RFI Q and A.docx

Can you please confirm the due date/time for RFI responses. SAM.gov lists March 20 at 4pm; GSA eBuy lists March 25 at 5pm.

Answer: SAM.gov has closed. GSA open through March 25. Please respond accordingly in GSA. Do not email.

Also, is this RFI exclusively for small business, or can any size standard respond? The eBuy listing shows full and open, but the MS Word RFI document says this is market research specifically for small business.

Answer: This is an open RFI for market Research, we are open to all options at this time.

Lastly, the RFI document requests information about capabilities, qualified personnel, corporate experience, staffing estimates, and project cost – and this information (15 page White Paper) should be submitted via email. However, the eBuy RFI submission form doesn’t have boxes/fields for this information and instead requests a different set of documents/information. Which should we follow?

Answer: The CO is unsure of how the process works in eBuy from a Contractor’s prospective. Recommend reaching out to their help desk. Typically the contractor submits their response in PDF format as an attachment.

For all data sources within the scope of the program, how does ATF envision advanced relevance and ranking logic being applied to improve discovery and context, and should multiple retrieval approaches (e.g., lexical and semantic) be combined within a single federated query experience?

Answer: This RFI is part of market research, we are open to exploring multiple options and capabilities. We envision an advanced hybrid retrieval model that combines lexical (keyword) precision with Semantic (contextual) understanding into a single Federated query experience Can ATF provide estimated data volumes (current and projected) for each internal system (e.g., SharePoint, SQL, file shares, AWS‑hosted data), expected annual data growth over the life of the contract, and an approximate breakdown of unstructured content types (e.g., PDFs, Office documents, images, other media)?

Answer: Estimated Data Volume: 1-5TB, Annual Growth: 500GB-1TB, content types: PDF, MS Office Formats, Image Files, and others What role‑based and attribute‑based access control (RBAC and ABAC) requirements are expected for the Federated Search system, and what level of granularity is required for enforcing access to records and individual data fields at query time?

Answer: This RFI is part of market research, we anticipate ABAC at this time to enable field level granularity allowing specific data fields like SSN, notes etc.. to be masked or redacted based on users’ s permissions. This enforcement must occur at query time, ensuring that sensitive information is filtered out dynamically before search results are ever displayed to the user.

To support architectural design and scalability planning, can ATF describe the anticipated user population and general expectations for search usage and performance across internal, external, and hybrid searches?

Answer: User population should not exceed 500 concurrent users

Have you considered other acquisition models including OTAs or CSOs? OTAs are other transaction authorities that operate outside the FAR guidelines. CSOs are a fast-tracked, competitive acquisition method used by the federal government to rapidly procure innovative, commercial, or non-developmental technologies Answer: This is an RFI for market research, we are open to reviewing all options.

What is the basis for evaluation? Is Price more important than technical optimization?

Answer: The basis for evaluation will be issued during the solicitation phase, if issued.

What is the technical requirement for third party handshakes for different data sources? This is in response to page 4 of 23 on Federated Search PWS on section 1.3 second bullet point. External Connectivity: The contractor shall develop connectors for the authorized external/third-party data sources. These sources shall be Accurint AVCC, Clear, i2 Analyst Notebook, Transunion TLO, Vigilant/ License Plate Reader, Pennlink, Tangles, and Whooster Answer: Must provide interoperability with existing authentication mechanisms. Single sign-on, Multi-Factor Authentication (MFA), Active Directory Federation Services (ADFS), and Personal Identity Verification (PIV) authentication

The RFI states, "The respondent shall include information addressing all the above sections within the 15-page limitation not including diagrams or images…". Can the government confirm that diagrams and images can be included and will not be counted against the page limit, rather than diagrams and images not being allowed at all?

Answer: Confirmed, will not count against the vendor.

Are tables allowed? If so, do they count against the page limit? Does the Times New Roman 11-pt constraint apply to tables as well?

Answer: See above.

The RFI requires Conformity to ATF’s Agile Scrum Methodology and IT Methodology. Can you provide documentation on these methodologies?

Answer: Yes, Scrum or Kanban Methodologies are defined in the Attachment that was included with RFI.

The RFI requires Conformity to ATF Enterprise Standard Technologies. Can you identify these technologies?

Answer: Yes. SQL Server, Oracle, PostGres databases, Amazon Web Services (AWS) cloud, is included in attachment with RFI The RFI requires Use of Government provided tools to accurately document, administer, maintain code, configuration settings, system documentation, project artifacts, and user guides. Can you specify these tools?

Answer: Yes. SQL Server, Oracle, PostGres databases, Amazon Web Services (AWS) cloud The RFI requires Use of ATF CI/CD tools for system integration and stress testing. Can you specify these tools?

Answer: Yes. Cucumber, Digital.Ai, GitLab, Jenkins, JMeter, Junit, Katalon, Maven, Mockito, Nexus, Node.Js, OpenShift, Postman, SonarQube, Selenium, TestNG

No technical documentation is referenced for Spartan, NForce, NESS, or eTrace. Will ATF provide API specifications, database schemas, or integration artifacts?

Answer: This RFI is part of market research, the government will provide this as part of an RFP if this project is pursued, upon contract award.

Will ATF provide details on API access, licensing, automation restrictions, and authentication methods for Accurint, CLEAR, TLO, Vigilant LPR, Pennlink, Tangles, and Whooster?

Answer: This RFI is part of market research, the government will provide this as part of an RFP if this project is pursued, upon contract award.

The RFI lists 'moderate/high' impact. Can ATF specify an exact required impact level?

Answer: GCC High

Will ATF provide required or preferred labor categories or certifications for proposed personnel?

Answer: No, vendor should include respective LCATs in response to forthcoming solicitation No performance or latency targets are defined. Does ATF have query speed, concurrency, or throughput requirements?

Answer:

Will ATF provide technical details (API protocols, database schemas, security models) for Spartan, NForce, NESS, and eTrace?

Answer: Yes, upon award, this is for market research at this time.

Does ATF already hold API licenses and integration agreements for external vendors, or must the contractor provide them?

Answer: Yes. ATF will maintain. This RFI is part of market research, ATF currently holds several API licenses, however some will need to be provided by the contractor or renegotiated by ATF.

What level of data isolation is required (logical, physical, virtual indexing)? Is there a DOJ or FISMA overlay?

Answer: Yes, combination of the three (logical, physical, virtual indexing). Yes, FISMA Compliance is a requirement for all components Which NIST 800-53 Rev 5 baseline is required (Moderate or High)?

Answer: High Will ATF provide AWS GovCloud environments, VPCs, networking, and OpenShift clusters, or must the contractor provision them?

Answer: ATF will provide Does ATF require any minimum onsite presence beyond scheduled meetings?

Answer: All work should be completed onsite at ATF Headquarters in Washington, DC If AI is used for ranking or indexing only, does ATF classify this as covered AI under EO 14110?

Answer: AI is not utilized at this time

Will ATF provide licenses and access for Digital.ai and other required tools?

Answer: Yes Is containerization mandatory for all components, or only applicable modules?

Answer: It is not mandatory Will ATF provide an existing API gateway or must the contractor implement one?

Answer: Existing API gateways exist, but additional API’s may be required from the contractor Are there required uptime SLAs or availability targets (24/7, business hours)?

Answer: Infrastructure SLA’s exist (99.99%), Application SLA’s are dependent upon criticality. This will be further refined/defined after contract award

Does ATF require minimum automated test coverage percentages or performance thresholds? Answer: Yes

Can ATF specify whether transition must include recorded training, walkthroughs, or shadowing sessions?

Answer: All options should be included.

Is PIV authentication required for all application components, including backend APIs?

Answer: Yes (All applications must allow for PIV authentication although other auth mechanisms may be used)

Are all AWS GovCloud services available to the contractor or are some restricted?

Answer: All are available with the appropriate “need to know”

Will ATF provide pre-configured CI/CD pipelines or must the contractor build them?

Answer: ATF will provide

How many data sources do you anticipate needing to query with the solution?

Answer: All available information has been provided Is there a complete list of data types that will be searched? The RFI references SharePoint, Files, SQL, AWS, etc... Is this the complete list? Do you have a number of data types, even if there is not a complete list?

Answer: All available information has been provided Of the file types, is there more than Word, Excel, PPT, PDF? Of the PDF, will there be a mixture of "readable" PDF vs "non-readable" pdf?

Answer:No How many different data locations will be searched? What security protocols and postures that will need to be navigated for each different location?

Answer: All available information has been provided

The PWS requires a “search-time” aggregation architecture while also stating that internal and external data will remain logically and physically separate within the “indexing layer.” Please clarify the intended target architecture, including whether ATF expects a pure federated query model, a hybrid federated-plus-indexed model, or another approach, and whether centralized storage of metadata, cached results, or partial indexes is permitted.

Answer: Hybrid federated-plus-indexed model, with centralized storage of metadata, cached results, and partial indexes Please confirm whether Spartan, Nforce, Ness, and Etrace represent the complete list of required internal source systems for the base effort. For each source, please identify the system owner, hosting environment, interface method, API availability, authentication approach, estimated data volume, and expected refresh cadence.

Answer: NForce & Spartan are primary systems, but others may be required. Additional details will be provided after contract award.

Please define the required performance thresholds for the Federated Search solution, including response-time expectations, concurrent user levels, throughput, uptime/availability targets, load-test objectives, and acceptable system behavior when one or more source systems are slow or unavailable.

Answer: Vendor should provide recommendation based on the subject matter expertise, industry standards, and industry best practice The PWS requires “high accuracy results” and a “unified relevancy ranking system.” Please define how ATF intends to measure search accuracy and relevance, including any target metrics, benchmark datasets, threshold values, explainability expectations, or user-acceptance criteria.

Answer: All available information has been provided Because the PWS contemplates a firm-fixed-price task order, please provide the Government’s baseline assumptions for the initial scope at award, including anticipated team size, labor mix, sprint cadence, expected backlog volume, and the minimum capability expected in the initial release.

Answer: All available information has been provided The PWS states that the Government may reprioritize, add, remove, or alter backlog items at any time without contract modification, provided the overall level of effort and team size remain within the agreed scope. Please define the baseline level of effort, team composition, and scope boundaries that will govern that determination.

Answer: All available information has been provided Task 2 includes requirements such as photo upload/thumbnail display, image attachments in system-generated emails, robust text editing, database/schema optimization, API development, and SSIS packages for data migration. Please confirm which of these items are mandatory components of the Federated Search requirement for the base effort and which, if any, are optional, future, or residual requirements.

Answer: All components are mandatory Please define the formal acceptance criteria for software releases and operational functionality, in addition to document deliverables, including required exit criteria for functional testing, UAT, system integration testing, security testing, load testing, and Section 508 testing.

Answer: Acceptance criteria is outlined in both the SOW/PWS, and CI/CD pipeline, they both align to industry best practice.

Please specify the personnel security level required by labor category or role, clarify what work uncleared personnel may perform before adjudication, and confirm whether ATF expects the contractor to fully staff and begin performance despite the stated 60–120 day adjudication timeline.

Answer: Base security requirement is SECRTET eligibility for ALL personnel

For all data sources within the scope of the program, how does ATF envision advanced relevance and ranking logic being applied to improve discovery and context, and should multiple retrieval approaches (e.g., lexical and semantic) be combined within a single federated query experience?

Answer: This RFI is part of market research, we are open to exploring multiple options and capabilities. We envision an advanced hybrid retrieval model that combines lexical (keyword) precision with Semantic (contextual) understanding into a single Federated query experience Can ATF provide estimated data volumes (current and projected) for each internal system (e.g., SharePoint, SQL, file shares, AWS‑hosted data), expected annual data growth over the life of the contract, and an approximate breakdown of unstructured content types (e.g., PDFs, Office documents, images, other media)?

Answer: Estimated Data Volume: 1-5TB, Annual Growth: 500GB-1TB, content types: PDF, MS Office Formats, Image Files, and others What role‑based and attribute‑based access control (RBAC and ABAC) requirements are expected for the Federated Search system, and what level of granularity is required for enforcing access to records and individual data fields at query time?

Answer: This RFI is part of market research, we anticipate ABAC at this time to enable field level granularity allowing specific data fields like SSN, notes etc.. to be masked or redacted based on users’ s permissions. This enforcement must occur at query time, ensuring that sensitive information is filtered out dynamically before search results are ever displayed to the user.

To support architectural design and scalability planning, can ATF describe the anticipated user population and general expectations for search usage and performance across internal, external, and hybrid searches?

Answer: User population should not exceed 500 concurrent users

Small Business Set-Aside Classification:

The RFI references market research to identify qualified small business concerns including 8(a), SDVOSB, HUBZone, and WOSB/EDWOSB. Can the Government clarify:

0. Is a specific socio-economic set-aside anticipated for the subsequent solicitation (e.g., 8(a) sole-source, SDVOSB set-aside, total small business set-aside)?

Answer: This is RFI is for market research, this has not been defined.

0. What NAICS code and associated small business size standard does the Government anticipate using for this requirement?

Answer: This is RFI is for market research, this has not been defined.

0. Would the Government consider proposals from a small business prime contractor teaming with a COTS enterprise search technology provider (as a subcontractor/OEM) to satisfy the technical requirements?

Answer: This is RFI is for market research, this has not been defined.

COTS vs. Custom Development:

The PWS references both custom connector development and "COTS options" in the RFI Section 2. Can the Government clarify:

0. Is the Government open to a COTS-based search platform with pre-built connectors (supplemented by custom connector development for ATF-specific systems like Spartan, Nforce, Ness, and eTrace), or does the Government envision a fully custom-built solution?

Answer: This is an RFI for market research, we are open to exploring multiple options and capabilities.

0. If a COTS platform is acceptable, would the licensing costs be included in the firm-fixed-price structure or treated as a separate CLIN?

Answer: This is an RFI for market research, we are open to exploring multiple options. Licensing for the federated search should be included, for external connectors (TLO, Accurint, Clear etc..) we currently hold those licenses and will need to determine the industry standard which is part of this research.

Data Source Technical Details:

0. Can the Government provide additional detail on the APIs or data access methods currently available for the internal systems (Spartan, Nforce, Ness, eTrace) — for example, are REST APIs, JDBC/ODBC connections, or file-based exports available?

Answer: This is an RFI for market research and we can not answer this at this time.

0. For the external data sources (Accurint AVCC, Clear, TLO, i2 Analyst Notebook, Vigilant/LPR, Pennlink, Tangles, Whooster), does ATF currently hold enterprise licenses with API access provisions for each, or would the contractor need to negotiate data access independently?

Answer: This will need to be a mix of both. We currently have enterprise licensing that includes some API, as well as some does not include the API. Those specific would be provided in an RFP if this project is pursued

Existing Infrastructure and Migration:

0. The PWS notes Sematica Pro was previously used and decommissioned in 2023. Is any indexed data, configuration, or connector architecture from the prior system available for reference or migration?

Answer: No, there is not

0. Are there any existing search capabilities currently in use across ATF (e.g., SharePoint search, AWS OpenSearch/Elasticsearch) that the Federated Search solution would need to integrate with or replace?

Answer: At this time, there is nothing to be replaced or can be used for existing.

Security Authorization:

0. What is the current Authority to Operate (ATO) status expectation — will the Federated Search application operate under an existing ATF system ATO, or will the contractor need to support a new ATO package?

Answer: The contractor will need to support a new ATO package.

0. Is FedRAMP authorization required for any COTS components, or is ATF's own ATO process sufficient?

Answer: This is an RFI for market research, we are open to exploring multiple options and capabilities. FedRAMP would be preferred

Scale and User Base:

0. Approximately how many concurrent users is the system expected to support?

Answer: 5000 accounts with 500 concurrent users

0. What is the estimated volume of records/documents across the internal systems to be indexed?

Answer: The following numbers are an approximate estimate and does not represent the actual number. Current Volume: 83 million (to include photos), Storage: all in TB, Annual Growth 20 %, Ingestion Rate: 22,234/day.

Contract Vehicle:

0. What contract vehicle does the Government anticipate using for the task order (e.g., GSA MAS, CIO-SP3/SP4, Alliant 2 SB, OASIS+ SB, or an ATF-specific BPA)?

Answer: This is RFI is for market research, this has not been defined.

0. Is the anticipated period of performance still base + 4 option years as described in the PWS?

Answer: Yes

User Scale: Could the Government provide an estimated number of users and anticipated concurrent users for the federated search capability?

Answer: 5000 accounts with 500 concurrent users Data Volume: Is there an approximate estimate of the current data volume across the systems expected to participate in the federated search solution, as well as anticipated growth over time?

Answer: The following numbers are an approximate estimate and does not represent the actual number. Current Volume: 83 million (to include photos), Storage: all in TB, Annual Growth 20 %, Ingestion Rate: 22,234/day.

Search Architecture: While the RFI references a “search-time aggregation” approach, does ATF anticipate a strictly federated query model, or would a hybrid architecture that includes selective indexing of metadata or content also be considered?

Answer: hybrid architecture Performance Expectations: Are there defined performance objectives for search response times or system throughput when querying multiple internal and external data sources?

Answer: All available information has been provided Advanced Capabilities: Beyond core search functionality, is ATF interested in additional analytical capabilities such as entity resolution, relationship discovery, or AI-assisted search to support investigative workflows?

Answer: All available information has been provided Cloud Infrastructure: Should vendors assume the federated search capability will be deployed entirely within ATF’s existing GovCloud environment with infrastructure costs (compute, storage, networking) provided by the Government, or should vendors include estimated cloud infrastructure costs in their response?

Answer:No