between the current system and the new system? (e.g., number of years of data to be migrated, number of historical cases, etc.)

NTSB Response: All the data in the system will need to be migrated to new system to ensure it fits with the new system data and logic structure.

d) Does the Government expect a single day (single hour, single moment) cutover from the current system to the new system, or a staged transition, for example where existing cases are handled by the current system and the new cases handled by the new system?

NTSB Response:

A full cutover from the current system to the new system.

32. If an offeror is invited to make a presentation for Optional Factor 4, may part of the presentation be pre-recorded and played back during the offeror's presentation?

9531BM25Q00140001, Page 8 of 11

Yes.

33. For Optional Factor 4, what is the list of features/capabilities/software functions which the offeror must present on, or is that to the discretion of an offeror?

NTSB Response:

Offerors must determine the features/capabilities/software functions to be presented in order to provide the required in Factor 4, per Section L of the RFP.

34. For Optional Factor 4, what are the real world scenarios which offeror should address? Or if these are not yet specified, can the Government suggest the category which these scenarios fall into (example, failure scenarios, performance scenarios, etc.)?

NTSB Response:

Scenarios will be presented to the offeror at the time of the presentation.

35. Please confirm that a 'neutral' evaluation for Factor 6 Past Performance, is considered 'Acceptable.'

NTSB Response:

Per the RFP, a Contractor will not be penalized in the evaluation with an unfavorable rating for lack of past performance or the failure of its past performance references to complete and submit the Past Performance Questionnaires.

36. SOW 2.1.2 (p. 2) requires "options to join telecoms." Please explain this requirement.

NTSB Response:

This requirement has been deleted.

37. SOW 2.1.10 (p. 2) requires "Ability to access system via any web-based connection (browser or internet connected device) with appropriate user authentication and security controls." Do 'internet connected devices' include mobile devices such as smartphones and tablets?

NTSB Response:

Yes, both, smartphones and tablets.

38. SOW 2.1.17 (p. 2) require "Ability to be compatible with web-based emergency notification system using SMS, landline, cell phones and emails to contact individuals 24-hours 7-days per week."

a) What specific web-based emergency notification systems is NTSB using or will be using (e.g., Giant Voice, Everbridge, etc.)?

b) Please confirm that this system will not be required to connect to emergency notification systems via Application Programmatic Interfaces (APIs), but only via SMS, telephones, and email messages that this system sends to the emergency notification system.

9531BM25Q00140001, Page 9 of 11

At present, the current software solution provides emergency notification capability. We can confirm that the system will not be required to connect to emergency notification systems. An internal solution would be ideal.

39. SOW 2.1.20 (p. 3) requires "Ability to send info with a button click from the Journal to the Daily Shift log." Neither 'journal' or 'daily shift' are mentioned anywhere else in the SOW. Please explain this requirement and its use case, including what specific information is included in the journal and daily shift log, how it is entered/maintained, etc. and please give an example.

NTSB Response:

All calls and events are journalized. Items of note are sent to a daily shift log that is viewable by agency principals.

40. SOW 2.1.22 (p. 3) requires "critical technical support available 365, 24 /7."

a) Is 'critical' defined as a 'severity 1' (system outage or unavailability)? If not, please define 'critical' in this context.

b) What is the expected service level agreement (SLA) associated with this "365, 24 /7" (example: email of issue, response within X hours, resolution within Y hours).

NTSB Response:

a) Yes. Severity 1.

b) For severity 1. Response with 1 hour and resolution within 4 hours.

41. SOW 2.1.23 (p. 3) requires 'Ability to allow NTSB personnel to create and customize modules with ease within the incident management software for data collection and reporting needs for various offices with differing missions and/or contractor development of new modules.' It then gives only two examples of 'Message templates' and 'Custom message distribution lists'.

a) Software is generally not indefinitely extensible and typically has limitations. For this reason, can the Government specify what other examples of 'modules' which the Government would like NTSB personnel to be able to create easily?

b) By 'easily', can such modules be created by 'scripting' if vendor training is provided or available to NTSB personnel on such scripting?

NTSB Response:

a) NTSB would like to have the ability to implement new business processes as requirements changes without major software development know-how.

b) Yes. Ideally, we will prefer that most of the capabilities exist. However, the proposed solution must stay within the guardrails established within the platform.

9531BM25Q00140001, Page 10 of 11

42. SOW 2.2 (pp. 3-4) gives a list of requirements associated with the 'Enterprise Risk Management Worksheet'.

a) Please provide a copy of this worksheet for offerors to review.

b) Is this worksheet digitized into the offerors' system and the completion of and workflows associated with the worksheet expected to be handled within the offeror's system?

c) This paragraph requires: "Contractor shall configure the platform to integrate with SAFTI Line of Business application". What interface does SAFTI use? Is it JSON, XML, or other API?

Please describe.

d) This paragraph requires: "Contractor shall configure the platform to provide RA information to launched staff." Please explain what 'launched staff' are.

NTSB Response:

a) The worksheet final product is dependent on the information entered; the type of team launched and will vary from form to form. The primary purpose is to provide a risk assessment of the risks a launch team may encounter.

b) The worksheet and workflows are completely handled within the system and all associated workflows

c) JSON and XML

d) “Launched Staff” refers to personnel who go (launch) to accident scenes. Sizes of teams can vary from one person launching to team of multiple staff.

43. SOW 3.1 & 3.2 (p. 5) requires that the solution be multi-tenant. What is the use-case for this if this solicitation is being purchased for a single customer, NTSB? Under this contract, and within the scope of this present SOW, will multiple tenants be set up for different offices/groups of users within the NTSB? Or will other tenants be set up for outside agencies such as the FAA, etc. within the scope of this present SOW? Or under the scope of this present SOW, there is only one tenant for NTSB, but the Government wishes this multi-tenancy capability for future expansion and use of the system by other agencies such as the FAA? Please explain and provide details such as what transfer of information or communications is required between different tenants, or if such tenants operate completely independently without any connection or data sharing between them.

NTSB Response:

We would like the vendor to describe how to accomplish separation of duties with the business processes implemented by the proposed solution.

44. Maximum number of concurrent users during major incident responses?

NTSB Response:

Up to the number requested in solicitation. 250 users.

45. Expected response time for critical operations (incident creation, update, search)?

NTSB Response:

Within 4-8 hours response time for operational issues. For system outages, see response question #40.

9531BM25Q00140001, Page 11 of 11

46. What are the specific data retention requirements for different incident types (aviation, highway, marine, rail, pipeline)?

Forever.

47. Are there different archival requirements for active vs. closed incidents?

NTSB Response:

Closed incidents should be retained forever and it can be moved to a lower tiered storage since access frequency will be very seldom.

48. Are there real-time data feeds from external sources (FAA, NHTSA, etc.) that need to be ingested?

NTSB Response:

Yes.

49. What authentication mechanisms are required for system-to-system communications?

NTSB Response:

System for cross-domain identity management. SCIM protocol support.

50. Should the system integrate with specific GIS services (ESRI, Google Maps, OpenStreetMap)?

NTSB Response:

We would like the vendor to propose a solution and cost.

51. Are there specific requirements for data segregation between different investigation teams?

NTSB Response:

Data segregation among team is required and the system should support role-based access control.

52. Are there requirements for predictive analytics or trend analysis?

NTSB Response:

Data Quality, data privacy, access control, actionable insights, robust data integration capabilities.