Questions_and_Answers.docx

Questions and Answers

CC17HQQ0082

#1

Reference: RFQ PART II, 10.0 Information Security and Privacy Requirements, 7. Security Controls, FISMA Compliance, (b), Software Design and Implementation, page 20.

Question: Can OCC please clarify whether the sub‐bullets refer to Contractor‐ developed policies or OCC‐developed policies? (Would the documents be provided from the Contractor to OCC after award, or from OCC to the Contractor?)

Answer: The policies cited in the bullets are OCC policies, which shall be made available to the Contractor after award

#2

Reference: RFQ PART II, 10.0 Information Security and Privacy Requirements, 7. Security Controls, FISMA Compliance, (b), Software Design and Implementation, page 20.

Question: If the sub‐bullets refer to policies to be provided by OCC to the Contractor, can OCC please provide the OCC policies, standards, and procedures documents for vendor review prior to proposal submission?

Answer: OCC policies, standards, and procedures documents are considered restricted and are not shared with Contractors prior to award. Our security artifacts adhere very closely with NIST guidance, so broadly speaking, an understanding of the required controls for a Moderate baseline would give the contractor a sense for what requirements must be addressed.

#3

Reference: RFQ PART II, 10.0 Information Security and Privacy Requirements, 7. Security Controls, FISMA Compliance, (b), Service/Solution‐Specific Security Artifacts, page 20.

Question: If the vendor has an SSP as well as the security artifacts listed in the sub‐bullets already in place for another federal examination program, will those be sufficient given that the solution (technology, services, etc.) for both programs will be the same, or do we have to create a new documentation set?

Answer: It depends on the level of detail documented with the SSP and the degree to which the OCC solution differs or has unique responsibilities that are not covered by the general SSP. Depending on the existing documentation, it may be possible to capture the OCC specific information in an Appendix to the original SSP. The OCC would be willing to work with the Contractor on how best to capture documentation of security controls relevant to the OCC solution

#4

Reference: RFQ PART II, 10.0 Information Security and Privacy Requirements, 8. Compliance with IT Security Policies, (a), page 23.

“Information systems and system services provided to OCC by the Contractor must comply with current OCC IT Security Control Standards, privacy policies and other related guidance.”

Question: May OCC please provide any information or documentation that is not already provided in the RFQ regarding policies and guidance in the above mentioned requirement, for vendor review prior to proposal submission?

Answer: OCC security information or documentation are considered restricted and are not shared with Contractors prior to award. Our security artifacts adhere very closely with NIST guidance, so broadly speaking, an understanding of the required controls for a Moderate baseline would give the contractor a sense for what requirements must be addressed.

#5

Reference: RFQ PART II, 4.3 Data Maintenance Services, page 12.

Question: Are the Data Maintenance services discussed in this section referring to test publishing (creating an exam file and making it available for scheduling and delivery)?

Answer: Yes.

#6

Reference: RFQ PART II, 3.0 Uniform Commission Examination Test, page 5, and 4.1 Data Automation and Programming Services, page 6.

On page 5, Approximate Number of Questions in the Pool states that “contractor will randomly select a certain quantity of these questions” and Number of Knowledge Domains in Each Pool states “A specific number of questions from each knowledge domain shall be randomly selected for the test.”

Page 6 states “The contractor shall provide all data automation, programming and related services necessary to electronically administer randomly‐selected, multiple choice examinations to OCC UCE candidates…”

Question: Where the above requirements mention random selection of questions, is the OCC referencing linear‐on‐the‐fly (LOFT) testing?

Answer: No.

#7

Question: The in‐depth documentation that OCC has provided on their program requirements is very helpful. However, we are finding areas that we may be able to provide more efficient and cost effective alternatives to some of these requirements. Unlike other RFQs we respond to, the OCC is not asking the contractor to provide an SOW outlining how we will meet the program requirements or to outline possible efficiencies and cost savings. Would the OCC allow contractors to provide this additional documentation as a supplemental SOW?

Answer: No.

#8

Question: Would the OCC consider extending the RFQ deadline to 10 days after providing responses to the contractor Q&A?

Answer: The OCC will not be extending the RFQ. There are more than 10 calendar days between the posting of the Q&A and the response date.