Attachment_5_-_Questions_Received_in_Response_to_RFP.pdf

ATTACHMENT #5

Questions Received in Response to RFP – CFP-14-R-00003

Note: Page numbers in these responses reference the page numbers as labeled at the bottom of each page of the RFP in CFP-14-R-00003 Amendment 0002. Please note that the RFP document is preceded by the two page SF-30 cover page document. The page numbers of the .pdf therefore do not exactly match the page numbers as labeled in the RFP.

ID/IQs, Components, and Task Orders

1. Per the RFP, Section 5, Contract Type, it states that all task orders issued will be Firm-

Fixed-Price (FFP) yet Task 0001 is contemplated to be Labor Hour (LB). Please clarify whether Task Order 0001 is contemplated to be FFP or LH. If the latter, would CFPB consider a Time & Materials contract type (T&M) so that other direct costs can be separately identified and invoiced for reimbursement?

Answer: This was an editing error. Task Orders may be issued on a Firm-Fixed Price, Fixed

Labor Rate, Labor Hours, or Time and Materials basis, or a hybrid or combination of these options, as determined by the CFPB and specified at issuance of each future task order. The RFP has been amended to reflect this change. Two task orders have been issued with the solicitation.

As stated in Task Order 0001, it is issued and must be proposed as a Labor Hours task order, utilizing a vendor’s fully-burdened labor rates; note that, additionally, it does provide for payment of direct costs with respect to “participant payouts.” The agency has determined that this is the appropriate payment scheme for Task Order 0001. Task Order 0002 is issued and must be proposed as a Firm-Fixed Price task order.

2. Rates will vary if an experiment/Task incorporates; eye-tracking equipment (can only process 6 participants maximum at one time) or large computer lab that accommodates

50 participants at one time. How is this rate variation handled for future Tasks?

Answer: For future Task Orders to be issued under either Component A or B, as applicable, the

Task Order pricing structure will be determined by the Contracting Officer, who will issue a

Request for Task Order Proposals to existing IDIQ contract holders. Note that in exceptional circumstances, CFPB reserves the right to make award to a Contractor in accordance with

Section I, Paragraph 6.0(C). See responses to Questions 1 and 3 for further information. While determination of payment type for individual task orders is based upon the discretion of the

Contracting Officer and requirements of the Federal Acquisition Regulation (FAR), the following is noted: In general, when a Task Order is well-defined, with “standard” requirements, a Firm-Fixed Price pricing structure may be called for. When “non-standard” materials or other hard-to-quantify direct costs are contemplated in a specific Task Order, and assuming other FAR requirements are met, a Time & Materials pricing structure may be most appropriate. These are but two of the possible pricing structures.

3. Is the RFP (deadline Oct. 31) only for the specific task orders provided in the documentation (Attachments 1 and 2)? It is unclear to us if this is part of a broader project of identifying contractors who are then asked to work on specific task orders or if there will be a new RFP for each and every task order. Further, how would the process of arriving at an acceptable price be arrived at in relation to task orders for component B since different projects might have very different levels of required labor etc.? Further clarification about the process of identify contractors and then responding to task orders would be greatly appreciated. For example, does the Oct. 31 deadline also require us to provide a proposal related to the component B task order (attachment 2)?

Answer: Vendors interested in Component A, Component B, or Components A and B of the solicitation must fully respond to all relevant provisions of this RFP. Please refer to the RFP for specific requirements of Component A and/or Component B. CFPB intends to award Indefinite

Delivery, Indefinite Quantity (ID/IQ) contracts for Component A and for Component B. IDIQ contracts are so named because they are for an indefinite quantity of services over a fixed period of time. For all vendors that both compete, and are selected, for award of a contract covering

Component A, they will be awarded Component A IDIQ contracts; and one vendor among these will also concurrently be selected for award of Task Order 0001. For all vendors that both compete, and are selected, for award of a contract covering Component B, they will be awarded

Component B IDIQ contracts; and one vendor among these will also concurrently be selected for award of Task Order 0002. Future Task Orders will be identified as they become known, and only those vendors that have already received award of a Component A or Component B IDIQ contract, as relevant, will have a fair opportunity to be considered for award of the task order.

Because Task Order 0001 is representative of the type of work envisioned under Component A, vendors interested in providing this work or any future work under Component A must submit a proposal in response to Task Order 0001(along with the other information requested in the

Submission Instructions; see pages 2826-297 of the RFP). Similarly, because Task Order 0002 is representative of the type of work envisioned under this work or any future work under

Component B, vendors interested in Component B must submit a proposal in response to Task

Order 0002 (along with the other information requested in the Submission Instructions; see pages

297-3129 of the RFP). Note that the deadline of Oct. 31 has since amended to Nov. 21.

4. Will you be open to any negotiations on the contract?

Answer: No.

5. What if we can’t perform Task Order 0001, Task Order 0002, or any future task order for logistical reasons? If we cannot perform Task Order 0001 and/or Task Order 0002, would our organization still be eligible for award?

Answer: You must submit a Task Order 0001 proposal to be considered for award of an

IDIQ contract under Component A. Assuming that more than one vendor is awarded an

IDIQ contract (Component A), based upon the criteria stated in the solicitation for award of the task order, one among the IDIQ contractors will be selected for award and performance of Task Order 0001. You must submit a Task Order 0002 proposal to be considered for award of an IDIQ contract under Component B. Assuming that more than one vendor is awarded an IDIQ contract (Component B), based upon the criteria stated in the solicitation for award of the task order, one among the IDIQ contractors will be selected for award and performance of Task Order 0002. Vendors that have received award of a Component A or Component B IDIQ contract are not required to submit bids in response to future Request for Task Order Proposals issued under those components.

See, also, the amended RFP at Section I, Paragraph 4.0, Task Order Type and Multiple

Award Ordering Procedures, for clarification as to the selection process for task order awards under Components A or B.

6. How frequently to you anticipate releasing task orders? Can we be approved for the contract but not for Task Order 0002? What is our status then?

Answer: Task Orders will be issued as they become known and sufficiently defined. CFPB expects a robust program and could envision 4-8 experiments per year across both Components.

However, at this time, we cannot predict with certainty the number of Task Orders that will be released under either component, or when (See page 8 of the RFP). Regarding your other questions, please see Question 5, above.

7. What kind of role do you have in mind for the contract manager: academic personnel/researchers? Or would this be my university's contract officer?

Answer: Please see the requirements set forth for the Contract Manager in Section I, Paragraph

10.0 in the RFP. The specific title of the Contract Manager is not important to the CFPB, provided the Contract Manager meets the requirements and performs the duties outlined in

Paragraph 10.0.3 on page 14-152 of the RFP.

8. How much time would the contract manager and technical support person spend on

CFPB work?

Answer: The agency will order work through the issuance of task orders. The amount of time to be spent by contractor personnel will likely be driven by whether the contractor has been awarded a task order; and, if so, the nature of the agency’s requirement and the selector’s approach to accomplishment of the particular work. In an ID/IQ Contract environment, depending upon whether the contractor is performing a task order and the nature of the task order, there may be some variation in the time demands placed on a Contractor’s personnel.

CFPB has estimated technical support labor hours for Task Order 0001 in the Request for Task

Order 0001 Proposal (see page 106-1074 of the RFP).

9. Will you pay indirect costs charged by the university?

Answer: Please see Question 1, above. Task Order 0001 is issued and must be proposed as a

Labor Hours task order, utilizing a vendor’s fully-burdened labor rates, although the agency pricing scheme also authorizes direct payments for “participant payouts.” “Fully-burdened” means that, subject to FAR requirements, vendors may include whatever factors they see fit in their cost estimates, including indirect costs and direct costs (not otherwise being paid.) Task

Order 0002 is issued and must be proposed as a Firm-Fixed Price task order. Vendors are therefore free to include whatever costs they see fit in their proposed price, including indirect and direct costs. As an overriding principle, the agency may only pay costs that it has determined are fair and reasonable. See the solicitation for additional details with respect to cost proposals.

10. How much usage do you anticipate (e.g. number of studies, lab time, number of subjects)?

Answer: CFPB has estimated lab usage for Task Order 0001 in the Request for Task Order

0001 Proposal (see page 1074 of the RFP). Additional usage estimates are currently unknown.

When they do become known, the agency will start the process of selecting a vendor to perform the requirement by issuing a Request for Task Order Proposals or following the additional task order selection procedures authorized within the solicitation.

11. Where do we indicate the indirect costs to be included as part of the budget?

Answer: Please see Questions 1 and 9, above.

12. Is it possible to budget for any costs beyond personnel (technical support and privacy support) and participant costs?

Answer: Yes. We believe this Question is in response to the Task Order 0001 Price Model. If your organization has other Labor Categories required for performance of Task Order 0001, those fully-burdened labor rates may be proposed (see “[add rows as necessary]” note in the

Task Order 0001 Price Model).

13. What lead time will be provided by CFPB between award and execution of Task?

Answer: CFPB plans to award Task Orders 0001 and 0002 concurrently with the award of the base ID/IQ Contract(s). The execution of Task Orders 0001 and 0002 is set forth in the

Deliverables schedule for each respective Task Order. Please see the RFP, Attachment 1 (page

1053) and Attachment 2 (page 112-1130). With respect to the lead time between award and execution of future task orders, we expect the timing of Task Orders 0001 and 0002 to be reasonable approximations.

14. In talking to our representatives, the norm is to offer an Hourly or Daily rate that covers facilities, staff, etc. Can we use that approach for this proposal?

Answer: Your proposed price build-up must comply with the Price Model(s) set forth in the

RFP. See page 106-1074 for the price build-up for Task Order 0001.

15. Would the CFPB be willing to consider a virtual lab for some task orders under

Component A and/or Component B? The virtual lab would be an online platform that could run economic experiments. The virtual lab would have nearly all of the same capabilities as a physical lab including recruitment options, variable payments, coordinated and interactive environments, and communication between subjects. There would be no ability to visually monitor a person, although it would be possible to track their mouse movements, key strokes, actions, and time spent on each page. It would sample experimental participants from a large, well-maintained, and nationally-representative subject pool.

Answer: Please see Section 4.0 on page 9 of the RFP for general guidelines. As specified, the guidelines help identify what CFPB is looking for in terms of the norms and capabilities of a modern economic laboratory; these guidelines are explicitly not prerequisites for submission, nor necessarily exhaustive. Whatever their proposal, Offerors should be cognizant of the RFP’s cyber security requirements (See pages 88-941 and 997-1020). Additionally, as stated in the solicitation, Offeror proposals must adequately address the relevant evaluation factors/criteria and be responsive to the submission instructions.

16. How many estimated days over the year would the CFPB need access to the laboratory facilities?

Answer: See Question 10, above.

17. Typically, how much time would there be between the issuance of the Request for Task

Order Proposals (RTOP) and the need to use the facilities?

Answer: See question 10, above.

18. We cannot allow access to our student subject pool for reasons of policy and principal, but we would be willing to develop a for-pay pool that we would administer, would this be of interest?

Answer: Yes, see Section 4.0 on pages 10-12 and 11 of the RFP for General guidelines regarding subject pools.

19. What exactly is involved in submitting a proposal (e.g., will we need to get university approvals, budgets, etc.)?

Answer: Please see the Submission Instructions in Section II of the RFP. Note that your

Proposal must be submitted and signed by an authorized representative of your organization. It is the Offeror’s responsibility to make the determination of who is an authorized representative of your organization.

20. To How Many Universities will these contracts be awarded?

Answer: CFPB intends to make more than one ID/IQ contract award for Component A as a result of this RFP, but reserves the right to make one, or no, contract award. Task Order 0001 will be awarded to at most one Contractor. CFPB intends to make more than one ID/IQ award for Component B as a result of this RFP, but reserves the right to make one, or no, award. Task

Order 0002 will be awarded to at most one Contractor.

21. Can CFPB provide a template completed proposal...or a simplified checklist for the original submission due on 10/31/14?

Answer: No. Please see Section II, Non-Price Submission Instructions for proposal submission requirements.

22. Is the “total contract value” equal to the sum of all payments for RTOP experiments that are delivered by the Contractor?

Answer: The “maximum contract value” is the not-to-exceed value for the life cycle of this requirement, including the exercise of any/all option periods. This is not a “guaranteed” amount that will be obligated under the Contract(s) nor is it an expected value – it is a “ceiling value.”

23. What labor categories are expected (or required) beyond those identified as Key

Personnel in the RFP?

Answer: CFPB is requesting that Offerors submit a Price Proposal for each respective Task Order of interest to the Offeror. Additionally, as seen in the amended RFP, CFPB is requesting that Offerors submit a Labor Rates Table of Labor Categories and Labor Rates to be used for the term of the contract, even if such labor categories will not be required for the performance of Task Order(s) 0001 or 0002. This Labor Rates Table will be utilized throughout the term of the contract, including any exercised option periods. The Labor Rates Table will be evaluated for price reasonableness by the Contracting Officer.

We understand that, in performance of a future Task Order, certain labor categories not envisioned at this time may be required. This is arguably more likely under Component B.

However, CFPB is requiring all Offerors to include a good faith Labor Rates Table as part of their proposal, identifying any and all labor rates that the Offeror would currently expect to use under each respective Component (noting that there may be more labor categories expected for future use under Components A and B than may be required for performance of Task Orders 0001 and 0002, respectively).

Data Rights

24. Will any data from the CFPB (e.g., data from consumers, data from employees) be made accessible through either Component A or B of this initiative?

Answer: The CFPB generally intends to make data collected under this RFP, except for personally identifiable, confidential or proprietary information, available to the public.

However, CFPB cannot commit to a timeline for public release at this time; as specified under the data rights provisions, IDIQ contract holders may also submit a request for release of the information. CFPB data unrelated to this RFP will not be made available to IDIQ Contract holders. The identities of Contractors receiving award will be shared publicly, however the names of the individuals working on the contracts will not be if the awardee provides a redacted copy of their contract after award, removing this information.

25. Participation in these projects appears to require the signing of a Non-Disclosure agreement (Attachment 3). Does the CFPB anticipate that the research conducted in

Component B will at some time be suitable for publication in refereed academic journals?

Is there anything in this RFP that would specifically limit the ability of the PI to publish the research using only the data generated in the laboratory (as opposed to data provided by the CFPB)?

Answer: Yes, the CFPB anticipates that research conducted under both components A & B will be published in refereed academic journals.

For information about Contractors’ data rights, see the “RIGHTS IN DATA” subsection on page

753 of the RFP. In particular, see “G. 2. ADDENDUM to 52.227-14 (MAY 2014): Contracting

Officer Approval Process Required for Release, Publication and Use of Data” on page 820 of the

RFP. Contractors may publish, without assertion to copyright, data that has been publicly released by the CFPB. For all data other than the data publicly released by the CFPB (including before and after final delivery and acceptance of deliverables), the Contractor is required to request express written permission from the Contracting Officer to use, release to others, reproduce, distribute or publish such data. We anticipate that such requests will be made, and we will handle each one on a case-by-case basis.

26. My main concern is to publish results. I'm nervous that the contract effectively makes it so that I am performing a service but cannot use the results. I notice that under the contract I wouldn't be able to publish unless a) the data is already publicly released by CFPB or b) if not publicly released, I get written permission.

It says that the decision will be based on timing or disclosure protection concerns. What does this mean? Under what conditions do you plan to publicly release the data and what is the timeline for this? Most journals have data availability policies that require the data to be public. I want to know that I will be able to publish the research. Will CFPB personnel be considered co-authors? Is that a requirement? Is that an option? What kind of conditions and restrictions are there on contract personnel collaborating with CFPB personnel outside of the contract, before, during or after the contract period?

Answer: It is CFPB’s interpretation that this question is in regard to Component B. See

Question 24, above, for details regarding Contractors’ data rights under this RFP.

Please see each task order for the nature of the services for which the contractor has been hired to perform, and for which the contractor will be paid. With respect to Task Orders 0001 and 0002, the agency’s needs for assistance do not include data analysis or synthesis of results, and this is reflected in the task orders’ work requirements. In future task orders, the agency may additionally have a need for a contractor to conduct data analysis or to synthesize results and this will be reflected in the specific task order. The contract Statement of Work has been modified to reflect the fact that this type of work will be contemplated under the IDIQ Contract. Whatever role the contractor plays with respect to research, conducted at least in part pursuant to a task order, the agency anticipates some collaboration among researchers. CFPB intends to attribute contributions made by the Contractor to the Contractor, including authorship or co-authorship.

Note that responding to this RFP or obtaining an award as a result of this RFP will not preclude

Offerors or Contractors from collaborating with CFPB personnel outside of this requirement.

27. Per the RFP Section G.2 Addendum to 52.227-14 (MAY 2014): Contracting Officer

Approval Process Required for Release, Publication and Use of Data – please clarify why

CO approval is required to make contract deliverables, contract research and results, and data publicly available that have not been publicly released by the CFPB. Is it CFPB’s intent to publish the work at the conclusion of the contract?

Answer: CFPB retains the rights to all data collected under this RFP. See Question 24, above, for information about Contractors’ data rights under this RFP. It is CFPB’s intent to publish work that is based upon data generated by Task Orders issued under this RFP. See Question 24, above, for details regarding data rights and CFPB’s intention to make data public.

28. Per the RFP Section G.2 Addendum to 52.227-14 (MAY 2014): Contracting Officer

Approval Process Required for Release, Publication and Use of Data – Will CFPB properly attribute authorship of the contract deliverables, contract research and results, and/or data to the Contractor performing the work?

Answer: The CFPB will attribute all work performed under a task order by the Contractor to the

Contractor.

29. What is the difference between a task order issued under this IDIQ and a grant?

Answer: The primary purpose of the task orders to be issued under the awarded IDIQ contracts is to advance the CFPB’s research goals, and this is a purpose served by the agency’s issuance of procurement contracts. For a very general overview of the different purposes served by procurement contracts and grants, you may wish to refer to the Federal Grant and Cooperative

Agreement Act, at 31 U.S.C. §§ 6303 and 6304.

Component A Specifics

30. For Component A, where do we indicate fees for lab time, equipment, costs associated with the use of our Lab?

Answer: See Question 12, above.

31. Is it possible that some costs associated with component A may be fixed (e.g. do not strictly depend upon the number of experimental session conducted in the lab)?

Administration of laboratory facilities can require significant fixed cost that do not vary substantial dependent upon actual usage and we are attempting to determine how to best account for these costs.

Answer: Yes. See Question 12, above.

32. The RFP mentions the need for the ability of CFPB members to communicate anonymously with experimental subjects before and after the experiment. Does the CFPB envision something more elaborate than email, chat, or possibly survey type technologies? Is verbal or visual communication required?

Answer: Section 4.0 of the RFP lists general guidelines, not pre-requisites. The word

“anonymous” was used in this case to mean that neither the researchers’ identities nor the subjects’ identities would be revealed during communication between researchers and subjects.

33. What exactly is meant by 'observation and communication facilities' in the offered lab space?

Answer: The phrase “observation and communication facilities” does not appear in the RFP.

Please see Section 4.0 of the RFP for general guidelines regarding the type of facilities CFPB is seeking.

34. What documentation is needed to prove we are within a 250 mile radius?

Answer: The street address(es) of the facility (or facilities) at which the work required under

Component A will occur.

35. Who defines the schedule for use of the Lab? Do we or is it at the convenience of CFPB employees?

Answer: CFPB will evaluate proposals for Component A based on the evaluation criteria listed on pages 220-242 of the RFP, as well as other general requirements of the solicitation. Factor 1 of these criteria is “Resources” which includes “a method by which the laboratory may be reserved” (Page 110 of the RFP). Factor 2 of these criteria is “Technical Approach to Task

Order 0001” which includes among its deliverables, a proposal that details, among other things, “CFPB access to facilities and logistical tools and the timeframe for that access.” As with all factors/deliverables, CFPB requests that vendors propose how these criteria will be met.

36. CFPB employees will have CITI Human Subject clearance (or equivalent)?

Answer: Yes they will have CITI Human Subject clearance and can provide copies of training certificates when needed for IRB approval

37. Our RA must be present during a session to handle incentive payment. Will that be a problem?

Answer: No, this is not a problem. In fact, Task Order 0001 lists subject payment as a contract deliverable (See page 1042-1053 of the RFP).

38. What is meant by providing ‘anonymous interactions between subjects and researchers before and after sessions’?

Answer: See Question 31, above.

39. For Component A, is it necessary that all associated personnel/support/resources also reside within the 250 mile proximity requirement? Or can offsite staff also provide support?

Answer: The proximity requirement for Component A only applies to the “contractor’s facilities,” not where its personnel reside.

40. Does the CFPB pay for incentive payments?

Answer: As specified in the task order price model, incentive payments are identified as a direct expense of the agency. However, the Contractor will be expected to administer payments (See

Task 3, on pages 1042-1053 of the RFP). Offerors are asked to estimate participant payouts in the Task Order 0001 Price Model. (See footnote 2 on page 1064 of the RFP for more detail; see pages 1064-1075 of the RFP for the Price Model Table).

Component B Specifics

41. From the RFP, it seems to call for setting up a research team with some sort of pricing structure to do experiments yet to be named – as the only material with respect to content

I could find is on p. 108 of the independent research group RFP. Or am I missing something? Please clarify – if this is correct or not.

Answer: A single Task Order, Task Order 0002, is being issued concurrently with the ID/IQ.

Vendors who are interested in award of the ID/IQ must respond to this Task Order (See pages

22-264 of the RFP for evaluation criteria and pages 264-3129 for submission instructions). As a point of clarity, under Component B, overall prices quoted in response to one Task Order will not be binding for subsequent Task Orders, although the labor rates proposed will be binding.

So, IDIQ contract holders submitting technical proposals in response to new task order proposal requests will additionally need to submit price proposals, which use the same labor rates provide in their original contract proposal documentation.

42. I understand that as a first experiment, you would want us to look at disclosure issues.

But it seems to me that disclosure issues is context specific – different from mortgages versus bank charges vs ….. that is, a single size clearly does not fit all. Are there any discussion papers from CFPB (or otherwise) discussing the issues say for mortgages or some other instrument you all are interested in? Without that any proposal would have to be in very general terms with details to be worked at a later point in time.

Answer: Task Order 0002 is about decision-making in the context of choices involving multiple dimensions. Please see Attachment 2, beginning on page 1086 of the RFP, for more information about Task Order 0002. Related literature, along with select citations, are provided on page 1086 of the RFP.

43. If funded, could we carry out multiple experiments with multiple researchers under

Component B?

Answer: See Question 6, above. Offerors are free to list more than one researcher in the role of

“Principal Investigator” under their Staffing and Management Plan (See page 253 of the RFP).

44. Regarding Component B, Should the proposal nonetheless describe just one experiment and if so, how do you advise choosing among the possible projects our researchers may suggest to us?

Answer: As specified in the solicitation, Offerors should submit a single experiment. CFPB cannot issue further guidance for choosing among projects beyond that already provided in

Attachment 2 (See page 1086 of the RFP) and that already provided in Task Order 0002 submission instructions (See page 298 of the RFP).

45. Regarding component B factor 4 - Past Performance: is any other previous performance considered relevant past performance if never had a government contract? To me it looks like the answer is no, but can you confirm this?

Answer: As stated in the evaluation criteria for Component B Factor 4 – Past Performance, the

Offeror may identify relevant past performance of Federal, state, local government and/or private contract it has had within the past five years to perform work the same or similar to this

Government requirement. Note that in the case of an Offeror without a record of relevant past performance or for whom information on relevant past performance is not available, the Offeror shall not be evaluated favorably or unfavorably on past performance.

46. P114, 9.0 says "The Task Order 0002 Price Volume has a page limitation of no more than five (5) pages and does not count toward the Price Volume page limitation." What does this mean? Are we supposed/allowed/expected to state a separate price for the base

ID/IQ, beyond the task order 2 price?

Answer: This was a typographical error. The Task Order 0002 Price Volume has a page limitation of five (5) pages. CFPB intended to state that the Price Volume does not count toward the page limitation of the Non-Price Volume. This has been corrected in the RFP.

47. Does the CFPB pay for incentive payments?

Answer: If by incentive payments you mean “participant payouts” (participants in the “subject pool”), then, yes, CFPB does pay for these particular incentive payments. . See Question 9, above.

IRB/PRA

48. What support or information will you need from us to obtain PRA clearance?

Answer: We anticipate that most laboratory experiments will get PRA clearance under what is called a generic clearance process, which is shorter and less involved than the normal review process. The proposed generic clearance is currently under OMB review, but we hope that OMB will approve this clearance in the upcoming weeks.

Attached is a draft PRA generic submission, similar to what contractors will assist the CFPB with completion. Most questions will need to be determined with the Contractor before data collection begins.

For example, this includes the research methodology and any incentives that may be a part of the research design. Therefore, we do not anticipate that this requirement will be a large burden on the Contractor.

49. How will IRB approval be handled? What support or information will you need from us to obtain IRB clearance?

Answer: Under Task Order 0001, Institutional Review Board (IRB) approval, if applicable, is the Contractor’s responsibility and is listed under Task 1 on page 1042. Under Task Order 0002, IRB approval is the Contractor’s responsibility if and only if it required by the Contractor’s home institution. This is listed under Task 1 on page 11008.

Security

50. Section 1.1.1. (p85) is a bit unclear. Can faculty, staff and graduate students who are not

US citizens be named as personnel, especially if the students are on student visas, not permanent residents? Does LPR mean green-card holder? A background check is mentioned for people working on-site. Does this mean at the contractor's facilities or the

CFPB HQ? Is this to be done at the contractor's expense? Do we need to pay for background checks for all named personnel?

Answer: The CFPB will assess the riskiness of each position listed in each proposed staffing and management plan. See section J.1.1 of the Request for Proposals, “Security Requirements”, for more information about the criteria used in this assessment. For this solicitation only, individuals with student visas may fill a position provided a background investigation is deemed unnecessary for that position by CFPB and provided that your institution can certify that those individuals may legally work for the Federal Government under the terms of their visa.

51. I am nervous about whether the campus security/IT clearance is doable and anticipate having to add security costs in budget. If Task 2 can be performed without collecting any personal information, do we need all the data security measures?

Answer: Data security will be necessary for this contract, though reducing the collection of direct personally identifiable information will reduce the risk of the data, and therefore, the

CFPB cybersecurity’s team review. We hope that the cybersecurity self-assessment, as well as our answer in question 51, below, will give you a sense of what the CFPB cybersecurity team’s review entails, and what kind of security issues are most important to them.

52. In the self-assessment, most of the questions refer to the handling, maintenance, development, and training concerning information systems that protect PII (Personally

Identifying Information). While we do have licenses for and use some online databases

(e.g. "Qualtrics" for survey administration, "SONA Systems" for participant pool registry, management, and study scheduling), these are third-party systems that are administrated locally, but the systems themselves are developed, maintained, etc. by the third party vendors with whom we contract but do not directly employ. To this effect, we are unsure of the scope of these questions--that is to say, we are unsure whether these questions refer only to registries developed by the institution or whether we are being asked to provide information about or from our third-party vendors? The questions in the self-assessment I am unsure of the scope include:

a. Does the service provider develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational information systems?

b. Does the service provider monitor information system security controls on an ongoing basis to ensure the continued effectiveness of the security controls?

c. Does the service provider perform periodic and timely maintenance on organizational information systems?

d. Does the service provider identify, report, and correct information and information system flaws in a timely manner?

e. Does the service provider monitor information system security alerts and advisories and take appropriate actions in response?

Answer: The scope of the cybersecurity review includes where the data that the CFPB experiment generates is held. So for example, if you use a program like "Qualtrics" for survey administration, and use that program to store experiment data, this would be in-scope for the cybersecurity review.

While the solicitation states the full range of applicable security requirements, below provides general guidance on the types of cybersecurity questions particularly relevant for this solicitation. Offerors do not need to answer these specific questions, outside of the provided self-assessment, these questions are posed solely for the Offeror to better comprehend the scope of the self-assessment. For cybersecurity reasons, we are particularly interested in:

a. What system is the participant pool data in, what system is the survey administration data in, and how, if at all, do these systems interact? We are most concerned with direct personally identifiable information (ex: name, email), and which systems hold this type of information.

b. How these systems are configured in terms of log-in and where is data stored? (Ex: Is the survey administration data stored locally or in a cloud or online website) How are these systems protected?

c. If there is a breach of data, will your organization know? What will you do once you know?

Procurement – Federal Acquisition Regulation

53. My university contract officers tell me that there are some FAR (Federal Acquisition

Regulation) commercial clauses in contract that Sponsored Projects does not normally sign/agree to. Is that a dealbreaker? Is there any room to negotiate on this? Two of the commercial FAR clauses, which we reject on research contracts and would attempt to negotiate out of the contract are 52.212-4, 52.212-1, 52.212-3, 52.212-5.

Answer: As this requirement is being solicited using “commercial item acquisition procedures,” these clauses are required and cannot be negotiated.