Vendor_Questions_and_Responses.pdf

UNITED STATES DEPARTMENT OF EDUCATION

Office of the Chief Financial Officer Contracts and Acquisitions Management

EDEFCM16Q0001 Case Management Solicitation

Vendor Questions and Responses

1) It is standard practice for the Government to purchase software licenses from Carahsoft or other similar government authorized reseller. Please confirm that ED will procure software separately.

Answer: No, the government will not provide any licensing. The price of any licensing should be included in the Vendor’s quote.

2) The solicitation (not including the Attachments) currently have a "DRAFT" watermark.

Can we assume that the solicitation is Final?

Answer: Yes, the solicitation is final.

3) Item #10 of the 1449 indicates a NAICS code of 541512. CLINs 0001 through 0005 indicate a NAICS code of 541519. Which NAICS code is intended for the solicitation?

Answer: The NAICS code for this solicitation is 541512. The Department will update the information provided in CLINs 0001 through 0005.

4) The CLINs identify the Option Time Duration to be 364 days. However, each of the CLINs have calendar bound dates from 8/31 to 8/30, which is 365 days. Should the CLIN read 365 days?

Answer: Each year of the contract consist of 365 days. Please disregard the amount of days mentioned for each CLIN, as we are attempting to make the updates necessary in our contract writing system.

5) Should this provision for Use and Non-Disclosure Agreement be submitted with our response? If so, where should it be located? (In reference to Provision 3452.227-72)

Answer: Yes, please submit the document in your Technical Proposal.

6) When will the vendor be provided a baseline set of requirements that must be addressed by the March 1, 2017 go-live date? What will be the availability for subject matter experts (SME) and other users to finalize requirements that must be addressed for the March 1, 2017 go-live? (In reference to Attachment A Page 1: "The system must be operational and all requirements must be met by March 1, 2017")

Answer: The solicitation provides all requirements in Section XII, Performance Objectives. All the requirements must be met by the go-live date of March 1, 2017.

SMEs will be available from contract initiation throughout the contract to help clarify any questions the vendor may have concerning specific requirements.

7) In order to help SaaS CRM service providers price this project, all respondents need a consistent number of named users that will have access the system. Various user counts were listed in RFP ranging from 80-110. What user count should we use for pricing? (In reference to Attachment A Page 1 & 5: "We are currently working with a total of approximately 80-100 users")

Answer: The OIG expects 100 users in FY 2017. We do not expect growth in the next 5 years to exceed 110 users.

8) Please define "non-information technology personnel". (In reference to III Scope, number 1) Answer: OIG personnel that do not have a foundation in Information Technology, programming, or coding should be able to customize lists, add fields, and manage users.

9) Most all COTS cloud SaaS providers have no pricing options for a perpetual license.

This requirement will severely limit the # of COTS/SaaS packages that can be incorporated into responses. With that in mind, will ED consider a system that does not include a perpetual license option? (In reference to Period and Place of Performers)

Answer: Yes, but the option to convert to a perpetual license option will be considered part of the best value determination under Evaluation Factor 1, Criterion 6.This is to enable the Government the option of moving the product from the cloud to host it within the Government’s network. The Statement of Objectives has been updated.

10) Please confirm that "requirement 28," as referenced in 1.2.9, refers to 1.2.8, or clarify as appropriate. (In reference to 1.2.9)

Answer: Requirement 28 refers to 1.2.8. The statement of objective has been changed.

11) Is the SAM API a Web Service API? (In reference to 1.2.10)

Answer: Yes. See https://gsa.github.io/sam_api/sam/.

12) Please clarify this requirement, Generate a unique case number that incorporates the fiscal year and that resets and assigns a next number by fiscal year. (In reference to 1.3.3)

Answer: When a case is created, the unique case number should include the fiscal year (FY)and a unique number for that year, that resets to one at the beginning of each FY. For example, the first case opened in FY 2016 would include 16 and 01.

The second case opened would include 16 and 02. The first case in FY 2017 would include 17 and 01.

13) There are many SaaS solutions that can meet EDs requirements that do not operate on a Windows 2012 Server virtual machine running Microsoft SQL Server version 2014. Will ED consider removing this requirement and consider these solutions? (In reference to 1.10.6)

Answer: As with the desire to have an option for perpetual licensing, this requirement is to enable the Government the option of moving the product from the cloud to host it within the Government’s network. Since the SOO has been updated to reflect perpetual licensing is a desired option, the ability of the product to operate on Windows 2012 Server virtual machine running Microsoft SQL Server version 2014 will be considered part of the best value determination under Evaluation Factor 1, Criterion 6. The statement of objectives has been updated.

14) Data migration (In reference to 1.11 Data Migration)

a. Where is data stored currently?

b. How much data is there?

c. What kind of data – documents? Pictures? Video? Audio? (Data Types)

Answer:

a. The data is currently stored on Department of Education OIG servers.

b. Approximately 200 GB Data

c. The current system has the following type of data: The primary data types are

.docx, .pdf, and .zip, but the following also exist: avi, bmp, csv, doc, docm, docx, gif, htm, html, jpeg, jpg, log, mdb, mht, mov, mp3, mpg, msg, odt, pcap, pdf, PNG, pps, ppt, pptx, pst, rtf, sql, tab, txt, wav, wmv, xls, xlsx, xml, zip.

15) The text says "Provide software licenses as outlined in Section 1.10.5." However, Section

1.10.5 reads "The contractor shall provide two remote or on-site training sessions for administrator functions. The training shall cover the creation of ad-hoc and common reports." What is the correct reference in Section 1.12.3? (In reference to 1.12.3)

Answer: The reference should be 1.10.6. The statement of objectives has been updated.

16) Please clarify "service desk coverage" - Is this requirement for 24x7x365 service desk coverage? (In reference to 1.13.11)

Answer: No. The service desk coverage should cover business hours specified by the Vendor. The length of the service coverage hours will be considered as part of the best value determination.

17) Recovery Time Objective (RTO) – Ability to recover files within 48 hours of request.

Will ED consider removing this requirement or extending the RTO to 20 business days?

( In reference to 1.14.4)

Answer: The Statement of Objectives has been updated to reflect within two (2) business days of the request.

18) Please clarify this requirement, Provide must support two failover tests annually (Fail over from primary server/system to backup server/system in alternate geographic location.) (In reference to 1.15.11)

Answer: As part of its Business Continuity Plan (BCP) the Department participates twice a year in Continuity of Operations (COOP) exercises. During those exercises, all IT investments must demonstrate that they can operate on a backup server and then be returned to operational status on the primary server/system. The requirement is that the backup server/system be located a geographically separate location (1.14.4). Therefore, the vendor must participate in these exercises by switching from a virtual machine in one data center to one in a backup data center.

19) Please clarify this requirement, Provide must be able to lock down access to the CMS to only specific Internet Protocol address ranges. (In reference to 1.15.12)

Answer: The system must only be accessible from the Department’s network. The contractor will be provided the range of Department IP addresses. This can be accomplished through router tables or firewalls.

20) We understand that the example table you provided will be completed for all Section XII performance objectives and will be part of the Technical Proposal. Can the completed table (the list of items to go into the table is currently 11 pages long) be included as an appendix not to be included in the 30 page count for the Technical Approach? (In reference to Attachment B – Example Performance Objective)

Answer: The sample table provided in the instructions in paragraph 5 of the instructions should be used and included as part of the maximum 30 pages for the technical proposal. The headings and columns can be adjusted as most beneficial to convey message. The table may also be printed using 10pt Times New Roman, single spaced. The table can be provided in excel if the printed version (given font, etc. indicated) of the table fits within the page count. Please refer to the Technical Proposal Instructions.

21) Would the Government consider adjusting the submission date to allow for a minimum of 7 business days from the date the response to these questions are provided?

Answer: The deadline will be extended to Thursday, August 4 at 2:00 PM EST.

22) Will Department of Education allow for single-spaced 10 pt size in Times New Roman font in the tech response? The current requirement is for double-spaced 12 pt size Times New Roman font, per Attachment B page 1.

Answer: The body must be 12 pt, double-spaced; however, see question 20 concerning the table.

23) Is this a follow-on requirement? If so, could you please provide the incumbent contract number for this opportunity?

Answer: No, this is a new requirement/solicitation. We are migrating data from our existing system, EDITS, to a new system.

24) Has ED OIG completed a Market Survey or Analysis of Alternatives or conducted product demos to determine which Case Management System would be a best fit for the agency? If so, what are the preferred solutions? ( In reference to IT strategy)

Answer: ED OIG has completed Market analysis. The preferred solution is a COTS Case Management System that is cloud-based and authorized by FedRAMP.

25) Can the government break out the number of users for the Help Desk and for the Case Management System? Please define the users of the help desk as those on the backend that are receiving requests.

Answer: There will be two OIG administrators who must be able to contact the Help Desk for support. The remaining users will request assistance through the OIG administrators.

26) If the software licensing is only available in a subscription model, will the response still be compliant by not offering a perpetual pricing model?

Answer: See Question 9.

27) Can the government please elaborate on the requirement for contractors to provide an oral/visual presentation upon request to demonstrate how the requirement can be met? Is this after response down-select?

Answer: For certain requirements, the Government might request the contractor to demonstrate (remotely) how the requirement is met. This would be after down-select.

28) Would U.S. Department of Education (Department), Office of the Inspector General (OIG) consider an on-premise solution with remote support?

Answer: No.

29) 7. Capacity/Experience/Past Performance states “This section shall include offeror’s experience with a range of federal contracts and expertise in technical requirements, federal security requirements, and the support and processes required for maintaining government websites and online systems” but does not specify a minimum or maximum.

Is there a minimum or maximum for how many Past Performances are to be included? ( In reference to Technical Proposal Instructions)

Answer: There is not a minimum or maximum. The contractor should provide sufficient information concerning Vendor’s reputation in terms of quality, problem resolution, cost control, timeliness, business relations, and customer service.

30) The Volume II – Business Proposal Instructions state “Tables may be single spaced and utilize no smaller than 10-point Times New Roman font.” Does this apply to the Volume I – Technical Proposal Instructions as well? (In reference to Technical Proposal Instructions)

Answer: Yes. See Question 20.

31) With the timeline of March 1st 2017, when and how would training be provided to department of education for use of the system? ( In reference to Performance Objectives System 1.2.6)

Answer: Regarding 1.10.5, training should be provided to key personnel by February 1, 2017. The statement of objectives has been updated. The method of training should be sufficient enough that OIG personnel are able to administer the system and train the remaining users.

32) How will OMB approval of forms be handled with the system when it is brought online and when ED OIG creates or modifies forms/elements within the system? ( In reference to Performance Objectives System 1.2.6)

Answer: Any forms handled by the system will be OIG internal forms that do not require OMB approval.

33) Can the bidders respond to the listed requirements in an MS XL format? ( In reference to XII. Performance Objectives Page 4 through 14 of the RFP.)

Answer: See Question 20.

34) States that “the contractor shall provide the option to move to a perpetual license at the end of the base year or any option year.” True Software as a Service (SaaS) solutions are only available and delivered as a SaaS and not using a perpetual license. Will the

Government consider SaaS solutions that cannot be moved to a perpetual license? ( In reference to Period and Place of Performance section of SOO)

35) “The system must be able to operate on a Windows 2012 Server virtual machine running Microsoft SQL Server version 2014.” Please confirm that this requirement is not required/valid for a SaaS model. (Attachment A, XII. Performance Objectives, Section 1.10.6)

Answer: See Question 13.

36) Is data migration required from the current EDITS system to the new Case Management System? If yes, can the Government provide details to allow contractors to estimate level of effort and cost such as current data model, number of tables, number of fields, number of records?

Answer: The current EDITS contractor is responsible for putting the data in the format necessary to migrate the data. The migration services would include providing the data format required, translating fields (as required) to match any changed terminology, assisting the current contractor with questions and importing that data into the new system.

37) Can the Government provide a breakdown of the 110 users in terms of roles and responsibilities? Does the count of 110 users include system developers, systems administrators, and management? (In reference to Attachment A, XII. Performance Objectives, Section 1.2.2)

Answer: The OIG expects 100 users in FY 2017. We do not expect growth in the next 5 years to exceed 110 users. The 110 users accounts for all users/operators/administrators of the system; however, it is desirable that the 2-3 administrators have separate standard user and administrator accounts so they do not use their admin access for normal daily access permissions.

38) Can the Government confirm that the Cover Page, Table of Contents, Abstract and Introduction, sections are excluded from the 30-page limit in the Technical volume?

Answer: Yes, theses sections are excluded from the page limit listed in the Instructions.

39) Does the Department want to build off the existing codebase or is it open to building a new application?

Answer: The Government does not want to build off existing EDITS codebase. The product should be a commercial off the shelf product that can have fields and workflows customized to meet requirements, and it should not be building a new application or enhancing the current system.

40) Where are documents stored currently?

Answer: The documents are currently stored within the database as varbinary data.

Also, see Question 14.

41) Are there predefined activities?

Answer: Yes.

42) Are there a small number of cases? How many cases and case types are there?

Answer: Since 2013, the OIG has opened 235 investigations (including projects), 1,850 preliminaries, and 13,743 hotline complaints. The system includes cases from 2006. We expect four different case types (Complaints, Preliminaries, Investigations, and Projects).

43) Is it expected that the number of cases & complexity of cases will increase?

Answer: No. Per Section II, we receive approximately 5,000 hotline complaints, open nearly 700 preliminary cases, and open 85 full investigations each year. We do not expect the number or complexity of our cases to change.

44) If the expected number of cases and complexity will increase, is the Department open to a complete re-design with scaling built in as opposed to COTS solution?

45) Is the Department looking for the ability for the user to be able to customize exceptions to process (generate rule changes on the fly); or is the Department only looking for the user to be able to manipulate along existing workflows (assignments, referrals, etc.)

Answer: The Government is looking for a product that minimizes contractor intervention, coding, and programming. If a minor change in workflows is required, Government personnel should be able to make the changes.

46) With regard to page count, Item 5 we have developed an Objective Matrix as referenced to address the 160+ performance objectives listed in the SOO. The Objective Matrix will cover 22 pages, single spaced with no addition explanations listed. Will the Government consider excluding this from the page count? (In reference to Instructions to Offerors)

Answer: See question 20.

47) Are the case specific restricted role base access lists preset/currently established or are they developed on a case by case basis? (In reference to 1.1.12)

Answer: They are developed on a case by case basis.

48) How large is the current data storage size for the 10-year archrival? Will access to this data be required after archival? (In reference to 1.3.23)

Answer: Currently, closed cases remain a part of the system and are included in the 200 GB of data referenced in Question 14. There is no separate storage or archiving. The requirement is not for archival, but for the deletion of all records associated with the investigation. No access to this data will be required after the retention period has been met.

49) The website must be written in HTML and .Net or Cold Fusion. Please confirm that this requirement is specific to the Hotline website and not the CMS as well. (In reference to 1.4.3)

Answer: The requirement applies only to the Hotline. The Department’s current server is configured to support these languages; therefore, it must be written in these languages if the hotline page is to be hosted on the Department server. The Department may consider alternatives if the contractor provides any needed software and assists in obtaining an updated accreditation of the system.

The contractor can optionally host the site on its own server and use its preferred language, but it must be within the FedRAMP authorization boundary, but outside the Agency Information System Authorization Boundary where the CMS is hosted.

50) The public facing webpage must support ability to switch languages for page in accordance with the Limited English Proficiency requirements (foreign language text will be provided). How many foreign languages will need to be supported by this requirement? (In reference to 1.4.6)

Answer: The languages that must be supported include English, Spanish, Russian, Vietnamese, Korean, and Tagalog. See http://www2.ed.gov/about/offices/list/oig/hotline.html for an example of current capabilities.

51) The system must be able to operate on a Windows 2012 Server virtual machine running Microsoft SQL Server version 2014. Please clarify whether this is a requirement of the CMS itself or the Hotline website. (In reference to 1.10.6)

Answer: See Question 13 & 50.

52) How long does it take to process a public trust clearance for prime and sub contractors?

Answer: A preliminary clearance decision will be made 2-3 weeks of receiving all required background documents.

53) Will the Department of Education be providing a site visit / industry day opportunity?

54) Within year one, does the government have a date in which the CMS configuration, setup and migration should be completed, or a date the CMS should be in production (i.e. a "go live" date)?

Answer: The go-live date is March 1, 2017.

55) Does the Time & Costs capability need to connect to any additional time and costing software? Or is this a stand-alone time and cost feature within the CMS being built?

Answer: The time and cost capability does not connect to any additional software.

The Time & Cost capability is a stand-alone feature within the CMS software.

56) In reference to the Training capability, is this CMS expected to host online training courses?

http://www2.ed.gov/about/offices/list/oig/hotline.html

Answer: No. In reference to 1.8, Training, the CMS is expected to track training not be a mechanism for providing training.

57) Is there a preferred method to gain access to the CMS? For example, can the CMS be cloud-based and accessible through a web-browser?

Answer: Yes, the CMS should be cloud-based and accessible via a web browser.

There should be no requirement to install software on the host computer.

58) If selected as the contractor, may we export all the current data to a staging database owned and secured by us during the development of the CMS?

Answer:

Sanitized data from the historical system will be provided prior to Agency ATO to enable the vendor to work with the data.

The government would consider allowing actual historical data to be migrated prior to Agency ATO if one of the following has been accomplished:

a) Another agency ATO;

b) P-ATO; or

c) We have reviewed the Security Assessment Report (SAR), and we have determined there are no critical security issues.

The agency ATO must be obtained before the go live date.

59) Is the previous contractor eligible to respond to this solicitation?

Answer: The previous EDITS contractor does not meet the small business requirement.

60) Current user base is 80 – 100. Is there a percentage growth of user base in the upcoming years?

Answer: The OIG expects 100 users in FY 2017. We do not expect growth in the next 5 years to exceed 110 users.

61) Are majority of the users ED OIG personnel working in DC? OR are there multiple groups of users spread across the nation?

Answer: There are approximately 30 users in the D.C. area. The majority of our users are spread across the nation.

62) Several system requirements under Section XII (Performance Objectives) have asterisks in the end but no additional explanation was provided. What was the governments intent with these asterisks?

Answer: See Volume I, Technical Proposal Instructions, 5(C).

63) It was mentioned that the website must be written in HTML and .Net or Cold Fusion. Is there any flexibility with this requirement?

Answer: See Question 50.

64) Can companies outside the USA apply for this? If so, do we need to be in the USA at ED Headquarters for meetings? Can all of the tasks be performed outside of the USA?

Answer: Yes, only if all requirements of the solicitation and FAR are met.

65) Can proposals be submitted via email?

Answer: Yes, proposals are accepted via email.

66) Is Department of Education (DoE) able to put together or provide sizing requirements of its current on premise environment? This needs to include number of:

Servers – VMs – VM Compute Resources (CPU/RAM) – Backup Storage - Backup Storage Retention (how long data/docs need to be stored)

IOPS –

Answer: The Department currently uses two physical servers for its case management system (one has the web interace/EDITS system and the other has the database). The specifications for the current servers are listed below. Concerning backups and the storage requirements, see questions 94, 96, and 120.

Web Server Dell Power Edge R720 Server (application and database) Processor: 2 x Xeon E52640 2.5GHz 15M Cache

Cores: 6 Memory: 40GB 1333MHz LV Dual Ranked RDIMMs OS Disks: 2 x 146GB 15k RPM Serial-Attached SCSI 6Gbps NICs: 2 x 5720 Broadcom HBAs: 2 x Emulex 12000 LPE Memory: 8GB

Database Server Dell Power Edge R720 Server (application and database) Processor: 2 x Xeon E52640 2.5GHz 15M Cache Cores: 6 Memory: 40GB 1333MHz LV Dual Ranked RDIMMs OS Disks: 2 x 146GB 15k RPM Serial-Attached SCSI 6Gbps NICs: 2 x 5720 Broadcom HBAs: 2 x Emulex 12000 LPE 8Gbps

67) What are the projected bandwidth growth over 5 year period?

Answer: The bandwidth growth would be in proportion to the number of users which is not expected to exceed 110 in the next 5 years.

68) Will VPN Access (site-to-site, client, both, none) be required?

Answer: As described in 1.15.12, access to the system must be limited to IP addresses specified by the Department. Secure access to the system must then be achieved via TLS.

69) Will the systems need to join an existing AD domain or established trust?

70) What standards does DoE need to harden the Operating System (DISA STIG, CIS)?

Answer: The security of the system must meet NIST 800-53. Guidance documents such as STIGs can be used to help guide the contractor to meet 800-53 requirements, but the NIST 800-53 is the requirement.

71) What is the mandated SLA Uptime that needs to be met (99.5, 99.9, etc.)?

Answer: 99%

72) How many documents are contained in each of the legacy databases (Activities, documents sensitive, documents standard, Hotline, inventory, investigators, OIG MIS, EX Parte, Grand Jury, Sequestration, Outreach, Sources, Time and Training) of the current application? What is the data format for these databases?

Answer: EDITS has 144,966 Documents related to case files. They are stored in “Varbinary” format in the SQL Server Database.

73) Are tables and Section Titles subject to the double-spaced 12-point Times New Roman font restrictions?

Answer: See Question 20. Section titles should not exceed or be less than 12-point Times New Roman.

74) Is past performance from State/Local government or commercial experience also acceptable?

Answer: Yes, but Federal OIG experience is preferable.

75) Can past performance of the combined team be utilized or just past performance from the prime?

Answer: All past performance can be considered, but we would give more weight to the past performance of the prime contractor.

76) Does the government anticipate periodic upgrades to the system, such as quarterly releases, to provide additional capabilities beyond those of the initial system deployment?

These would be beyond normal software patch releases. If so, would these periodic updates be subject to the Department of Education Life Cycle Management framework?

Answer: If the vendor’s COTS product is updated, the updated product must be made available to the Government during the period of the contract. The implementation of these updates would be made after approval is granted by the OIG (Department approval is not required).

77) Will you consider extending the response due date to allow adequate response time?

78) Given that references and access to departmental regulations have not been provided, we feel like this language is too vague/broad for a FFP contract; can you please elaborate on this requirement? ( In reference to Attachment A, Section I: “All work must be performed and in compliance with Federal and Department regulations.”)

Answer: All Department policies follow standard Federal Government-wide directions (e.g., NIST), and the contract is only expected to follow these policies within the scope as defined in the SOO. Additional security information can be found in Section C- Contract Clauses (pages 8-14) of the solicitation.

79) In reference to the databases in Attachment A, Section II, “The following databases are part of the current application: Activities, documents sensitive, documents standard, Hotline, inventory, investigators, OIG MIS, EX Parte, Grand Jury, Sequestration, Outreach, Sources, Time and Training”:

Are these all unique databases?

What format will the data be provided?

How are the documents stored and associated to the case files?

Will someone familiar with these datasets be available to assist in mapping the data?

Will you be able to provide an example of the data sets?

Will you be able to provide a data dictionary of the data?

What is the data dictionary to be used for?

Can you provide any detail on the amount of data being migrated?

Does all of this data map to sections within the proposed new system? If so, please describe how. If it does not map to a section within the proposed new system, how does the government wish to handle that data?

Does inventory relate to gun inventory as mentioned in 1.9.8?

Answer:

The reference to databases in Section II were background purposes. The current contractor will be responsible for formatting data to meet the new system requirements. The new system does not have to be structured in the same manner.

Are these all unique databases? Yes.

What format will the data be provided? The current contractor will be required to export data in a format that will allow the vendor to import into their system. For example, data fields can be provided in CSV format, and documents can be provided as standards documents in appropriately organized folder structure with supporting metadata in CSV files. The system should be capable of meeting data migration requirements as outlined in Section 12, 1.11.

How are the documents stored and associated to the case files? They are stored in “Varbinary” format in the SQL Server Database, but can be exported.

Will someone familiar with these datasets be available to assist in mapping the data?

The current contractor will available to assist.

Will you be able to provide an example of the data sets? Yes, once the contract has been awarded and an agreed upon format has been established.

Will you be able to provide a data dictionary of the data? A description of all fields and associated relationships can be provided.

What is the data dictionary to be used for? It will be used to better understand how OIG’s data is stored to aid in discussions about reporting, potential future enhancements, and the ability to migrate data at contract end.

Can you provide any detail on the amount of data being migrated? See Question 40.

Does all of this data map to sections within the proposed new system? If so, please describe how. If it does not map to a section within the proposed new system, how does the government wish to handle that data? See Question 37.

Does inventory relate to gun inventory as mentioned in 1.9.8? Yes.

80) In reference to Attachment A Scope 1, “Provide COTS case management software (CMS) that meets the objectives listed in Section XII and that is customizable by non-information technology personnel,” we consider our solution to be configurable by non IT personnel. We consider customizations to be in the form of software modifications.

Software modifications are only allowable through us. Is your intention that you are just wanting configuration through menu driven or similar options for the non IT staff? We just want to make sure we are clear about the different between customization (programing changes) and configuration (menu driven).

Answer: See Question 46.

81) In reference to Attachment A, Section III.5 – Does the public facing hotline website fall outside of the FedRAMP requirement?

Answer: Possibly. If the site is hosted on the Government’s server then it would fall outside of the FedRAMP requirement as the system is internal to the Department’s network and already has a standard non-FedRAMP accreditation.

82) Are there any additional security requirements outside of obtaining and maintaining the FedRAMP requirement?

Answer: Security requirements are outlined in Section XI and Section XII.

83) In reference to Attachment A, Section VII: “Any contractor personnel who has access to the investigative data or administrator level access to the database or the case management system is required to have and maintain a 6c, or above, public trust clearance (noncritical-sensitive ADP) and provide documentation to the COR prior to start of the project.”

There is work to be done before there is case data. Are the clearances only needed once there is case data in play?

Answer: Contract personnel must have required clearance before receiving access to Government data or systems.

84) In reference to Attachment A, VII: “required to have and maintain a 6c, or above, public trust clearance (noncritical-sensitive ADP) and provide documentation to the COR prior to start of the project” Are DoD clearances (Secret and Top Secret) considered above the 6c requirement? Can those individuals be excluded from this requirement?

Answer: ED/Personnel Security should be able to obtain reciprocity for contract personnel with a 6C or higher clearance.

85) Is it reasonable to assume that we only have to support operating systems, browsers and Office products still supported by Microsoft or other vendors? ( In reference to Attachment A, Section II)

86) In reference to Attachment A, IV: “as well as any customization or minor development work necessary to meet all requirements”, how will the government ensure that requirements not envisioned by the contractor are not created post award? We want to make sure that since this is a FFP contract that the government does not engage in scope creep and would like to understand how the government will ensure that doesn’t happen.

Answer: All requirements are listed in the SOO, and if any issues arrive that the vendor believes are outside the scope of the contract, the vendor should raise these to the Contracting Officer.

87) In reference to Attachment A, III.4: “support from previous contractor”, what will be the level of support to be provided from the previous contractor? And what format will they be able to provide the data in? Will we have any responsibility of connecting to the legacy system, or will all work in the old system be the responsibility of the previous contractor? If we will have a requirement of connecting to the legacy system, how will access be provided, and what tasks are expected to be performed?

Answer: The new CMS will not connect with the old system EDITS. See Question 37.

88) In reference to Attachment A, III.3: “Provide a hosting environment during development and configuration of the CMS”:

Since this will not involve real data, is it envisioned that this development hosting environment will be FedRAMP accredited? If the FedRAMP process will be occurring in parallel, this would delay the project.

Answer: No. The development hosting environment does not have to be FedRAMP accredited.

89) In reference to Attachment A, IV: “Help desk support for admins”, is this just related to the CMS? What is the type of support needed? Our help desk is generally staffed 8am- 5pm EST. Is that sufficient for this requirement?

Answer: See Question 16. OIG expects to have 2, and at most 3 personnel who would have administrative rights and would be authorized to contact the vendor for support. The envisioned level of support includes the following: hosted server communication problems, application errors/failure, and occasional assistance with more complex configuration issues that the administrators cannot resolve without guidance.

90) In reference to Attachment A, IV: “meetings at ED HQ”, how many trips are envisioned?

What would be the duration of these trips?

Answer: Limited in-person meetings are anticipated in DC. These would primarily be meetings with the current contractor where it is necessary to view data to assist with the migration of data. One trip to DC will also be required to obtain PIV cards (for those individuals requiring them). General program meetings can be handled remotely.

91) In reference to Attachment A, IV: For travel, we generally account for travel time. Will this be compensated for trips that were not envisioned?

Answer: This is a firm fixed price contract with no provision or line item for travel.

Any necessary travel outside of the Washington, DC offices, such as a field office, will require approval prior to travel taking place.

92) In reference to Attachment A, IV, are there any requirements other than for meetings that would require travel to an ED facility? i.e.: clearances, PIV cards.

Answer: Personnel requiring a PIV card will need to obtain it in DC.

93) In reference to Attachment A, X: “The contractor must ensure that the government retains access and download capability of all data for research, investigation, transfer, or migration to other systems.”: Can you provide more details on this requirement? How long does data need to be made available outside of periods of performance? How will the contractor be compensated for continued access if hosting has lapsed? Would the FedRAMP requirements need to stay in place during this period?

Answer: The purpose of this requirement is to ensure that the contractor provides the Government access to all data during and at the end of the performance period, not beyond.

94) Attachment A, XI. b: “with a minimum of two data center facilities at two different and distant geographic locations”, is the requirement for data in two locations? Is that referring to backups of the data, or real time data redundancy?

Answer: If the primary data center is completely destroyed, the vendor must be capable of restoring services at another data center per 1.14.4. This is the intent of this requirement. See Question 132 for additional information.

95) In reference to Attachment A, Section XII 1.4 Hotline Website:

Does the government prefer to host this? If they host, what level of access would we have to maintain the site?

Is the .Net/ColdFusion requirement fixed?

Is the public facing website need to be a full website, or just the intake form?

If a full website, could you provide more details?

What fields would you want prepopulated?

1.4.7 “Information collected from the hotline website must automatically and expeditiously be securely transmitted to the CMS and populate the appropriate fields in a new complaint record. The hotline website must not retain any user data.” – We would not recommend allowing a form to have access to submit directly into the CMS. We would recommend allowing the CMS to reach out and grab the data from the hotline website periodically, would this be an acceptable solution?

We propose having an intermediary server to accept posts from only the hotline website.

The intermediary server would allow CMS to reach out to it to pull in submissions. No server would have access to push data to the CMS server.

Answer: The Government prefers the hotline webpage be hosted on the Department’s server. In this situation, the vendor must assist the government with any information necessary to update the current accreditation, but the vendor would have no responsibility for operating or maintaining the server or server software--only addressing problems with the web pages/code created by the vendor (see question 50 ref .Net/ColdFusion). However, at its option, the vendor may host the hotline on its own server, but them it must fall under FedRAMP (see question 50). The hotline will consist of multiple pages, necessary to provide limited instructions and to gather all information from the person submitting the complaint.

It complaint form will be structured similarly to the form on DoD OIG’s website (https://www.dodig.mil/hotline/submit_complaint1a.cfm). However, it will be limited to this purpose (no additional pages, etc. will be required). Generally, the information collected by the hotline site that has a corresponding field in the database should be automatically ported into the corresponding field within the CMS; however, the remaining fields will be combined and ported into a single summary field. The intermediary server proposal stated would be acceptable as long as the intermediary server is located within the Agency Information System Authorization Boundary. If the hotline is hosted on the Department server, it would also be permissible for the hotline to temporarily (not to exceed 5 minutes) store a hotline complaint in encrypted form and have the CMS reach out and pull the data into the CMS.

96) Should a test server be available in the solution for the agency to view and approve upgrades before they get released on their live server? Can this server reside in the FedRAMP authorization boundary?

Answer: Once the system if fully operational, the only updates to the system under this contract should be standard upgrades/patches tested by the vendor and being distributed to all customers who use the product (No Education OIG-specific upgrades). While approval would be required prior to any upgrades, it is not essential (but permissible) to have the patching occur on a test server. However, appropriate backups/snapshots must exist to enable restoration of the system to the https://www.dodig.mil/hotline/submit_complaint1a.cfm same condition prior to the upgrade should problems be identified. The server can reside in the FedRAMP authorization boundary.

97) In reference to Attachment B: Past Performance, is there number of references desired?

Answer: See Question 30.

98) For the Technical Approach section, does each objective have to be written in our corresponding table or, based on the example given on the first page of Attachment B, can the numerals suffice (i.e. 1.1.6)?

Answer: Numerals are sufficient. See Question 20.

99) We intend to use MSSQL TDE (data at rest encryption), and Microsoft encrypted volumes to meet the encryption requirements. Does the agency object to this technical approach?

Answer: No, so long as FIPS Mode is enabled.

100) In reference to Attachment A, XII 1.1.1, what is the level of support envisioned?

Is there a cap on the number of support calls/tickets?

See Questions 16 and 90. The vendor can specify any limit/cap on number of support calls, and this will be evaluated as part of the best value for the Government.

101) In reference to Attachment A, XII 1.2.1 “easy to use graphical user interface,” is a web based system preferred?

Answer: Yes. See Question 58.

102) How will the contractor be notified if the baseline to user workstations changes?

Who will be responsible to ensure that the system is compatible with new baselines?

How frequently do the workstation baselines change?

Answer: The Government will notify the contractor. Prior to changes to the baseline system used by Government personnel, the contractor responsible for the Government computers must ensure that all current applications will operate under the new baseline, and the Government verifies this in a Department test lab prior to deployment. Systems are upgraded every 3 years. There are only rare major changes to the baseline during this period.

103) Is there any requirement to access the CMS from outside of the government issued laptops?

Answer: The laptop is the primary tool, but access from the OIG’s Citrix server is also needed.

104) In reference to Attachment A, XII 1.1.15 “clear the logs,” what logs are you wanting to clear? Do you mean archiving the audit logs?

Answer: Yes, audit logs. The requirement is related to restricting the ability to delete logs.

105) In reference to Attachment A, XII 1.1.7 – “any temporary files stored on the server must be encrypted”, which server? Do OS temp files need to be encrypted, or just CMS data files?

Answer: Yes, any data file, to include temporary files written to the drive, which may contain sensitive information must be encrypted.

106) In reference to Attachment A, XII 1.2.6 “supports data validation,” what level of data validation is required?

Answer: Standard data validation to minimize inadvertent data entry errors. For example, checking data entered for an investigative activity to ensure a future date was not entered, not allowing a 4 digit zip code to be entered, or ensuring that a social security number has 9 digits.

107) Attachment A, XII 1.3.3 “It is preferred that the case number be maintained as case changes from a preliminary to an investigation”: Would it be acceptable if the case number were not maintained as long as parent and child relationships were linked and visible within the CMS?

Answer: It would be acceptable and would meet the requirement. The preference, however, is that the case number be maintained when a preliminary is converted to an investigation, with the exception of a type indicator (e.g., “-I” for an investigation, “-P” for preliminary inquiry).

108) In reference to Attachment A, XII 1.3.22, could you provide more detail on attaching documents to other documents?

Answer: OIG personnel frequently write investigative documents that have attachments. For example, an agent may write a memorandum of interview that has a rights advisement as an attachment. The requirement is for the system to have a mechanism for how documents are uploaded that makes it clear to another person review the file in the CMS that the rights advisement document is an attachment to that specific MOI. By way of example, after a document is uploaded in EDITS (current CMS), the system has an option to upload attachments to that document. If the system assigned a unique document number of 10 to that document, the first attachment is given a document number of 10.1, clearly indicating it is an attachment to document 10. This requirement may be achieved by other means, but there should be a clear way to easily identify all of the attachments to a particular document.

109) In reference to Attachment A, XII 1.3.23, would you want a review process before data was deleted?

Answer: Yes. The deletion would be initiated by the OIG. The Statement of Objective has been updated.

110) In reference to Attachment A, XII 1.2.11 “should prevent duplicate entries” – Our system allows distinct entities to be entered, but correlates/links them together. This allows the CMS to preserve historical records from old cases. Do you not want to preserve the historical records?

Answer: This is permissible. The objective of this requirement is to prevent each agent from re-entering the same information multiple time for the same person or organization if the information is identical. If the entity already exists, the agent should be able to easily identify and select that existing entity and simply have the option of updating information that may have changed (e.g., address). It would be desirable to maintain the historical records for items that have changed.

111) In reference to Attachment A, XII 1.3.10 “create entities, associate them with a case” – Our system allows entities to be created by linking them in a case. Would entities be created outside of a case?

Answer: Generally, no. Most entities are created within the case; however, they must be accessible for other cases. There are some entities, such as those outlined in 1.2.8, that would be created outside of a case, but these would be imported lists for specific lookups. The Statement of Objectives has been updated on 1.2.8 to reflect only active schools, which reduced the list from 51,200 records to approximately 21,349 records.

112) What is the government willing to allow for maximum liability exposure of the contractor under this procurement? We would propose a trailing 6 months of revenue from the contract.

Answer: Liability stops at Government acceptance unless there are latent defects in the system that could not be found at time of acceptance. We do not know what is meant by a trailing 6 months of revenue.

113) Can DoED confirm that the successful bidder for solicitation number EDEFCM16Q0001 will not be conflicted out of performing work outside of OIG at the Department of Education as a result of the case management support?

Answer: The Department of Education does not control other work performed by successful offerors outside of OIG.

114) Does the agency have any COTS product in mind?

Answer: We are interested in evaluating any COTS product that meets, or can be updated by the contractor to meet, the requirements in this solicitation. The OIG desires to pick the product that best meets its requirements and has the best value.

115) In reference to Attachment A, XII 1.5.9 “Locking a case to prevent further editing” – What events would cause a case to get locked?

Answer: The region submitting the case to headquarters for closure review. The case being closed by headquarters. The purpose of locking would be to prohibit users from adding documents or completing fields in the case after quality control activities by headquarters have been completed.

116) In reference to Attachment A, XII 1.6.13 – Does the agency have a number of specific reports that should be included in this proposal? If not, should the contractor propose a limit?

Answer: We do not anticipate more than 10 common reports; however, some of the reports have multiple queries to generate the information to be incorporated into the report. This would be in addition to the ad-hoc reporting capabilities described in 1.6.12.

117) For the FedRAMP requirement, does the government understand that the initial and ongoing costs of maintaining FedRAMP compliance are significant and that we would have no choice but to pass along such costs as part of this procurement? Does the government have an expectation that the contractor must absorb any or all of these costs?

If so, how does the government propose that the contractor capture these costs for reimbursement?

Answer: This is a firm fixed price contract, and the vendor is required to obtain/maintain FedRAMP for the period of performance. The contractor must incorporate appropriate costs into their proposal.

It should be noted that the FedRAMP model of ‘do once, use many times’ actually removes a barrier to entry for small businesses to work with federal agencies.

Instead of CSPs having to expend…