Amd 0001 Attachment A Q and As.pdf

Solicitation 9594CS26Q0053 – Amendment 0001 Attachment A - Questions and Responses

Question #1: Is there any incumbent/recompete or this is a brand-new project? If yes, could you please provide us with their award number or even if the customer bought similar services in the past.

Response: See solicitation section L.13. There is no incumbent.

Question #2: Is CSOSA interested in deploying this system on Appian?

Response: The contractor should provide this in the proposed solution if this is their offering

Question #3: References L.6.3 / M.3.1 (Factor 1 Gate). Factor 1 requires the proposed cloud platform to hold a current, active FedRAMP Moderate (or higher) Authorization on the FedRAMP Marketplace at the exact time set for quote submission, and states that a status of "In Process" or "FedRAMP Ready" results in an Unacceptable rating. Will the Government consider, as an alternative path to satisfy this gate, (a) a current FedRAMP Ready designation paired with a binding authorization milestone schedule, or (b) CSOSA acting as the sponsoring agency for an agency authorization, given the platform already operates on FedRAMP High authorized AWS GovCloud and has completed a 3PAO Readiness Assessment? If neither alternative is acceptable, please confirm that only a live "FedRAMP Authorized" Marketplace listing for the exact proposed offering will pass Factor 1.

Response: (a) No alternative will be accepted. (b) No, CSOSA will not act as a sponsoring agency.

Confirmed only a live FedRAMP Authorized listing for the exact proposed platform offering will pass Factor 1.

Question #4: Reference L.6.2 / L.6.4 (Technical Quotation format). Section L.6.2 specifies font type and size but does not state page margins or page size for the technical quotation. Please confirm the required page margins (for example, 1 inch on all sides) and page size (8.5 by 11 inches).

Response: See Amendment 0001, revision to section L.6.2.

Question #5: Reference L.6.4 (Factor 2 page limit). Section L.6.5.2 sets a 5 page limit per Relevant Project Experience reference (Factor 3) and L.6.8.2 sets a 5 page limit for the draft transition plan (Factor 6), but no overall page limit is stated for Factor 2 (Technical Approach) or Factor 5 (Management and Support). Please confirm whether an overall page limit applies to the technical quotation and to Factor 2 and Factor 5 specifically.

Response: For information added regarding page limits, see Amendment 0001, changes to solicitation sections L.6.4.1, L.6.4.2, L.6.4.3, L.6.4.4, and L.6.7.2.

Question #6: Reference L.6 (page-count treatment of graphics). Please confirm whether tables, charts, graphs, screenshots, and diagrams (for example, the System Architecture and Authorization Boundary diagram in L.6.4.3 and the sample monthly report in L.6.7.2) count toward any applicable page limitation, or whether they are excluded from the page count.

Response: See response to Question #5.

Question #7: Reference L.6.4.2 / L.9.2 (demonstration delivery). Given the 10 MB per email limit in L.9.2, please confirm the acceptable method and any size limit for delivering the recorded 90 minute capability demonstration (for example, a Government-approved secure file transfer link), and confirm whether the demonstration link counts against the email size limit.

Response: The Quoter shall submit the recorded demonstration via a secure, accessible hyperlink within its email submitting its quote. The email itself (including the text link and all attachments) must comply with the 10 MB email size limit specified in Section L.9.2. The actual video file hosted at the provided link is excluded from the 10 MB email attachment restriction; however, the hosted video file shall not exceed a maximum file size of 2 GB.

9594CS26Q0044 – Amendment 0001 Attachment A

Question #8: Reference L.6.6 / L.6.6.2 (Past Performance, CPARS in lieu of PPQ). To reduce the burden on client points of contact, please confirm that submitting completed CPARS from CPARS.gov for the Factor 3 reference projects fully satisfies Factor 4 and that the referenced client need not also complete the Attachment J-8 Past Performance Questionnaire for those same projects.

Response: Solicitation section L.6.6.2 states, “In lieu of providing the above identified completed past performance questionnaires, the Contractor may provide completed Contractor Performance Assessment Reports (CPARs)...”

Question #9: Reference M.3.3 / M.3.4 (relevance of analogous experience). For Factor 3 and Factor 4, please confirm whether reference projects involving closely analogous Federal law enforcement and criminal justice data integration, dashboarding, and secure analytics (rather than an identical local police CAD or RMS deployment) will be treated as relevant public safety analytics experience.

Response: Confirmed. Yes, referencing projects closely analogous Federal law enforcement and criminal justice data integration, dashboarding, and secure analytics will be treated as relevant publish safety analytics experience.

Question #10: Reference L.13 (no incumbent, phase-in, and knowledge transfer). Section L.13 states this is a new requirement for CSOSA. Please confirm there is no incumbent contractor, no Government furnished existing analytics platform, and no funded incumbent or Government knowledge transfer or phase-in period; and confirm that performance and the deployment timeline begin at award, with the Project Management Plan due 60 days after award per SOW C.3.

Response: Confirmed. There is no incumbent and no Government furnished existing analytics platform and confirmed, yes deployment begins at the timeline at award and Project Management Plan due 60 days after award.

Question #11: Reference SOW C.7.2 / C.12 (data access and the two external sources). Please confirm that the Government will provide timely access to sanitized or test SMART 21 (Azure SQL) data and the SharePoint Data Library, along with the relevant schemas and data dictionaries, and please identify the connection methods, credentials, and points of contact for the two external data sources to be integrated under C.7.2.5 and for the law enforcement partners named in C.5.4.2 (MPD, PGPD, APD, FCPD).

Response: Yes, the Government will provide access to agency owned or managed data upon the contractor receiving security clearance.

Question #12: Reference SOW C.5.3.2 / C.5.6 / L.6.7 (CJIS authority). Please confirm whether a CJIS Security Addendum and a signed management control agreement will be required at award, and identify the CJIS Systems Agency (CSA) of record for NCIC derived data accessed through SMART 21, so the contractor can align its CJIS compliance evidence and U.S. person attestations.

Response: No CJIS agreement will be required at award.

Question #13: Reference B.2 / G.3.5.4 / J-9 (withholding on recurring items). The award is firm-fixed price with a 10 percent invoice withholding released semi-annually. Please confirm how the 10 percent withholding and semi-annual payout apply to recurring subscription line items (Core Analytics Software License and 24/7 Support and Maintenance) versus one-time milestone deliverables, so the Fixed Price Payment Schedule can be aligned to G.3.5.4.

Response: See Amendment 0001, changes to solicitation section L.7.3. The 10% invoice withholding and semi-annual release schedule applies only to one-time milestone deliverables and the invoice for the on-site technical analyst (because this effort is firm-fixed priced and to ensure the work required for this price element is acceptable and timely, the withholding must apply). The 10% invoice withholding does not apply to recurring subscription line items (Core Analytics Software License and 24/7 Support and Maintenance).

Question #14: Reference J-9 / SOW C.12 (firm pricing baseline for ingestion). Please confirm that the data volumes in SOW C.12 (SMART 21 of approximately 75 to 99 GB; SharePoint of approximately 260,000 documents and 40,000 photo files across 151 sites) are the firm baseline for firm-fixed pricing, and confirm whether growth materially beyond this baseline during the 36 month term would be addressed by contract modification rather than absorbed under the fixed price.

Response: The high level estimation of growth would be approximately 35% – 42% per year.

Question #15: Reference L.6.7.1 / M.3.5.1 (Government SLA targets). Please confirm whether the Government has minimum required response and resolution targets for Severity 1, 2, and 3 issues, or whether the contractor's standard Service Level Agreement governs and will be evaluated as submitted.

Response: The Quoter’s standard Service Level Agreement (SLA) will govern and be evaluated as submitted. As noted in Section M.3.5.1, shorter and more aggressive guaranteed response and resolution windows may be evaluated more favorably.

Question #16: Is this activity considered a new requirement or a follow-on to an existing contract?

Response: See solicitation section L.13.

Question #17: If there is an incumbent, would you be able to share the vendor’s name, and the contract number so that I may identify it in Sam.gov?

Question #18: Section G.3.5.4 outlines a mandatory 10% invoice withholding mechanism. Will the Government clarify whether this 10% retention applies strictly to the platform's core SaaS licensing fees, or does it also encompass the labor invoices submitted for the continuous, recurring services of the on-site Full-Time Technical Analyst?

Response: See response to Question #13.

Question #19: Regarding the bi-annual release of the accumulated withholding described in Section G.3.5.4.3, if a specific project deliverable or milestone experiences an agency-directed delay, will the withholding release for unrelated recurring support services still be authorized for payout?

Response: Yes. If a specific project deliverable or milestone experiences an agency-directed delay, the bi-annual release of accumulated withholding for unrelated, successfully performed recurring support services will still be authorized for payout, provided the Contractor is otherwise in compliance with the terms of Section G.3.5.4.3 for those specific services. An agency-directed delay on a specific project deliverable will not negatively impact or freeze the withholding release scheduled for unrelated, operational recurring support services that have been satisfactorily delivered.

Question #20: Section B.2 specifies that this is a firm-fixed-price contract with zero price adjustments or escalations permitted over the 36-month period of performance. If an external municipal data feed (e.g., MPD or FCPD) introduces breaking structural alterations to their native API or egress pricing models during contract execution, what equitable adjustment mechanism will the Government utilize to cover the vendor's unanticipated engineering or data ingestion costs?

Response:

a. As a Firm-Fixed-Price award, price adjustments for routine maintenance or minor third-party API updates are not permitted. However, if an external data feed introduces structural alterations that fundamentally change the Government's requirements or fall outside the original Statement of Work, the Government may evaluate the need for a bilateral contract modification pursuant to FAR 52.212-4(a) (Changes).

b. To enable the Government to objectively evaluate whether a future third-party alteration constitutes a material change in scope, Quoters must explicitly define and quantify their technical and financial baseline assumptions regarding these API/data feeds within their submitted quote. This must include the specific ingestion models, data structures, and egress pricing structures upon which their fixed price is based. Without this information, the Government will not be able to determine there has been a significant change.

Question #21: SOW Section C.16.3 reserves the right for CSOSA to download its data at any time without "retrieval fees". Will the Government confirm that "retrieval fees" refers to vendor-imposed software penalties, and that excessive cloud-hosting data egress volumes initiated independently by the agency will be funded directly by CSOSA?

Response: The Government confirms that "retrieval fees" refers to proprietary vendor-imposed administrative penalties or software licensing costs to access or export data. However, the Government acknowledges that physical cloud data egress incurs infrastructure costs. To maintain the Firm-Fixed- Price framework, Quoters must include a reasonable baseline volume of data egress (e.g., 5 TB per year] or "routine monthly backups") within their quoted price. If Government-directed data downloads exceed this defined baseline and result in material, un-forecasted cloud infrastructure costs, the parties may evaluate the need for a bilateral contract modification pursuant to FAR 52.212-4(a). Offerors must explicitly define their quoted cloud egress volume baselines within their technical quote.

Question #22: Will the Government cap Contractor liability under H.15 based on total contract value or insurance limits?

Response: No. Liability under Clause H.15 is not capped by the total contract value or by the minimum insurance limits required under the contract. Per H.15.1 and H.15.5, the Contractor is required to indemnify the Government against any and all claims, losses, or liabilities arising out of contract performance.

Question #23: SOW Section C.12 defines the legacy baseline data environment as an Azure SQL database holding up to 99 GB of case management data (~106,000 files) and a SharePoint architecture consisting of 151 sites (~300,000 total documents and unindexed photos). Will the Government provide a sample schema map or data dictionary for the SMART 21 system prior to the proposal deadline to ensure accurate data modeling estimation?

Response: No, CSOSA won’t be providing a schema or data dictionary pre-award. Each domain that gets modeled will be based on requirements that the Government identifies and none of them will require the entire Smart system to be modeled all at once. The Government’s expectation is that this dialog will begin post award and will be iterative per requirement and/or domain.

Question #24: Are the approximately 40,000 SharePoint photo files required to be OCR-indexed, or only ingested and displayed?

Response: The answer depends on how the proposed system works and if requirements are identified to require that. At the moment, the Government is not aware of a requirement to OCR-index any photos.

Question #25: Can you define the “critical match” criteria required for real-time alerting under C.7.2.4?

Response: A critical match is a data element that directly corresponds to a key identifier—such as a person, event, condition, or indicator—defined by the specific use case. When the system detects this match in real time, it triggers an alert because it represents a high-priority or high-impact condition that requires immediate attention.

Question #26: SOW Section C.7.2.5 mandates that the on-site analyst integrate two additional external data sources to be identified by the COR post-implementation. To ensure fairness of Firm Fixed Price, can the Government clarify if external data sources will utilize standard REST/HTTPS protocols or pre-existing OpenAPI/Swagger specifications?

Response: Until the external data sources are identified it’s not possible to commit to any protocol constraints. Once the external systems are identified, we will know more about the protocols and/or level of effort.

Question #27: SOW Section C.5.4.2 mandates universal search capabilities across six specific platforms (SMART 21, SharePoint, MPD, PGPD, APD, and FCPD). Does CSOSA currently possess active Interagency Agreements (IAAs) or Memorandum of Understanding (MOUs) granting programmatic credentials and legal security clearances to pull data from these four external municipal police networks, or is the vendor responsible for negotiating these data-sharing pipelines?

Response: The Government will facilitate any modifications of existing or new IAA or MOUs required for these data exchanges.

Question #28: SOW Section C.5.4.6 requires the platform to deliver an "auditable deduplication and merge" capability. Will the Government clarify if it requires automated, deterministic machine-learning deduplication upon ingestion, or if it requires a manual, human-in-the-loop workflow configured by the on-site analyst?

Response: The Government requires an "auditable deduplication and merge" capability as specified in Section C.5.4.6 but does not strictly dictate whether the underlying mechanism must be automated machine-learning or a manual, human-in-the-loop workflow. Pursuant to Section L.6.4.1, Quoters must propose their specific technical approach to meeting this requirement, ensuring that whatever method is utilized remains fully auditable. The Government will evaluate the effectiveness and efficiency of the proposed solution during technical evaluation.

Question #29: Will the Government provide a mobile device management solution protecting the Government iOS and Android devices accessing the platform?

Response: See Amendment 0001, SOW section C.5.4.9.

Question #30: Under M.3.2.1.1, does “minimal customization” refer to pre-deployment configuration effort or ongoing operations support?

Response: Although workflows and light customization may be required there is no expectation a full development process would be required for this effort. This is not a development from scratch effort.

Question #31: SOW Section C.7.1.1 mandates that the on-site technical analyst perform an absolute minimum of 1,920 productive hours per 12-month period, explicitly excluding vendor PTO, sick leave, and corporate holidays. Given that standard federal calendars operating with 12 annual holidays and standard leave typically yield 1,800–1,860 productive hours, will the Government confirm that vendors may propose a designated primary analyst supplemented by a secondary pre-cleared resource to hit the 1,920-hour productive ceiling without violating FFP parameters?

Response: Contractors may propose a supplementary analyst and any required support personnel to deliver the required work products and deliverables. All supplementary analysts or support personnel with access to CSOSA network must be cleared. While multiple supplementary Contractor personnel can be cleared, the Government is only funding payment for 1920 productive hours for an on-site technical analyst. In addition, the expectation is that the Contractor will provide one consistent analyst to perform support on site and any supplementing personnel is only supporting for minimal hours that the dedicated person is not performing, e.g., vacation and if needed, sick leave.

Question #32: Can you please confirm if only one analyst is authorized to work on-site, per Section F.2.2?

Response: See response to Question #31.

Question #33: May a qualified substitute analyst maintain on-site coverage during the primary analyst’s leave without contract modification?

Response: See response to Question #31.

Question #34: May non-support engineering personnel work remotely within CONUS if they are U.S.

persons inside the Authorization Boundary?

Response: See Amendment 0001, added section C.5.6.4 which states, “Any Contractor personnel with a CSOSA clearance must work within CONUS.”

Question #35: Section H.1.3.3 states that the Contractor must allow up to 30 days for the Office of Security to process baseline background checks before an individual may begin work. However, Table 1 dictates that the Project Management Plan is due within 60 days of award. Will the Government confirm that the 36-month period of performance schedule will be adjusted day-for-day if agency background clearance processing times exceed the stated 30-day window?

Response:

a. No, the Government will not grant an automatic, day-for-day adjustment to the 36-month period of performance. The 30-day security processing timeframe begins only after complete, error-free background check packages are officially received by the agency’s Office of Security (following submission by the Contractor to the COR and subsequent internal routing).

b. Delays caused by the Contractor’s failure to submit complete forms, provide timely fingerprints, or respond promptly to Office of Security inquiries do not warrant a schedule extension. If the Government determines that a material delay was caused solely by unusual agency administrative processing exceeding the 30-day window, and that such delay directly impacted the critical path of deliverables, the Government will evaluate the necessity of a bilateral contract modification to adjust the schedule or period of performance pursuant to FAR 52.212-4(f) (Excusable Delays).

Question #36: In reference to the DCSA background investigation mandated in Section H.1.4, will the Government confirm that personnel who currently hold an active, favorably adjudicated Federal Public Trust or Secret clearance will be granted interim logical access to accelerate performance while the secondary CSOSA adjudication is finalized?

Response: No. Personnel who hold an active, favorably adjudicated Federal Public Trust or Secret clearance will not be granted interim logical access while the secondary CSOSA adjudication is finalized. All Contractor personnel must successfully complete the agency’s specific background investigation and adjudication process prior to being granted logical or physical access, regardless of their current clearance status or level held with other federal agencies.

Question #37: SOW Section C.16.5.5 states that the Contractor must provide at least 180 days' notice before making "breaking changes" to the system API. Will the Government confirm that maintaining backward-compatible endpoints (e.g., preserving a dedicated, unchanged API version specifically for CSOSA data streams) satisfies this requirement, allowing global platform updates to proceed uninterrupted?

Response: Yes, the Government confirms that maintaining backward-compatible endpoints (e.g., preserving a dedicated, unchanged API version specifically for CSOSA data streams) satisfies this requirement, allowing global platform updates to proceed uninterrupted?

Question #38: SOW Section C.5.5 mandates that any third-party SaaS or managed services touching agency data or metadata (including logging, monitoring, and ticketing systems) must reside inside the Authorization Boundary or hold an independent FedRAMP Moderate authorization. Will the Government clarify if commercial, multi-tenant ticketing applications used solely for meta-support tracking without ingesting Criminal Justice Information (CJI) are exempt from this hard boundary restriction?

Response: The Government clarification – a commercial, multi-tenant ticketing applications used solely for meta-support tracking without ingesting CJI would be an acceptable exemption from this restriction.

Question #39: SOW Section C.11.3 outlines agency review cycles of up to 15 business days for deliverables, and Section C.17.4 allows a 15-calendar-day validation period at contract closeout. Will the Government confirm that these review windows do not count against the vendor's required delivery timelines or the 10-day data extraction mandate?

Response: The contractor shall incorporate the dates to account for these variables in the project plan

Question #40: Section L.6.3 mandates a direct hyperlink to the cloud service offering's active listing on the official FedRAMP Marketplace. If a vendor provides an active FedRAMP Moderate SaaS platform, but integrates specialized components operating inside the same authorized GovCloud boundary, will the Government confirm that the primary platform’s Package ID satisfies the Factor 1 gate criterion?

Response: No. The Government will not confirm that the primary platform's Package ID meets the requirements of Factor 1. Every component of the proposed Cloud Service Offering (CSO) must collectively match the listings on the FedRAMP Marketplace for the offering to receive a PASS under the gate criterion. The Government requires that all components of a proposed solution align with the listings on the FedRAMP Marketplace. Therefore, the primary platform’s Package ID alone is not sufficient to pass Factor 1.

Question #41: Section L.6.4.2.2 establishes a strict 90-minute limit for the Technical Capability Demonstration. For vendors electing the live remote format via Zoom/WebEx, will the 20-minute Government Q&A session be paused or excluded from the 90-minute limit if technical setup or agency network connectivity difficulties arise?

Response: Question and answer session is included in the 90 minute. Technical setup or agency network connectivity issues will be counted outside the 90 minute time period.

Question #42: Section L.9.1 states that File 1 (Cover Letter) must contain all information identified in "L.4.2," File 2 must align with "L.4.3," and File 3 must align with "L.4.4". As sections L.4.2, L.4.3, and L.4.4 do not exist numerically within the solicitation text, will the Government confirm that the required contents are instead found in sections L.5, L.6, and L.7 respectively?

Response: See Amendment 0001 which corrects the sections referenced in section L.9.1.

Question #43: Does the reference to “C.7.5” in SOW Section C.11.2 refer to Section C.7.2.5?

Response: Yes; see correction identified in Amendment 0001.

Question #44: Do references to C.18.2, C.18.3, and C.19 in Sections L and M correspond to SOW C.17.2, C.17.3, and C.18?

Question #45: Do the citations in H.14.2.2 to H.12.2.1, H.12.2.5, and H.12.2.7 refer to the corresponding H.14.2 subsections?

Question #46: Is there a page limit for the Factor 2 narrative or the overall technical proposal?

Response: See response to Question #5.

Question #47: Will recorded and live demonstrations be evaluated identically, with neither format viewed more favorably?

Response: Neither format will be weighted or evaluated differently. Each demonstration will be evaluated identically.

Question #48: SOW Section C.13.2 defines "Derived Data" as a "work made for hire" and explicitly prohibits the vendor from using it to train external machine learning models. Will the Government confirm that this restriction applies strictly to commercial or multi-tenant model training, and that the vendor is authorized to utilize agency data to train and fine-tune localized, tenant-isolated models exclusively dedicated to CSOSA's environment?

Response: Confirmed, the vendor is authorized to utilize agency data to train and fine-tune localized, tenant-isolated models exclusively dedicated to CSOSA's environment for CSOSA use only.

Question #49: Does C.13.2 prohibit use of de-identified system telemetry for platform security, reliability, and performance monitoring?

Response: It does not prohibit the use of de-identified system telemetry for platform security, reliability, and performance monitoring?

Question #50: SOW Section C.14 states that automated processes within the platform utilizing agency data for "product improvement" must be disabled by default. Will the Government clarify if this restriction extends to automated, native database optimization, system indexing, or localized query performance tuning running within the secure Authorization Boundary?

Response: This restriction does not extend to automated, native database optimization, system indexing, or localized query performance tuning running within the secure Authorization Boundary.

Question #51: SOW Section C.15.1.3 stipulates that if an audit reveals unauthorized data retention or storage outside of CONUS, the Contractor shall be liable for the total costs of the audit. Will the Government agree to establish a reasonable liability cap for these audit costs under the firm-fixed-price framework to prevent unquantifiable financial exposure?

Response: No. The Government will not establish a liability cap for audit costs resulting from unauthorized data retention or storage outside of CONUS. Compliance with CONUS data storage requirements is a material obligation of the contract, and the Contractor maintains exclusive control over its IT infrastructure, cloud environments, and subcontractor data handling practices. The cost of an audit necessitated by a breach of these specific security terms is a direct consequence of non-compliance, and the risk remains entirely with the Contractor.

Question #52: SOW Section C.15.2 requires all metadata and backups to reside exclusively within the Continental United States (CONUS). Will the Government confirm that temporary, encrypted transit packets routing through standard tier-1 telecom infrastructure do not constitute a violation of this data residency clause, provided no data is at rest outside of CONUS?

Response: Yes. The Government confirms that temporary, encrypted transit packets that may traverse standard tier-1 telecommunications infrastructure do not constitute a violation of the data residency requirement so long as no Agency data (including metadata or backups) is stored, retained, or otherwise held at rest outside CONUS.

Question #53: Will pre-existing commercial software and configurations remain Contractor property, with CSOSA owning the Agency and Derived Data.

Response: Yes, pre-existing commercial software remain the contractor’s property.

Question #54: Which agency serves as the CJIS Systems Agency responsible for validating the Contractor’s CJIS compliance?

Response: All security compliance will be assessed through the agency’s Authority to Operate Process in addition to the annual IG security auditing process.

Question #55: Within what timeframe after award will CSOSA provide system credentials, API access, and network connectivity for integration?

Response: Agency network access and credentials will be issued upon meeting security clearance compliance. Security clearance can take up to 30 days. Access to network resources will be provided within 5 days of clearance authorization.

Question #56: Section L.6.8.2 and SOW Section C.17.2 mandate the complete extraction and return of all historical records, audit logs, and system-generated insights within a strict 10-calendar-day window at contract end, performed at no additional cost. Given that extracting up to 99 GB of database elements and over 300,000 document/photo assets requires extensive pipeline throughput, will the Government modify this to 10 business days, or confirm that the 10-day clock begins only after the final schema map and export scripts are jointly approved by the COR?

Response: See Amendment 0001, revision to solicitation section L.6.8.2 and Attachment J-1, section C.17.2.

Question #57: SOW Section C.17.4 provides CSOSA with 15 calendar days to inspect and validate the final data export. If the contract period of performance has officially expired during this verification window, under what contract vehicle or funding mechanism will the vendor be compensated for engineering support required to rectify disputed files within the mandatory 5-business-day remediation window?

Response:

a. No additional contract vehicle or funding mechanism will be utilized. This is a Firm-Fixed-Price contract. Under FAR 52.212-4(a) (Inspection/Acceptance), the Government reserves the right to inspect deliverables and require repair or replacement of nonconforming services or work products at no increase in contract price.

b. The 15-calendar-day inspection window is an inherent part of the contract's quality assurance process. If the final data export fails to meet the explicit technical requirements stated in the contract, the Contractor is legally obligated to rectify the deficiencies within the mandatory 5-business-day remediation window at their own expense, regardless of whether the formal period of performance has concluded.

Question #58: SOW Section C.17.5.3 mandates that a notarized Certificate of Destruction signed by the Contractor's corporate Chief Information Security Officer (CISO) must be delivered within 10 days of the data purge. Will the Government confirm that electronic notarization (e-Notary) is acceptable to satisfy this mandate?

Response: Yes – In accordance with 36 CFR Part 1230, CSOSA accepts an electronic notarization (eNotary) to meet Section C.17.5.3, which requires a notarized Certificate of Destruction signed by the Contractor’s CISO within 10 days of the data purge.

Question #59: What are the Government’s review and approval turnaround times for the PMP, SSP, and Training Plan?

Response: See Amendment 0001, Attachment J-1, newly added section C.21.

Question #60: SOW Section C.5.4.10 mandates a continuous platform and API availability level of 99.9%, excluding scheduled maintenance. Will the Government clarify if an API outage caused entirely by a downstream infrastructure failure or an unannounced breaking change initiated by an external municipal partner (e.g., MPD, APD) will be excluded from the vendor's availability metrics and Monthly Performance Report calculations?

Response: Performance metric calculations shall exclude any network outages planned or unplanned by any of the agencies providing data feeds to include the source data CSOSA.

Question #61: What incident notification window applies under C.5.4.10, given that H.1.11.2 specifies one hour?

Response: See Amendment 0001, revision to solicitation section C.5.4.10.

Question #62: SOW Section C.18 requires the submission of a Monthly Performance Report by the 5th business day of each month. Will the Government confirm that failure to meet this specific monthly administrative deadline will not result in the rejection of the primary platform invoice or trigger a dispute under Section G.3.6?

Response: The Monthly Performance Report will be required as supporting documentation for the monthly invoices.

Question #63: Section L.5 Note 1 states that if a Quoter is an authorized reseller rather than the manufacturer, the NAICS code will be re-mapped to 541519 with a small business size standard of 150 employees. Will the Government clarify how this re-mapping impacts the evaluation under Factor 1 (Gate Criterion), and confirm that a reseller utilizing a manufacturer's FedRAMP Moderate cloud platform will receive a "PASS" if they provide the mandatory manufacturer authorization letter or point of contact?

Response:

a. The re-mapping of the NAICS code referenced in Section L.5, Note 1, relates solely to size standard determinations and does not alter or impact the evaluation criteria for Factor 1 (Gate Criterion).

b. As stated in L.6.3.1, the requirement is for the proposed public safety data analytics cloud platform to hold a current FedRAMP Moderate Authorization at the exact time and date set for submission.

A Quoter operating as an authorized reseller may achieve a "PASS" under this gate criterion, provided that:

(1) The underlying Cloud Service Offering (CSO) being proposed is the exact solution authorized on the FedRAMP Marketplace.

(2) The Quoter provides the mandatory evidence required by L.6.3.2 (the direct hyperlink, CSP name, and Package ID for that authorized solution).

c. This Amendment 0001 adds a requirement to identify as a manufacturer or a reseller and, if a reseller, to provide a manufacturer authorization letter to prove reseller status. Note that while a manufacturer authorization letter is required (via change identified in Amendment 0001) to prove reseller status, it cannot be substituted for the specific evidence (hyperlink and Package ID) demanded in L.6.3.2.

Question #64: Section M.2.2 establishes that Factor 2 (Technical Approach) is more important than all other non-price factors, and that combined, the non-price factors are more important than price. Will the Government clarify if a technical solution that drastically exceeds the baseline requirements of Table L.1 (e.g., offering pre-built API integrations for all external municipal partners on Day 1) will be assigned a higher adjectival rating or technical weight to justify a price premium over a baseline compliant quotation?

Response:

a. The Government will evaluate all quotes strictly in accordance with the evaluation criteria set forth in Section M. Per Section M.2.2, this is a Best Value procurement where Factor 2 (Technical Approach) is more important than all other non-price factors, and non-price factors combined are more important than price.

b. Pursuant to the evaluation methodology, features or capabilities that exceed the baseline requirements and offer clear, quantifiable operational benefits to the Government may be evaluated as "Strengths." The assignment of adjectival ratings will depend entirely on the totality of the Quoter’s technical approach and the degree to which it reduces performance risk or enhances capability. As stated in solicitation section M.1.2, “Award may be made to other than the lowest priced quotation if the Government determines that a price premium is warranted due to technical merit.”

Question #65: Section L.6.6.1 specifies that Past Performance Questionnaires (PPQs) must be emailed directly to the Government by the client reference no later than the July 2, 2026 deadline. In the event that a busy municipal client reference fails to submit the form directly to the agency despite proactive vendor reminders, will the Government consider alternative verification methods, such as contractual documents or pulling active historical data from the Contractor Performance Assessment Reporting System (CPARS), to prevent an administrative "FAIL" or an unexpected neutral score?

Response: Solicitation section L.6.6.2 states, “In lieu of providing the above identified completed past performance questionnaires, the Contractor may provide completed Contractor Performance Assessment Reports (CPARs)...” In addition, section M.3.4.2 states:

M.3.4.2 The assessment is based on the Government’s review of past performance information submitted and any obtained by the Government from other sources the Government deems appropriate.

Question #66: User base size — How many total users by tier (Admin, Power User, End User)?

(licensing costs)?

Response: Amendment 0001 revises Attachment J-1, section C.12 to add CSOSA’s user base.

Question #67: Mobile device count — How many iOS and Android devices need to be connected?

(affects infrastructure and support scope)?

Response: Amendment 0001 revises Attachment J-1, section C.12 to add CSOSA’s mobile device count.

Question #68: Data ingestion volume — Will the ~75–99 GB SMART 21 database and ~260,000 SharePoint documents be the ceiling, or is growth anticipated over the 36-month term? (storage/capacity pricing)?

Response: Amendment 0001 revises Attachment J-1, section C.12 to add data ingestion volume.

Question #69: API call volume — Is there an anticipated volume of API calls/bulk extractions that the contractor should price for?

Response: API volume call limitations is not a Government requirement

Question #70: Concurrent user load — What is the expected peak concurrent user count to ensure the 99.9% SLA can be priced accurately?

Response: Amendment 0001 revises Attachment J-1, section C.12 to add concurrent user load.

Question #71: Is this new requirement?

Question #72: Statement of Work, Section C.7.

a. CSOSA has framed the requirement as a commercial SaaS acquisition, but Sections C.7 include obligations more typical of custom development, staff augmentation, or government-funded software development. Specifically, the issue is that the SOW requires a dedicated on-site full-time technical analyst for 1,920 productive hours per year, Monday through Friday, for the full 36-month period, and assigns that individual integration, configuration, workflow, dashboard, alerting, and external data-source implementation tasks.

b. Section H.13 of the Solicitation indicates the Government is not purchasing Personal Services, but the government’s requirement under this C.7 of the Statement of Work align closely with the factors for such services under FAR 37.104 (on-site performance, overnment-furnished tools, services applied directly to agency mission, need beyond one year, etc.)

c. Would the Government consider amending its requirements under C.7 of the Statement of Work to instead state outcome-based implementation and support obligations, with the contractor retaining discretion over staffing model, location, personnel mix, and delivery method?

Response: The Government requires at least 1 on-site analyst. Other staffing resources are at the discretion of the contractor and should be clearly identified and described in the response to the solicitation.

Question #73: Statement of Work, Section C.13.

a. Similarly, the Government has framed its requirement as a commercial SaaS acquisition governed by FAR Part 12, but Section C.13 of the Statement of Work requires relinquishing intellectual property rights that are more closely aligned with custom code development projects. Specifically, for C.13, the concern is that CSOSA’s ownership language extends beyond Agency Data and exportable customer-specific outputs to “metadata,” “insights,” “analytics,” and “predictive models,” and treats Derived Data as a “work made for hire.” The Government’s requirement under this Section is materially broader than ordinary SaaS data ownership terms and risks transferring or encumbering platform IP, model logic, generalized know-how, product telemetry, and non-customer-specific analytics.

b. FAR Part 12.212 requires Commercial computer software and documentation must be acquired under licenses customarily provided to the public, and contractors generally should not be required to furnish non-public technical information or provide rights to use, modify, reproduce, release, perform, display, or disclose software except as mutually agreed upon. This is echoed under FAR 27.405-3.

Additionally, FAR 12.302(c) would advocate for the use of more IP rights clauses which more closely align with customary commercial practice.

c. In light of the above, would the Government consider amending Section C.13 of the Statement of Work to confirm Government ownership of Agency Data and customer-specific exports, while preserving the contractor’s ownership of the platform, software, algorithms, configurations of general applicability, know-how, usage telemetry, and de-identified or aggregated operational data that does not identify CSOSA, individuals, or Agency Data?

Response: See Amendment 0001 which deletes solicitation section C.13 in its entirety and replaces it with a revised section C.13.

Question #74: Statement of Work, Sections C.5.4.2, C.7.2.5, and C.12.

a. SOW Section C.5.4.2 identifies several potential data sources, including SMART 21, CSOSA’s SharePoint Data Library, MPD, PGPD, APD, and FCPD, and SOW Section C.7.2.5 requires integration of two external data sources to be identified by the COR.

b. Please provide a discrete list of all data sources the Contractor will be expected to ingest, search, access, integrate, or otherwise use under the contract, including for each data source:

a. The owning entity or agency;

b. Whether CSOSA already has legal authority and technical access rights to make the data available to the Contractor;

c. Whether the data source is publicly available, CSOSA-owned, or controlled by a third-party agency; and

d. For any third-party agency data source, whether that agency is expected to have its own contractual, data-sharing, or access relationship with the Contractor or platform provider.

c. This clarification is needed because the Contractor can only ingest or integrate third-party data where the data is publicly available, made available by CSOSA under proper authority, or provided by an entity that has an applicable customer, contractual, or data-sharing relationship permitting access through the proposed platform.

Response: The final determination of which data sources will be ingested will be made after the tool is selected, as the tool’s capabilities and features will influence which sources can be integrated. All access, authorization, and data-sharing approvals for those data sources will be managed solely by the Government. The Contractor will ingest only the data that the Government authorizes and provide.

Question #75: Solicitation, Section H.1.10. Solicitation, Section H.1.10, page 9, requires that the “Contractor must store, process, or transmit all PII, PHI, or Sensitive Information only within CSOSA-controlled IT resources.” Can the Government confirm that this does conflict with the Government’s stated requirement for a FedRAMP-authorized SaaS platform hosted in a contractor cloud environment under Section L.6.3?

Response:

This requirement does not interfere with the contractor’s already-approved FedRAMP cloud system described under Section L.6.3. The completed system’s Authority to Operate (ATO) will cover the platform, the application, and all system boundaries defined in the design documents and System Security Plan (SSP). All of the security settings and protections for the data stored in this system will remain fully inside that approved cloud environment.

Question #76: Section B: Would CSOSA consider splitting the acquisition of the Public Safety Data Analytics Platform (i.e. NAICS code 513210, Software Publisher) and associated secure compute/storage infrastructure to be separate from the Support Services tasks covered under other NAICS codes?

Response: No. In accordance with FAR 19.102, the Government must designate a single NAICS code that represents the preponderance of the work and the principal purpose of the acquisition. The designated NAICS code for this solicitation remains 513210, Software Publishers.

Question #77: L.6.3.1: Is CSOSA expecting the Public Safety Data Analytics Platform software (i.e. a PaaS component) that runs on FEDRAMP certified infrastructure to also be listed in the FEDRAMP Marketplace or is it expecting that only the infrastructure that has been configured to meet the FEDRAMP Security controls to be listed on the FEDRAMP Marketplace?

Response: Government has already clearly stated its position on Factor 1 in Question #40, and that answer governs the requirement here.

Question #78: SOW C.5.4.2 / C.12 : Can CSOSA provide additional information about the identified data sources and if the data is structured, semi-structured or unstructured for each of the data sources listed including:

o CSOSA’s current case management system (Supervision & Management Automated Record Tracking (SMART 21)) Approximately 96,000 archived files; and Approximately 10,000 active.

o CSOSA’s SharePoint Data Library, 151 SharePoint sites and corresponding libraries, including:

Approximately 260,000 documents; and Approximately 40,000 photo files.

o and external (other public safety partners) i.e., external systems with local public safety law enforcement partners, such as Metropolitan Police Department of the District of Columbia (MPD), Prince George’s County Police Department (PGPD), Alexandria Police Department (APD), and Fairfax County Police Department (FCPD).

Response: We can only provide this information for the SMART data, archived and active lives in a SQL database, organized in structured tables. The Data Library is in SharePoint, stored in a structured repository format.

Question #79: SOW C.12. Can CSOSA identify the Analytics use cases that will leverage SMART 21 and how it expects to lever the 96,000 archived files and 10,000 active files?

Response: This will depend on the analytics capabilities of the proposed system.

Question #80: SOW C.12. Can CSOSA identify the Analytics use cases that will leverage the CSOSA’s SharePoint Data Library and how it expect to leverage the 26,000 documents and 40,000 photo files?

Response: These will be provided during the project.

Question #81: SOW C.5.4.2 / C.12. Is CSOSA planning that the Public Safety Data Analytics Platform Software as a Service System will access the data where it stored, without moving the data, in the listed data sources (SMART 21, SharePoint, MPD, PGPD, APD, FCD) or is the plan to load or duplicate the data inside the security boundary of the Public Safety Data Analytics Platform Software-as-a-Service solution or some hybrid approach?

Response: The contractor should provide their approach.

Question #82: SOW C.5.4.2 / C.12. What are the expected data volumes that need to be stored within the Public Safety Data Analytics Platform Software-as-a-Service solution?

Response: SOW Section C.12 Data Sources. CSOSA’s current Case Management System (SMART 21) and SharePoint Data Library which consist of:

o CSOSA’s current case management system (Supervision & Management Automated Record Tracking (SMART 21)) Approximately 96,000 archived files; and Approximately 10,000 active.

o CSOSA’s SharePoint Data Library, 151 SharePoint sites and corresponding libraries, including:

Approximately 260,000 documents; and Approximately 40,000 photo files.

Question #83: SOW C.5.4.2 / C.5.5 / C.12. What is the existing FEDRAMP status of the listed data sources (SMART 21, SharePoint, MPD, PGPD, APD, FCD) and are they expected to be inside of the security boundary of the Public Safety Data Analytics Platform Software-as-a-Service solution? If they are not FEDERAMP Moderate or not inside the security boundary, what impact does connecting to those data sources have on the FEDRAMP compliance of the desired Software-as-a-Service solution?

Response: SMART and SharePoint used by CSOSA is housed in a FedRAMP certified environment.

Regarding FedRAMP status of systems outside CSOSA, if not in a FedRAMP certified environment, then the appropriate security requirements to integrate to these sources will be addressed by CSOSA.

Question #84: Can CSOSA Identify the following:

o Number of expected Data Producers and Data Consumers to be serviced by the Public Safety Data Analytics Platform o Number of External users that may receive Reports from the Public Safety Data Analytics Platform o Number of expected Data Producers and Data Consumers to be serviced by the Public Safety Data Analytics Platform o…