Attachment 6- OEC eFeeds Questions for Industry.docx

OEC eFeeds Questions for Industry

1. FedRAMP questions: a) Is your product FedRAMP authorized? b) If it is not, what will it take for you to get it FedRAMP authorized? c) Are you familiar with the process to get FedRAMP authorized? d) Are you willing to work with a third party assessor to get FedRAMP authorized? e) If so, how long will it take to complete the process to obtain FedRAMP authorization? f) Will you assist the Government in determining the costs for FedRAMP authorization?

2. Has your application gone through a 3rd party assessment of its security controls based on Cybersecurity framework published by NIST?

3. If so, can you provide the report and findings from the 3rd party assessment?

4. If your company is awarded the contract with the SEC, are you committed to take your application through the FedRAMP process for authorization within 12 months from the date of award?

5. Are you familiar with and versed in the requirements for Federal Acquisition Regulations (FAR)?

6. If you are not already registered, are you willing to register in the System for Award Management (SAM) to do business with the Federal Government? For information on how to register, please refer to https://sam.gov/content/entity-registration.

7. Are the Service Level Agreements (SLAs) in this draft RFP reasonable? What SLAs and associated penalties/consequences for each SLA if it is not met should the Government consider using for this effort?

8. What evaluation criteria should the government consider using to ensure a best value award to one vendor? Please be as specific as possible.

9. The SEC is looking to implement agile project management. What agile development methodologies have you had success with?

10. Other than labor costs, what other direct cost items are needed for completion of the SOW?

11. Using Excel, could you recommend a pricing structure for this SOW? If you have any suggestions, please show them.

12. In your experience what does the process and steps look like in working to set up the broker data feeds with your clients and brokers?

13. What type of personnel and qualifications would be required for performance of the areas in the SOW (i.e., dedicated ISSO, security PM)? Based on this information identify the appropriate labor categories your company may consider proposing in response to an RFP. You are encouraged to provide any staffing strategies you might develop to ensure that the contract is appropriately staffed through the period of performance.

14. Which, if any, of the labor categories you identified should be considered key personnel?

15. What type of Government Furnished Information would be required for the services?

16. How is the vendor expecting information to be sent from the SEC to the vendor for use in the application?

17. What data elements do you require from the SEC in order to accurately configure the application and reporting capabilities?

18. How is the information, which is nonpublic, sensitive and confidential, sent from the SEC to the vendor protected, encrypted and secured? Can a separate and independent instance of the application be stood up for the SEC? Is there an additional cost to the SEC for a separate and independent instance of the application?

19. Does the SOW provide a clear representation of the government’s needs? If not, what needs to be clarified or added?

20. What is the preferred contract type for these services? T&M, Labor Hour, etc. or a hybrid? If hybrid, please identify the contract types suggested and the services to be provided via each contract type.

21. How long do you need to complete a responsive proposal for this effort? What additional information would you need the government to provide in an RFP to be able develop a responsive and adequately priced proposal?

22. What is an acceptable period of performance for this requirement? Do you envision the need for option periods? The government was anticipating doing a Base Year Period of Performance with 4 Option Years.

23. What does the implementation fee cover from a configuration and testing standpoint?

24. General comments or observations.