Attachment 3 VCS Replacement RFI Questions for Industry.pdf

Modernization of Veterans Canteen Service IT Systems RFI Questions

Recommended Solution:

Please provide a detailed explanation of how your proposed solution will:

1. Improve Performance: Describe how the proposed solution enhances overall performance, including system speed, reliability, and scalability compared to our current solution.

2. Streamline Processes: Outline how the proposed solution will optimize and automate our existing processes, leading to increased operational efficiency and reduced manual effort.

3. Enhance Customer Service: Explain how the proposed solution improves the customer experience, including features that facilitate better customer interactions, faster service, and higher satisfaction levels.

4. Improve Functionality: Detail any new or improved functionalities the proposed solution offers, and how these will benefit our operations.

5. Ease of Use: Highlight how the proposed solution is designed to be user-friendly for both staff and customers, including any intuitive interfaces or simplified workflows.

6. Cost Effective: Describe how the proposed solution will improve cost efficiencies and reduce overhead costs for the VA.

Technical Questions:

1. Security Measures:

Describe the security measures your proposed solution employs to ensure the security of sensitive data, such as personally identifiable information (PII) and financial information.

Specifically, address the following:

a. How does your solution comply with industry best practices such as the National Institute of Standards and Technology (NIST) cybersecurity framework and any other relevant standards?

b. Explain the measures taken to secure data in use, in transit, and at rest.

c. Describe the access control mechanisms in place, including multi-factor authentication and role-based access control.

d. Provide information on any third-party security audits or certifications your solution has undergone.

e. Explain your practices around regular security updates and patch management to address emerging threats and vulnerabilities.

f. Are steps being taken to prepare for post-quantum cryptography threats?

g. Describe your approach to ensuring the security of your point-of-sale (POS) solution specifically, including compliance with PCI DSS (Payment Card Industry Data Security Standard).

Note: Many VA IT security requirements, including compliance with FedRAMP, are not anticipated to be applicable for the systems proposed by vendors for this project. Consequently, vendors do not need to incorporate these specific security requirements in their RFI responses.

2. Section 508 Compliance: Is your solution compliant with Section 508 of the Rehabilitation Act of 1973 and all its amendments? https://www.section508.gov/manage/laws-and-policies/ https://www.section508.gov/manage/laws-and-policies/

3. Data Integrity and Availability: How do you ensure data integrity and availability in the event of a system failure or other disaster?

4. Data Migration: Do you foresee any technical issues with migrating existing data from the current legacy Oracle Financial and Retail solution to your solution? (See attachment # for details on current VCS systems)

Non-Technical Questions:

1. Pilot Preparation: How many months do you estimate it will take to prepare the new solution for the pilot phases at a minimum of two locations that include PatriotStore (retail), PatriotCafé (food), and PatriotBrew (Coffee) locations?

2. Nationwide Rollout: How many months do you estimate the nationwide rollout to approximately 220 VCS locations will take for your proposed solution?

3. Cost Model Description:

Provide a description of your cost model. Specifically, address the following:

a. What is the pricing structure for your solution? Include details on whether it is based on the number of users, transactions, or any other metric.

b. What are your software licensing options, if any?

c. What are the subscription options available, and what do they include?

d. Detail any additional costs for annual maintenance services, including what is covered under these services (e.g., software updates, support, etc.).

e. Are there any one-time setup fees or implementation costs?

f. Explain any costs associated with additional features or modules that may be required to fully utilize the solution.

g. Describe any costs related to training and support services, including whether these are included in the initial purchase or charged separately.

h. Provide detailed information on the cost-effectiveness of your solution, including initial setup, ongoing operational costs, and potential savings compared to traditional systems.

i. Are there any other costs not covered above that are required as part of your solution?

4. ROM Estimate: Can you provide a ROM for your cost model?

Daniel, Justin specify what activities are included in "preparing the new solution for the pilot phases." Clarify whether this includes just technical setup, user training, or preliminary testing

Daniel, Justin clarify whether the timeline for the nationwide rollout is expected to include any buffer time for unexpected delays, pilot evaluation feedback integration, site readiness, or user training at each location