A11_NAFCPS-Questions_Responses.pdf

Non-Appropriated Funds Central Payroll System (NAFCPS) Request for Information Questions and Answers

Vendor Question DFAS Answer 1 Could you please provide the details of the current incumbent for this opportunity?

This is a new requirement. There is no incumbent.

2 Does the government expect the vendors to propose the required LCATs and FTE numbers to perform to the requirements or was the Pricing Spreadsheet missing information on those?

The government expects the vendors to read the PWS, and to provide pricing according to the FTE numbers located within Part 6, Attachment 3 and LCAT as described in Part 6, Attachment 4. The pricing spreadsheet has the title of the LCAT under column A, row 4 of the Excel spreadsheet and the FTE numbers to quote under column B, row 4

3 Do you need a quote to respond to this bid?

Is it possible to share the last incumbent and contract award number?

This is a sources sought, a response is requested for adequate acquisition planning.

Please read the description thoroughly. Everything needed is included within the description written.

Also, the PWS and pricing sheet are included to provide estimated pricing.

There is no incumbent on this requirement.

4 I was just reviewing the information for the subject RFQ that states it is seeking sources currently for information. Is this opportunity a hybrid or onsite and remote work or is it expected to be onsite 100%.

This is a Sources Sought not a Request for Quote.

It is remote work with the exception of any time that there is a need to go to the Data Center where the servers are at, due to an issue that cannot be resolved otherwise.

5 Scope of Work (Section 1.4): Ensure that all tasks listed (e.g., installation, configuration, maintenance of server hardware/software) have clear, specific requirements. For example, is the frequency of updates/patches clearly defined? Should there be specific timelines for the expected resolution of issues?

Objective: The objective mentions minimizing downtime and maximizing reliability. It may be beneficial to quantify what "minimizing" and "maximizing" mean in terms of acceptable downtime thresholds and specific reliability targets (e.g., 99.9% uptime).

Timeline could vary depending on the issue. We will expect immediate response.

6 Period of Performance (Section 1.5): The duration of the contract is clear, but does the PWS explain how extensions (four option periods) will be handled and what performance will be evaluated to trigger renewals?

The Performance Requirements Summary (Attachment 1) and the Deliverables Schedule (Attachment 2) list the areas that will be used to evaluate the vendor.

If there’s a continued need and it is in the best interest of the government, along with the vendor performing satisfactorily, then the government may exercise the option years.

7 Place of Performance (Section 1.6): The only time that the vendor will be required to be onsite is if there is a severe performance issue

This section allows work to be performed remotely or on-site.

However, the criteria for when on-site work is necessary versus when remote work is acceptable could be more explicitly stated. Are there specific tasks that must be performed on-site?

that cannot be resolved remotely and if there is a need to relocate the server to another Data Center.

8 Performance Metrics (Section 6.1 - Attachment 1):

Surveillance Methods: The PWS mentions 100% inspection by the NAF Program Manager. Clarification might be needed regarding what constitutes "100% completed" for tasks like status reports.

How are delays or incomplete submissions addressed?

Severity of Issues: Severity 1, 2, and 3 issues have response and resolution timelines (e.g., problem identified within 1 hour for Severity 1). Are there any penalties or specific escalation processes if these response times are not met?

Any delay or incomplete submission will be reported to the NAF Program Manager immediately. All deliverables must be a 100% completed and accurate. If the vendor fails to complete deliverables we will discuss with the Contracting Officer for further action.

9 Security Requirements (Part 2):

The requirements for personnel security investigations are clear, but it might be worth clarifying how long contractors have to comply with these requirements before starting work. Are there provisions for replacements if personnel fail to pass security checks?

In regards, resources offered must be comply when work begins. They cannot perform work until the security adjudication process is complete. So that performance is not adversely impacted and CPAR ratings are not negative, vendors must provide replacement resources that can go through the security adjudication.

10 Training Requirements (Section 4.10):

This section mentions knowledge transfer sessions for government employees. It would be helpful to clarify the expected frequency of these sessions, how feedback will be collected, and whether formal assessments or certifications are required for the trainees.

Training should cover processes of the performed work and the administration and maintenance of the server. The goal of the training is to provide training and documentation for a government employee to have the knowledge to serve as the backup administrator and perform the work independently. Training will be conducted four (4) hours per month unless a specific need requires additional training hours.

11 Quality Control Plan (Section 1.7.1):

While the PWS requires a Quality Control (QC) plan, it might be beneficial to clarify how frequently the QC plan needs to be updated or if there are any specific reporting formats or standards (e.g., ISO) that should be followed.

The Quality Control Plan is a living document. It should be updated as often as necessary to ensure that the work complies with the requirements in the PWS.

12 Travel Requirements (Section 1.7.3):

This section addresses travel approval by the COR. Clarifying the specific conditions under which travel will be deemed necessary and who bears the cost of unapproved travel could help avoid disputes.

All travel has to be approved first by the COR;

there is no unapproved travel. The vendor will prepare a Travel request and will submit to the COR for approval. Travel will be required when there is a Severity 1 condition that cannot be resolved remotely and requires to be present at the Data Center.

13 Deliverables (Section 6.2 - Attachment 2):

The deliverables schedule includes weekly status reports, management reviews, and training plans. It might help to include a definition of what is considered a "complete" deliverable. For example, should status reports include specific sections (e.g., project risks, task progress) every week?

Part 4 Specific Tasks of the PWS describes what are the requirements to be included in each of the status reports.

14 Technical Task Details (Part 4):

Some tasks, such as configuring/maintaining server hardware and software, are clear. However, tasks involving collaboration with other IT teams (Section 4.7) and application administration (Section 4.9) could benefit from more detail. For instance, how often should meetings be held, and what are the roles of each team?

Communication with DISA may be required depending on the issues. Meetings will be scheduled as needed. Other internal customers like the DFAS-TX Operations may be involved in the daily operations of the system.

15 Ambiguities in Language:

Words like "maximize," "minimize," "as needed," "as appropriate," or "support" may be too vague in some areas. Consider providing concrete, measurable expectations.

For example: Section 1.7.6: "The contractor must also be available for after-hours support/on-call for Severity 1." It may be beneficial to define "on-call" expectations more clearly (e.g., within how many hours should the contractor respond?).

Within 30 minutes of the initial call.

No “maximize,” no “minimize,” one “as needed” that was deleted. Do not know what we could use to substitute support that would stay true to the meaning of the sentences.

Paragraph 1.7.8 indicate that the COR, and other Government personnel, as appropriate, will meet with the contractor. It is not possible to determine who may need to be at the meeting. The COR will invite anyone (including the Contracting Officer) he deems necessary.

16 System Performance Monitoring (Section 4.2.16):

There are details about monitoring tools and the SysLog tool, but the specifics of what data must be logged and retained, as well as the reporting format, could be expanded for clarity. What are the retention periods for logs, and how should they be audited?

There are specific logging events that are required by the NIST regulation. We will discuss those with the vendor once the contract is awarded. We will use Galileo Active Monitor Software for IBMi and the IBM iSecurity Syslog Reporting Manager.

Through the SysLog software, logs will be sent to Sentinel (SIEM) which will make them available for six (6) months and then kept for an additional calendar year in storage. Other reports created through Galileo will be kept a similar amount of time.

17 Would we be able to sponsor the System Administrator for the T-3 clearance after they start work? If not, would they be able to start with an Interim Secret clearance?

The security adjudication process begins after the award is made and will be conducted by government personnel. Questions regarding waivers/interim security clearances may be discussed with security personnel after time of award.