Attach 2. D-27-DC-91626 QA.pdf

Question Number RFP Section Paragraph (RFP) Page Number Question(s) Answer(s)

The RFI identifies 9,028 internal users and 2,603,659 external users. For ROM purposes, please provide an estimated breakdown of each population by anticipated usage: regular, supervisory, and infrequent users.

Please refer to section 3 of the RFI Supplemental Information document.

For purposes of developing a SaaS ROM, please clarify the number and types of production and non-production environments, including any sandbox environments, respondents should assume for pricing purposes.

Each environment currently has a dev, test, and production environment.

3 Section 7, Response Instructions Please confirm the RFI submission time on Tuesday, October 20, 2026 is 5pm EST.

RFI responses are due Thursday, November 5, 2026 is 6pm EST. Responses received after the deadline may not be considered.

4 Section 7, Response Instructions Please confirm that the 40 pages is inclusive of the answers to the questions outlined in Section 6.

The Government requests that industry responses be limited to 40 pages, excluding cover page, table of contents. The 40-page limit is inclusive of the respondent's substantive response, industry questions, and

Rough Order of Magnitude (ROM) estimates.

Artificial-Intelligence (AI)-Ready

Architecture

Are there any AI platforms/capabilities (i.e., AWS Bedrock, Azure Foundry, Google Gemini, etc.) that are already approved or ATO'd for development of production AI use cases?

The Government leverage native AWS and Azure AI services. These services and implementations must be compliant with Federal, DOJ, and DEA AI policies.

6 Section 4 Do external users use any other IAM solutions other than login.gov to access DEA systems? The Government does not use any other IAM solutions other than login.gov at this time.

7 Appendix A; Section 3 Can DEA provide, for each application listed in Appendix A, the technology stack, hosting environment, ATO status and authorization boundary, annual transaction volume, record counts, and interface inventory?

Technology stack, hosting environment -- Section 1 of the RFI Supplemental Information document. Annual

Transaction volume-- section 2 of the RFI Supplemental Information document. Record Counts-- section 7 of theRFI Supplemental Information document. Interface inventory-- section 9 RFI Supplemental Information document. All environments are ATO'd currently, with the exception of DC4, which has an ATP.

8 Appendix A; Section 3 Can DEA confirm which applications are currently inactive or already scheduled for retirement? Please refer to the updated list of applications.

9 Section 3 Can the Government confirm that a separate contract will be maintained for legacy O&M applications?

The Government anticipates maintaining a separate contract for ongoing O&M of the legacy applications. The legacy O&M effort is separate from the requirements described in the RFI and is not included within the scope of this effort.

Section 3 What historical data volume, quality and retention assumptions should govern migration pricing? Does DEA require full-fidelity migration of all history, or is archive-with-access acceptable for older records?

Archive-with-access may be an acceptable approach for older records, provided the records remain accessible, retrievable, and protected throughout their required retention periods, with the metadata necessary to support proper disposition preserved (36 CFR §§ 1236.14 and 1236.20). Records scheduled as permanent must remain transferable to NARA in accordance with 36 CFR Part 1235 and NARA transfer guidance.

Records that have met their retention period under an approved schedule, and that are not subject to a hold, may be disposed of before migration, which may reduce migration volume

11 Section 8 What does “Training and Documentation” in Section 8 encompass: internal DEA users only, or the external registrant population as well?

What delivery methods and volumes should be assumed?

Training and documentation requirements are anticipated for both internal DEA users and external registrants, as appropriate to the final solution and implementation approach.

For internal users, the Government anticipates training and documentation for users that interact with the system. This may include role-based training, user guides, etc.

For external users, the Government anticipates the need for appropriate user guides and self-service support to enable success. The Government seeks industry recommendations regarding the most effective methods.

12 Section 4 Given a registrant population that includes sole practitioners and small pharmacies, does DEA require multilingual support or specific plain-language standards for registrant-facing content?

This is not a requirement of the Government at this time.

13 Section 4 Which system serves as the financial system of record for reconciliation with pay.gov collections, and is integration to it within scope?

None of the applications are financial systems; we use an API to connect to pay.gov for payments. Other than the amount of the fee charged (which is set by CFR) and whether it's paid or not, we don’t retain any payment information. See section 4 of the RFI Suppplemental Information document.

Section 4; Section 6 — Questions 11 & 12;

Section 8

Will DEA accept an application deployed into a FedRAMP High authorized hosting environment, with the application authorized through a

DEA or DOJ agency ATO inheriting infrastructure controls?

All solutions must meet FedRAMP High authorization/certification at the time of award. Vendors should propose solutions that comply with NIST 800-53 and CJIS. Solutions themselves should be NIST 800-53/CJIS compliant, not just hosted on compliant platforms.

Section 4; Section 6 — Questions 11 & 12;

Section 8

Does DEA or DOJ operate an existing cloud environment and authorization boundary that the solution is expected to deploy into and inherit controls from, rather than establishing a new one? If so, please identify the environment, its authorization level, and the control inheritance available.

The Government hosts applications in AWS and Azure FedRAMP environments. Recommended solutions should expect to host within AWS.

Would DEA consider ordering a follow-on effort through the GSA Multiple Award Schedule (MAS), including the Information Technology category (e.g., SIN 54151S IT Professional Services)?

The acquisition strategy has not yet been finalized. Information received through this RFI will be considered as part of the Government's ongoing market research and acquisition planning. Respondents are encouraged to identify contract vehicles and acquisition approaches for their proposed solution.

Does DEA anticipate the follow-on being competed as full and open / unrestricted, or as a small-business set-aside? If a set-aside is contemplated, which socioeconomic category? We recommend given the scope that this is competed as full and open.

The acquisition strategy has not yet been finalized. Information received through this RFI will be considered as part of the Government's ongoing market research and acquisition planning. Respondents are encouraged to identify contract vehicles and acquisition approaches for their proposed solution.

RFI Number: D-27-DC-91626

Questions and Answers

Questions and Answers

Is there an anticipated contract type and structure (e.g., FFP, T&M, modular CLINs, enterprise license, per-registrant/per-applicant pricing) that DEA is leaning toward under the outcomes-based contracting (OBC) framework?

The Government has not finalized its acquisition strategy. Information obtained through this RFI will assist DEA in determining the appropriate acquisition approach, contract structure, period of performance, and other applicable requirements. Respondents are encouraged to provide recommendations based on their experience and proposed capabilities.

What is DEA's anticipated period of performance and preferred phasing (e.g., pilot/MVP followed by enterprise rollout), and is there a target date for initial operating capability

The Government anticipates a multi-year POP to support the implementation, deployment and sustainment of the solution.

The Government has not established a preferred phasing or implementation approach at this stage. The

Government is seeking industry input on the most effective approach for implementing the solution , including whether a pilot/minimum viable product, phased deployment, or enterprise wide implementation is appropriate.

Of the applications in the DC Applications Appendix (RICS suite, ARCOS, CTRANS, CSOS, DC3, etc.), which are highest priority for early modernization, and are any explicitly out of scope or slated for retirement rather than migration?

Please refer to the updated Appendix A.

Does DEA envision a single integrated platform replacing the RICS suite, or a phased consolidation where certain systems remain and are integrated?

The Government envisions an integrated platform replacing the applications indicated in Appendix A, with a phased conosolidation to manage the process.

Should vendors assume the existing Salesforce-based contact center (DC3) and the AWS Bedrock-powered chatbot (DC4) are retained and extended, or are they candidates for replacement under the new platform?

The Government plans to retain and expand DC4. The Government plans to retain DC3. Both applications are part of the transformation effort.

For the approximately 8 TB of historical data across the largest tables, does DEA expect full migration into the new solution, selective migration with archival of the remainder, or read-only access to legacy stores during transition?

Historical federal records must be maintained in accordance with applicable NARA-approved records disposition schedules and any applicable legal holds or preservation requirements.

Prior to decommissioning legacy systems, record requiring continued retention must be preserved or migrated in accordance with 36 CFR § 1236.14. Please see the updated applications appendix.

24 Section 4

Section 4 (Technical and Regulatory Standards) identifies FedRAMP High as a baseline requirement. Will DEA consider a COTS platform deployed and operated within a FedRAMP High-authorized government cloud environment (e.g., AWS GovCloud or Azure Government), whether DEA-managed or contractor-managed, and authorized under a DEA/DOJ ATO, as satisfying this requirement? Or must the proposed product itself hold an independent FedRAMP High authorization as a SaaS offering?

Proposed solutions must, themselves, be FedRAMP High authorized/certified. Applications leveraging a

FedRAMP High platform will not be considered.

#7. Response Instructions p 12-13, "with font size no less than 12-point" Can a respondent use 10 point font on tables and graphics, such as the requested NAICS codes and proposed SLAs? Yes, the Government permits 10-point font on tables, graphs, and charts, when necessary.

#7. Response Instructions p 12-13. "Include the following... FedRAMP #"

Is the government looking for the FedRAMP identifier for a proposed cloud service/platform or a FedRAMP identifier for the IT Services corporation?

The Government is requesting vendors provide the FedRAMP authorization/certification number for proposed cloud solutions.

#1. Overview p 1 and #4. Core Functional

Requirements p 4-9

Section 1 describes industry feedback on a single sign-on (SSO) solution while Sections 4 and 5 describe enterprise modernization of RICS and the related Diversion Control systems. Please confirm the intended scope of the anticipated acquisition.

SSO is part of the modernization.

#4. Technical and Regulatory Standards p

8, "FedRAMP High (baseline requirement)" and #6. Industry Questions 11.c p 12

Will DEA accept a hybrid architecture in which the solution is deployed within a DEA-owned AWS GovCloud account under DEA's ATO, with

FedRAMP High inherited from the IaaS provider, or does DEA require the application itself to hold a FedRAMP High authorization?

Proposed solutions must, themselves, be FedRAMP High authorized/certified. Applications leveraging a

FedRAMP High platform will not be considered.

Yes, the government will consider hybrid solutions; however, solutions must be COTS.

#3. Current Systems and Integration

Environment p 4, "DC3 is a Salesforce-based..." and Appendix A p 18, DC4

What is DEA's intended disposition of the existing Salesforce-based DC3 contact center and the AWS Bedrock-based DC4 chatbot? Should respondents assume these are retained and integrated, or replaced?

Both DC3 and DC4 software will be retained and integrated.

#8. Rough Order of Magnitude (ROM)

Request p 13-14

For the ROM, should respondents assume DEA-owned cloud accounts or vendor-hosted SaaS, and what period of performance (base and option years) should the ROM reflect? Should costs be presented as annual averages or totals?

Requirements have not been finalized regarding whether the solution will be hosted on DEA-owned cloud accounts or whether on vendor-hosted SaaS platforms. Respondents are encouraged to provide recommendations based on their experience and proposed capabilities.

For market research purposes only, respondents should provide ROM estimates based on a 12/month base period and (4) 12/month option periods. Respondents should identify one-time implementation costs and recurring annual costs separately. Respondents should clearly identify their pricing assumptions, and any recommended optional capabilities. The Government has not established a final contract duration or structure and this structure is solely established to provide a common basis for ROM estimates.

#8. ROM Request p 14, "Reference materials and counts" (9,028 internal /

2,603,659 external; 8 TB)

Of the 2,603,659 external user accounts, approximately how many are unique active registrants? Can DEA provide a breakdown of the 8+ TB by source system and format, and an inventory of current internal and external interfaces (DOJ, CBP ACE, state licensing sources, Pay.gov, others)?

Please refer to user account information in section 3 of the RFI Supplemental Information document.

Information about Diversion application size is in section 6 of the RFI Supplemental Information document.

Information about interconnections is in section 9 of the RFI Supplemental Information document.

Questions and Answers

#5. System Goals and Objectives p 9-10 and

#6. Industry Questions 10 p 12

Is DEA open to a phased, modular award structure, and would a data model unification and integration foundation phase (canonical registrant record, master data management, interface fabric) preceding application migration be considered in scope?

The Government has not finalized its acquisition strategy. Information obtained through this RFI will assist DEA in determining the appropriate acquisition approach, contract structure, period of performance, and other applicable requirements. Respondents are encouraged to provide recommendations based on their experience and proposed capabilities.

33 #7. Response Instructions p 12-13 Does DEA plan to hold one-on-one vendor sessions or a virtual industry day prior to release of a solicitation?

The Government may elect to request vendor demonstrations after the response deadline. If demonstrations are requested, they will be conducted for informational and market research purposes and will not constitute a formal evaluation or source selection activity.

#3. Current Systems and Integration

Environment p 4, "CSOS"

Does DEA intend to retain CSOS as a PKI-based digital ordering system in its current form, and are the CSOS certificate authority and subscriber enrollment functions in scope for modernization?

CSOS will be retained as a PKI based certificate creation and distribution platform. It will be part of the transformation effort.

#1. Overview p 1 (SSO) and Appendix A p

18, "Online MFA"

Which external identity solution does DEA intend for registrant authentication (login.gov, the existing Online MFA capability, or other), and is consolidation of the existing per-application registrant logins into a single registrant identity a required outcome?

The Government anticipates that vendors propose solutions for authentication and registrant identitiy consolidation.

#3. Current Systems and Integration

Environment p 3, "ARCOS" and Appendix A p 18, EDI applications

What are the current annual transaction volumes for ARCOS, NARCOS, and the EDI upload channels, and does DEA require continued support for the existing EDI file formats during and after transition?

O&M during transformation will be considered under a separate contract. ARCOS (which encompasses EDI) receives around 7 M transactions per month.

#4. Public-Facing, Print, and Geospatial

Support p 7

Should respondents assume DCGIS, Print-On-Demand (POD), and IVR are replaced within the modernized platform, integrated as retained systems, or excluded from scope?

DCGIS, POD, and IVR should be considered within the transformation-- though, at this point the IVR has migrated to AWS Connect.

#4. Core Functional Requirements p 8, "DEA and Department of Justice (DOJ) approval processes"

Are the DEA and DOJ AI review and approval processes documented, and can DEA share the approval criteria or expected timeline so respondents can reflect them in the implementation schedule and AI-related ROM?

The Government will not share existing documentation. Timelines and approvals are dependent upon the use of

AI and its outputs. Use Cases which may be categorized as High Impact AI may take longer for approval.

#6. Industry Questions 10 p 12, "acquisition and licensing structures" What is the anticipated award timeframe and preferred contract vehicle (GSA MAS, DOJ BPA, open market, other)?

The Government is currently developing its acquisition strategy and schedule. The anticipated contract award timeframe has not yet been finalized. Information received through this RFI will be considered as part of the

Government's ongoing market research and acquisition planning. Respondents are encouraged to identify contract vehicles and acquisition approaches for their proposed solution.

40 Appendix A: Application Descriptions p 18 Several applications in Appendix A are marked sunset, no longer used, or inactive. Can DEA confirm which applications are excluded from migration scope so respondents can reflect this in the ROM?

Please refer to the updated list of applications.

#5. System Goals and Objectives p 9-10, "migration from RICS"

Does DEA expect the contractor to assume operations and maintenance of legacy systems during the transition period, and if so, for how long?

The Government anticipates maintaining a separate contract for ongoing O&M of the legacy applications. The legacy O&M effort is separate from the requirements described in the RFI and is not included within the scope of this effort.

#4. Outcomes-Based Contracting and

Performance Alignment p 9

Does DEA have baseline measurements today (registration processing time, backlog, contact center handling, data quality rates) that respondents should use as the starting point for proposed performance thresholds?

Please refer to performance baselines, including contact center handling expecatations, in section 12 of the RFI

Supplemental Information document.

43 Modernization scope RFI 3 - 4; Appendix A

Can DEA identify which applications and capabilities must be replaced, retained and integrated, or retired? Can we get clarification whether

ARCOS, CTRANS, DC3/DC4, and CSOS are modernization targets or integration endpoints, and whether inactive, duplicate, and deprecated appendix entries should be excluded.

Please refer to the updated list of applications.

44 Unique users and licensing - RFI 8

The provided user totals represent accounts across applications rather than unique users. Are there estimated unique internal and external users, monthly active external users, peak concurrent users, and internal users by role? How should organization accounts with multiple delegated users be counted?

Please refer to section 3 of the RFI Supplmental Information document.

45 Migration scope and data quality - RFI 4, 8

Can DEA map the 8+ tb of reported storage to the source applications and identify whether this includes documents, scanned images, attachments, audit history, and archives? What historical data must remain operationally accessible versus archived, and what known data-quality or duplicate-record issues should be included in migration estimates?

Please refer to section 6 of the RFI Supplemental Information document.

Integration complexity and access - RFI 3 -

Can DEA provide an interface inventory identifying required integrations, available APIs or file exchanges, exchange frequency, transaction volumes, and interface documentation? Which integrations require new development, and will DEA provide access to test environments and coordinate participation by external system owners?

Please refer to section 9 of the RFI Supplemental Information document for information about interfaces.

Hosting and authorization responsibilities -

RFI 4, 6, 8

What assessment, authorization, continuous-monitoring, and agency-specific security activities must the contractor price, and how many production, nonproduction, and disaster-recovery environments should be assumed?

All solutions will undergo a security assessment and review to assure compliance with NIST, DEA, and DOJ security requriements, and obtain an authorization to operate. Depending on the proposed solution, we anticipate a need for at least a development, test, and production environment, and disaster recovery environment for the production environment.

Workload and service-level assumptions -

RFI 3 - 4

Can DEA supply peak transaction rates, batch-processing windows, API volumes, annual data growth, and any mandatory availability or recovery requirements? Where respondents are asked to recommend SLAs, are there minimum mission requirements that should govern the ROM?

Annual user growth about 3.5%. Please refer to section 2 of the RFI Supplemental Information document for information about volumes. See section 10 and 11 for incident response and recovery requriements. See section

12 for performance baselines.

Costs between FedRAMP environments -

RFI 8

Does “costs between different FedRAMP environments” refer to recurring data transfers between authorized services, one-time migration between environments, alternative hosting scenarios, or all of these? Can we identify the expected source and destination environments and associated transfer volumes?

The Government is seeking information regarding potential costs associated with data transfers and operation across FedRAMP-authorized cloud environments. Respondents should identify applicable cost considerations for recurring data transfers between authorized services, one-time data migration between environments, and alternative hosting deployment scenarios, as applicable.

The Government has not necessarily established final source and destination environments or transfer volumes.

Respondents should clearly distinguish estimates based on stated assumptions from costs that will require additional technical information to determine.

Questions and Answers

50 AI scope and consumption - RFI 4, 8 Should the base ROM include only an AI-ready architecture, with AI capabilities priced separately as options, or should specific AI use cases be included?

Yes, ROMs should include AI ready-architecture and any proposed AI options as separate line items. Specific use cases may be included as separate line items for clarity if necessary.

51 Section 6

Is DEA asking industry to respond with a new SaaS-based infrastructure that meets the requirements outlined in Section 4, while still integrating with the current applications? Or are they asking for a modernization where they rip and replace all (or a portion) of their current legacy landscape?

The Governement expects to integrate all data into the transformed environment and integrate business processes and functions. See updated appendix a.

52 Section 3/Section 6 Is the AI chatbot hosted on the same Salesforce org? Can you share any technical details of that implementation - does it include Data Cloud

/ Data 360, Agentforce?

The chatbot is not hosted on salesforce. Please refer to section 1 of the RFI Supplemental Information document.

53 Section 6 Please define the agency's intended “data boundary.” Does this refer to the agency network, cloud tenant, ATO/FedRAMP authorization boundary, geographic boundary, or another security boundary?

Data boundary should be understood to be the proposed ATO boundary, encompassing the end result of the transformation project.

54 Section 4 May agency data be processed by an external FedRAMP-authorized AI/model service, provided that the data is tenant-isolated, appropriately encrypted, not used for provider model training, and retained only according to agency-approved policies?

Vendors may propose solutions meeting this request; however, all solutions must been FedRAMP High requirements, and Federal, DOJ, and DEA Security, Privacy, and AI requirements.

55 Section 6 Does the data-boundary requirement apply to the complete AI processing lifecycle, including inference, RAG/embeddings, fine-tuning, evaluation, telemetry, logging, caching, backups, and agent/tool interactions?

Yes.

56 Section 4 What specific authorization, residency, retention, personnel-access, and data-egress requirements must the proposed AI architecture satisfy?

All solutions must been FedRAMP High requirements, and Federal, DOJ, and DEA Security, Privacy, and AI requirements.

57 7. Response Instructions Section 6 contains 12 questions with a two-page limit per question, totaling 24 pages. Is that limit a hard ceiling per question, or may vendors allocate the 24 pages proportionally across questions based on content?

There is not a hard ceiling; however, the Government requests that industry responses be limited to 40 pages, excluding cover page, table of contents. The 40-page limit is inclusive of the respondent's substantive response, industry questions, and Rough Order of Magnitude (ROM) estimates.

58 7. Response Instructions Is the ROM excluded from the 40-page response limit, similar to the cover page, table of contents, and appendices?

The Government requests that industry responses be limited to 40 pages, excluding cover page, table of contents. The 40-page limit is inclusive of the respondent's substantive response, industry questions, and

Rough Order of Magnitude (ROM) estimates.

59 7. Response Instructions Should respondents include a technical overview or approach narrative describing how their solution addresses the functional areas in

Sections 3, 4, and 5, in addition to responding to the questions in Section 6? If so, does that narrative count toward the 40-page limit?

Yes, the vendor is expected to provide a technical overview and approach describing their solution in addressing functional areas. However, the Government requests that industry responses be limited to 40 pages, excluding cover page, table of contents. The 40-page limit is inclusive of the respondent's substantive response, industry questions, and Rough Order of Magnitude (ROM) estimates.

60 RFI §8, pp.13-14 For the requested ROM, should respondents provide costs for a specific period of performance, such as a base year plus option years, or should respondents present implementation costs and normalized annual recurring costs without assuming a particular contract term?

For market research purposes only, respondents should provide ROM estimates based on a 12/month base period and four 12/month option periods. Respondents should identify one-time implementation costs and recurring annual costs separately. Respondents should clearly identify their pricing assumptions, and any recommended optional capabilities. The Government has not established a final contract duration or structure and this structure is solely established to provide a common basis for ROM estimates.

61 RFI §7-8, pp.12-13

Please confirm whether the ROM pricing response is included within the 40-page substantive response limitation or may be provided as a requested appendix excluded from the page count. Also, are supporting materials such as architecture diagrams, capability mapping matrices, and FedRAMP/Section 508 conformance materials treated as excluded supplemental materials?

The Government requests that industry responses be limited to 40 pages, excluding cover page, table of contents. The 40-page limit is inclusive of the respondent's substantive response, industry questions, and

Rough Order of Magnitude (ROM) estimates.

62 RFI §7, pp.12-13 Please confirm whether the two-page limit for each Section 6 Industry Question is included within, rather than in addition to, the overall 40-page substantive response limit.

The Government requests that industry responses be limited to 40 pages, excluding cover page, table of contents. The 40-page limit is inclusive of the respondent's substantive response, industry questions, and

Rough Order of Magnitude (ROM) estimates.

63 RFI §3, pp.2-4; §5, p.10 Can DEA provide anticipated transaction-volume growth over the next five years, including registration transactions, public submissions, ARCOS transactions, correspondence, and other high-volume workloads, for scalability and ROM sizing purposes?

The registrant population grows at around 3.5% each year. Extrapolating ARCOS and CTRANS transaction growth during for that time, the government estimates that in 5 years, an additional 108,000 transactions will be reported/month. (Currently-- around 7,000,000 transactions are reported per month)

64 RFI §8, p.13 To support comparable ROM estimates, can DEA provide the current annual O&M cost baseline, contractor FTE levels by labor category, and the incumbent contract(s) and periods of performance supporting the in-scope applications?

Respondents should develop their ROM estimates based on the requirements and scope described in the RFI, along with their proposed technical approach, staffing assumptions, implementation strategy, and anticipated ongoing support requirements. Please clearly identify th assumptions, exclusions, and cost drivers supporting each estimate.

The Government encourages respondents to provide thier independent assessment of anticipated regarding staffing, licensing, integration, transitioin, and sustainment. Responses should distinguish one-time implementation costs from recurring operating costs, as applicable.

65 RFI §4, pp.6-7 Please provide, if available, annual registration fee revenue, annual payment transaction count, and peak payment volumes to support availability tiering, financial controls design, and ROM assumptions.

Annual payment transaction count for calendar year 2025: 1,308,253

Peak payment volumes: December 2025; fee $112,428,047; transaction count 127,042

66 RFI §4, p.7; §5, p.9

Does DEA have existing agreements, interfaces, or aggregator relationships for state licensure verification? Approximately how many state boards and license types must be covered, and is the contractor expected to establish or maintain data-sharing agreements directly with state sources?

No agreements or relationships exist. All state boards and license types must be covered.

Questions and Answers

67 RFI §3, pp.3-4; §4, p.7

For the CBP Automated Commercial Environment (ACE) interface, what availability and latency requirements apply? Will DEA manage CBP-side coordination and change control, and should respondents assume the existing interface remains unchanged during the initial transition?

Currently, we provide a text file to CBP with the transactions for a given day that gets uploaded to ACE. It is not a persistent interconnection-- we upload the file, and they pick it up. We have not discussed altering that particular interface with CBP as part of the transformation.

68 1. Overview 1 The RFI opens with discussion of Single Sign-On but also describes a broad enterprise modernization effort. Is DEA primarily evaluating identity and access management platforms, or a comprehensive case management / CRM platform incorporating SSO capabilities?

The Government anticipates that SSO is a part of the modernization effort. The solution should be a CRM incorporating SSO.

3. Current Systems and Integration

Environment

Can DEA provide information regarding current enterprise middleware, integration, and API management capabilities and indicate whether maximizing reuse of existing integration investments is a desired objective of the modernization effort?

Please refer to section 1 of the RFI supplemental information document contains information about system components for current environments.

70 7. Response Instructions 12, 13

Can DEA confirm the page count? We are assuming DEA want's no more than 40 pages total, which includes general company information, no more than 2 pages maximum per question (12 questions, 24 pages), and the requested ROM.

The instructions state "Vendors should limit their substantive responses to no more than 40 (8.5 x 11 sheet) pages, excluding the cover page, table of contents, requested appendices, and product literature or other supplemental materials specifically identified by the respondent."

and also

"In addition, vendors should respond to each item in #6, and limit responses to no more than two 8.5 x 11 sheets per question/item, with font size no less than 12-point."

The Government requests that industry responses be limited to 40 pages, excluding cover page, table of contents. The 40-page limit is inclusive of the respondent's substantive response, industry questions, and

Rough Order of Magnitude (ROM) estimates.

Does the FedRAMP High baseline require the proposed SaaS offering to possess an existing FedRAMP High authorization at the time of response or award, or may a solution deployed on FedRAMP High-authorized infrastructure obtain a DEA-sponsored ATO before production deployment?

The solution must be FedRAMP High at time of award. The solution itself must be FedRAMP high, not just installed on a platform that is FedRAMP high.

Does DEA currently anticipate acquiring the modernization through a single enterprise prime contract, multiple modular workstreams, or phased task orders, and which applications or capabilities are expected to comprise the first implementation wave?

The Government has not finalized its acquisition strategy. Information obtained through this RFI will assist DEA in determining the appropriate acquisition approach, contract structure, period of performance, and other applicable requirements. Respondents are encouraged to provide recommendations based on their experience and proposed capabilities. Migration from O&M to Transformation environments will be discussed during discovery.

For RICS, ARCOS, CTRANS, CSOS, DC3, and the applications in Appendix A, which systems does DEA expect to replace, retain as systems of record, or integrate with during the initial modernization period?

Please refer to the updated section A.

Can DEA provide estimated unique monthly active and peak concurrent users, transaction-volume peaks, EDI/API volumes, and expected availability or response-time targets, given that the supplied account totals include duplicate users across applications?

Please refer to section 3 of the RFI Supplmental Information document for user metrics. See section 2 for application and registration metrics.

Does the requirement for high-volume print-on-demand and website administration include contractor-provided physical printing, mailing, and content-authoring services, or is the expected scope limited to software, integration, hosting, security, and publishing workflow capabilities?

The expectation is that the current printing hardware and operations undergo review and transformation.

76 Section 1, Overview

The RFI describes the objective as transforming decentralized and siloed applications through a modern solution, including SaaS and COTS.

Please identify whether DEA has established a target enterprise architecture, preferred platform ecosystem, or designated system integrator model that respondents should align to in proposing the modernization approach.

The Government expects respondents to propose best solution for review and acceptance.

77 Section 1, Overview

The RFI refers to a single sign-on solution while also describing broad enterprise modernization requirements. Please clarify whether SSO is the primary acquisition focus, a mandatory platform capability, or one component of a larger enterprise application modernization requirement.

SSO is one component of a larger enterprise application modernization requirement, and is also a mandatory platform capability.

78 Section 1, Overview Please identify the anticipated scope boundary for the desired solution: whether DEA expects replacement of existing applications, integration of existing applications under a unified identity and data layer, phased coexistence, or a combination of these approaches.

The Government anticipates that the solution will be a combination of the listed approaches. Respondents should review the RFI and related materials and propose the best solution for the Govenment review.

79 Section 2, Background and Mission Need

Please identify the mission functions that DEA considers highest priority for modernization during the initial implementation phase, including registration processing, reporting, import/export, customer service, analytics, public reporting, and enforcement-support functions.

Migration and priorities from O&M to Transformation environments will be discussed during discovery.

80 Section 2, Background and Mission Need Please clarify whether DEA has documented its current-state business processes, pain points, process maps, application inventories, data models, interface inventories, and future-state requirements that may be made available during a subsequent solicitation.

The Government maintains all of the listed documents. A determination about whether to include these items in a future solitication has not been determined yet.

81 Section 2, Background and Mission Need

Please describe DEA’s intended definition of a unified solution. Specifically, does DEA seek a single commercial platform of record, a logically integrated modular architecture, or a federated environment that retains multiple systems of record while presenting a unified user experience.

The Government anticipates that the solution will be a combination of the listed approaches. Vendors should review the RFI and related materials and propose the best solution for review.

Questions and Answers

82 Section 2, Background and Mission Need

Please identify the categories of sensitive information expected to be processed by the modernized environment, such as personally identifiable information, law-enforcement-sensitive information, controlled-substance transaction data, investigative data, payment information, and CJIS-regulated information.

Categories of information are captured in the the PIAs which are located here:https://www.dea.gov/foia/privacy-impact-assessment. The PDF of the CSOS PIA can be downloaded directly at the following link: https://www.dea.gov/sites/default/files/2023-10/DEA%20PIA%20CSOS%2023-

1818%20%281%29.pdf. The RSN PIA can be downloaded directly from the following link:

https://www.dea.gov/sites/default/files/2025-02/508_DEA_PIA_23-1814_RSN%20-%20FINAL.pdf. Vendors are required to propose solutions that can meet the CJIS Compliance requirements.

83 Section 3, RICS

The RICS environment is described as a suite of more than 20 applications with varied infrastructure, limited interoperability, and no data sharing. Please provide the current application inventory, application ownership, technology stack, hosting location, lifecycle status, and planned disposition for each RICS component.

The application inventory, ownership, technology stack, hosting location, lifecycle status, and planned disposition for each RICS component are outside Records Management and are to be provided by the program office and IT. Records Management requests to be consulted before any RICS component is decommissioned so that records requiring continued retention are preserved or migrated in accordance with 36 CFR §§ 1236.10 and

1236.14. Please refer to the updated applications in Appendix A.

84 Section 3, RICS

Please clarify which RICS capabilities DEA expects the modernized platform to replace versus integrate, including registrant records, administrative-action tracking, workload assignment, communications, public web functions, dashboards, print-on-demand, GIS, tips, events, and toxicology reporting.

Please refer to the updated appendix A for information about the projected disposition of applications for the transformation effort. The capabilities listed under RICS in the RFI, and asked about in this question are expected to be folded into a platform facilitating a single, comprehensive view of registrant data.

85 Section 3, RICS RICS processes more than three million transactions annually. Please provide transaction-volume distributions by transaction type, peak periods, concurrency levels, batch-processing windows, response-time objectives, and expected annual growth rates.

Please refer to section 2 of the RFI Supplemental Information document for metrics. RTO is in section 10. Annual growth is about 3.5%.

86 Section 3, RICS

RICS supports more than 3.5 million mailed communications annually through the Print-On-Demand environment. Please identify the correspondence types, templates, approval processes, print vendors, mailing interfaces, service-level expectations, retention requirements, and whether electronic delivery may replace any portion of current physical mail volume.

The majority of mail sent from RICS is DEA form 222. There is no plan to require electronic use of this form (the electronic form does exist, it's just not mandated). In order to mail a 222, the mail system must receive a request from either a verified registrant ordering the forms for themselves, or a request from a validated DEA user requesting the forms on behalf of a registrant. Batch processing picks up these requests and writes them to the printshop, where they're printed, folded, and inserted. Expectations for the mailing service may be more appropriate in the SOO, SOW, or PWS rather than in response to a question in an RFI.

87 Section 3, ARCOS Please clarify whether ARCOS modernization is within the contemplated scope, and if so, whether DEA expects the proposed solution to ingest, validate, store, analyze, and report ARCOS transactions or only exchange data with ARCOS through approved interfaces.

ARCOS is part of the transformation effort. The Government's expectation is that the transformed application will continue to meet DC's requirements for ingestion, validation, storage, analysis, and reporting.

88 Section 3, ARCOS Please provide the ARCOS transaction formats, validation rules, error-handling processes, EDI standards, submission schedules, data-retention requirements, and anticipated requirements for historical-data migration or archival access.

Transaction formats and EDI standards can be found here:

https://www.deadiversion.usdoj.gov/arcos/arcos.html

We do not anticipate a change in the transaction format. Additional Information about ARCOS reporting can be found here:

https://www.deadiversion.usdoj.gov/mtgs/supply_chain/conf_2025/Day_1/4_ARCOS_Reporting.pdf

89 Section 3, CTRANS Please identify the specific CTRANS applications and business functions that DEA intends to retain, integrate, modernize, or replace, including chemical import/export, controlled-substance import/export, regulated-machine reporting, approvals, and CBP ACE interfaces.

Please refer to updated list of applications.

90 Section 3, CTRANS

Please clarify the current technical and business-interface model with CBP ACE, including interface protocols, message standards, transaction acknowledgements, availability constraints, certification requirements, error-resolution procedures, and responsibility for interface maintenance.

Please refer to section 9 of the RFI Supplemental Information document. Specific rules around the interface with CBP are negotiated in an ISA, but the Government does not believe that is appropriate content for this effort.

91 Section 3, DC3 and DC4 DC3 is identified as a Salesforce-based CRM application. Please clarify whether DEA expects the proposed solution to retain DC3 as the customer-service platform, integrate with it, migrate its capabilities, or provide an alternative CRM capability.

DC3 will be a part of the transformation effort. The Government expects that the data within the salesforce platform to be retained..

92 Section 3, DC3 and DC4

Please describe the required data exchanges among the registrant portal, case-management functions, DC3, and DC4, including whether customer-service agents require real-time access to registrant status, payment, correspondence, submission, deficiency, and workflow information.

The requirement is allow the contact center to have real time access to registrant status and history according to their role and needs.

93 Section 3, DC3 and DC4

DC4 currently provides chatbot assistance using content from the Diversion Control website. Please clarify whether the future platform must integrate with, replace, expand, or leave unchanged the current chatbot, and identify any requirements for multilingual support, escalation to human agents, knowledge management, transcripts, and quality monitoring.

The Government expects to expand DC4s current role especially with regard to call deferral. All SI-related functionality must be proposed to DOJ and vetted through the proper channels.

94 Section 3, CSOS Please clarify whether CSOS certificate lifecycle management, registration-authority processes, certificate-authority processes, certificate-revocation-list publication, and electronic-order reporting are within the expected modernization scope.

CSOS is within the scope of the transformation effort

95 Section 3, CSOS If CSOS integration is required, please identify applicable cryptographic standards, certificate policies, authentication mechanisms, external dependencies, audit requirements, and constraints associated with daily certificate revocation list updates.

The Government intends for CSOS to be within the scope of the transformation effort. Please follow the link for additional information:

https://www.deadiversion.usdoj.gov/drugreg/csos/csos.html https://www.deadiversion.usdoj.gov/drugreg/csos/csos.html https://www.deadiversion.usdoj.gov/drugreg/csos/csos.html https://www.deadiversion.usdoj.gov/drugreg/csos/csos.html

Questions and Answers

Section 3, State Licensing and Other

Authoritative Sources

Please identify the state licensing sources DEA currently uses or expects to use, including the states, professional-license types, data-access mechanisms, update frequencies, matching rules, legal agreements, and exception-handling procedures.

Registration Program Specialists (RPSs) use the website searches available from each state's licensing board.

There's no technological solution in place for this currently because states don't provide consistent data or reliable access. As we understand it, part of the transformation effort would be to build an application that brings this data in.

Section 4, Registration Lifecycle

Management

Please provide detailed volumes and service objectives for new registrations, renewals, modifications, transfers, surrenders, retirements, and other registration transactions, segmented by registrant type and transaction channel.

Please refer to section 2 and 3 of the RFI Supplemental Information document. Additional information about these requirements will be provided in future solitications or at discovery.

Section 4, Registration Lifecycle

Management

Please identify which registration business rules, eligibility requirements, fee rules, approval authorities, documentation requirements, and adjudication workflows are stable versus expected to change frequently because of policy, statutory, or regulatory updates.

The Government anticipates that all business rules,eligiblity requirements, fee rules, approval authorities, and requried documentation will remain the same throughout the transformation (barring policy changes).

Workflows may change, depending on DC's needs. These requirements will be provided during discovery.

Section 4, Registration Lifecycle

Management

Please clarify the required Pay.gov integration pattern, including supported payment methods, transaction types, refund processes, reconciliation frequency, failure handling, receipt requirements, and responsibility for Payment Card Industry compliance.

Please refer to section 4 of the RFI Supplemental Information document.

Section 4, Registrant Portal and Self-

Service

Please identify required authentication assurance levels for registrants, delegated organizational users, third-party representatives, and public users, including identity proofing, multifactor authentication, credential recovery, and account-linking requirements.

Not all requirements have been established yet. The Government anticipates solutions to integrated registration identities from vendors.

DOJ's requirement for authentication assurance is AAL3

Section 4, Registrant Portal and Self-

Service

Please define the expected delegated-access model for organizations with multiple authorized users, including role types, approval and revocation workflows, delegation duration, segregation-of-duties requirements, and audit-log retention.

The Government requests respondent suggestions in this area.

102 Section 4, Website Management Please clarify whether website administration covers only Diversion Control public web content or also includes the development, hosting, security monitoring, accessibility remediation, content approval, backup, and lifecycle management of public-facing applications.

Website administration is separate from application development and management

Section 4, Application Processing and

Workflow

Please identify whether DEA expects authorized business users to configure workflows,…