RFI EOP-OA-RFI-2026-09_18_ Questions and Answers.xlsx
XLSX spreadsheet 19 KB Posted
- Solicitation number
- EOP-OA-RFI-2026-09
- Issued by
-
Executive Office of the President
About this file
This file is a Questions and Answers document providing responses to inquiries submitted by industry stakeholders in response to the Executive Office of the President (EOP) Office of Administration Information Technology (OAIT) Request for Information (RFI) regarding an internal e-commerce and supply inventory solution for office supplies. The document does not contain substantive information about specific products or services required, procurement terms, or award details, as it serves solely to address clarifying questions from potential respondents. Amendment 01 extended the RFI response deadline to September 28, 2026 at 11:00 AM EDT. This RFI is a Special Notice and information-gathering tool only; no formal solicitation or Request for Proposals has been issued at this time, and this is not a procurement opportunity requiring proposals or pricing submissions.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Request for Information_EOP-OA-RFI-2026-09.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Q&A
| # | RFI #EOP-OA-RFI-2026-09 - Questions/Comments | Government Response |
| 1 | Existing systems: What current systems manage the product catalog, inventory, pricing, account strings, funds certification, fulfillment, and financial posting? | In-house .NET app supports product catalog, inventory, pricing, fulfillment, and account strings. Account strings are associated with Component Offices. In the current system they are appended to Office names. Some Components have 2 Offices, other Components have 15 Offices. All other financial information is stored outside of e-commerce/inventory system. |
| 2 | System of record: Which system should be authoritative for products, prices, stock levels, orders, approval status, and delivery status? | The new internal e-commerce and inventory system for office supplies (Supply Store) would be a new system of record. |
| 3 | Inventory scope: Does “inventory system” require real-time stock-on-hand, reservations, replenishment, receiving, adjustments, cycle counts, and low-stock alerts, or only catalog and order administration? | The Supply Store system should have real-time stock-on-hand information, reservations (orders), and display low-stock alerts to the Requesters. |
| 4 | Funds certification: Is funds certification performed by the named component approver, a separate certifying official, an external financial system, or some combination? | Funds are reviewed in the external system by Component Approvers. |
| 5 | Approval model: Is there exactly one approver per component, or must the solution support multiple levels, delegated approvers, alternates, escalation, and temporary substitutions? | Couple of approvers per Component. |
| 6 | Ordering channels: Does “single ordering channel per component” mean a logically separated queue and catalog experience, or strict data segregation between components? | Logically separated queue, where a White House Office (WHO) will see only notebooks with WHO logo, and Office of the Vice President (OVP) will only see notebooks with OVP logo. Both offices will see same pens available to them. |
| 7 | User licensing: Please clarify “1,000 non-named users.” Does this mean concurrent, occasional, shared-device, or otherwise non-dedicated users, and what is the anticipated peak concurrency? | Peak concurrency - 500 users access system per month. 1,000 users means that if a user #999 leaves, the new user would be able to take their license. |
| 8 | Deployment preference: Does EOP prefer cloud SaaS or on-premises Kubernetes? What security authorization, network connectivity, and operational requirements apply to each option? | There is no preference between cloud and on‑premises solutions. We require a role-based access control system with Single Sign On (SSO), US-based servers (if cloud). |
| 9 | US-based servers: Does this requirement apply only to data storage, or also to processing, backups, disaster recovery, administration, and support personnel? | Data storage should be within Continental U.S. |
| 10 | Entra ID data: Which required attributes are available and reliable in Microsoft Entra ID, particularly component, approver, building, floor, room, and phone information? | These attributes are available in MS Entra. |
| 11 | Must users see real-time item availability before ordering, and may they submit backorders or substitutes? | No backorders should be available. |
| 12 | Are quantity limits calculated per order, per calendar day, rolling 24-hour period, user, component, or recipient? | Quantity limit, per order, per calendar day, per $ amount for a total order, with super users who could order above maximum. |
| 13 | When an override occurs, must the approver or administrator provide an override reason and should it be separately reported? | No separate reporting is required. |
| 14 | Can one cart contain items charged to different account strings, recipients, delivery locations, or components? | One cart to one account string, one recipient, one location. |
| 15 | Are order changes and cancellations permitted after approval or after submission to the Supply Store? | No changes are permitted after approval. |
| 16 | What fulfillment statuses, service targets, escalation rules, and delivery confirmation evidence are required? | Just the Delivered status is sufficient. |
| 17 | Are product images the only attachments, or must requesters and administrators upload supporting documents? | Product images only. |
| 18 | Must the system support delegated “on behalf of” ordering, and what permissions and audit information are required? | The system must support delegated ordering. Anyone can order on behalf of another within their Component. Audit will state that Jane Doe ordered on behalf of John Smith. |
| 19 | What reports are required beyond the example component/date-range report, and which must be available in real time? | Components, Offices, and Approver Assignments change often and government administrators should be able to easily change them (Add, Remove, Revise). |
| 20 | Is Excel output required in addition to structured CSV? | CSV is sufficient. |
| 21 | What retention period applies to orders, approvals, catalog changes, exports, and audit records? | At least four years. |
| 22 | Are records-management schedules, legal holds, FOIA discovery, or archival integrations applicable? | Not at this time. |
| 23 | What data classification and security impact level apply to the system? | None at this time. |
| 24 | Are accessibility requirements such as Section 508/WCAG conformance mandatory, and is formal accessibility testing required? | The system should be 508-compliant. |
| 25 | Must audit and security events be forwarded to an existing SIEM? If so, which platform and event requirements apply? | Not at this time. |
| 26 | Are vulnerability scanning, penetration testing, software supply-chain evidence, or continuous monitoring deliverables required? | Vulnerability scanning, penetration testing, and continuous monitoring are essential activities for any cloud solution. Specific deliverables are not required by EOP. |
| 27 | Is historical catalog, order, user, or inventory data expected to be migrated? If so, what volume, format, quality, and retention period apply? | All data should be available for download. All data should be retained for the 4 year period. |
| 28 | What environments are required: development, test, training, staging, production, and disaster recovery? | Production and Test. |
| 29 | What availability, recovery-time, recovery-point, backup, maintenance-window, and support-response objectives apply? | The system should have an availability of 99.9%. System support should be available within 1 hour during business hours. |
| 30 | Should the ROM include infrastructure, third-party services, data migration, security authorization support, training, and ongoing operations? | Data migration should be easily done by an EOP government system admins. Training hours should be minimal as the system should be user-friendly and intuitive. |
| 31 | Is there a desired implementation deadline or phased MVP target? (The document notes that the current 10–16 week estimate is an internal assumption, not an RFI requirement.) | MVP target should be January 2027. |
| 32 | Are there required acquisition vehicles, socioeconomic preferences, or restrictions beyond the requested identification of GSA/GWAC availability? | None at this time. |
| 33 | Will there be opportunity for a 20-minute capability discussion? | If your solution is of interest to EOP, we will schedule a web discussion. |
| 34 | Can you confirm the source of the catalog SKUs, product details, images, and pricing? Will EOP provide this data directly, or will it come from cooperative contracts and/or multiple suppliers? | EOP will provide this data directly. |
| 35 | If multiple suppliers are involved, how are units, rates, and pricing updates managed today? | Manually by system admin. |
| 36 | How frequently do you expect catalog content and pricing to be updated? | Each week of the year. |
| 37 | Does each catalog entry need to support multiple purchasable units of measure (for example, single unit vs. a 12-pack), or is each line a fixed unit? | The items can be sold per kit, per box, per bundle, per dozen, per item, etc. |
| 38 | How does OAIT plan to maintain the catalog going forward: bulk import, manual entry, or vendor-fed data? Who supplies product images? | Bulk import 1st, then either bulk import or manual entry should be available. Supply team obtains product images. |
| 39 | Can you clarify the item-status workflow you need to track? For example: fulfilled, partially fulfilled, received, partially received, backordered, or pass-through. | 1. Ordered. 2. Waiting for Approval. 3. Waiting for Supply Team. 4. Pending Delivery. 5. Delivered. 6. Denied. |
| 40 | Are there specific delivery-routing requirements, including multiple delivery locations or recipient-level tracking? | No specific delivery-routing requirements. Single location for each order. |
| 41 | Do you need inventory quantities to update in real time, or is periodic/bulk updating sufficient? | Update in real time is required. |
| 42 | The RFI references 1,000 non-named users alongside RBAC and SSO. Will each requester have an individually provisioned SSO account, or will a smaller group of named users place orders on behalf of others? | Each Requester will have an individual SSO account. |
| 43 | Is approval routing needed only at the component level, or does OAIT need visibility/approval scoping below that, such as by division or supervisor group? | Approval is required only at the Component level. |
| 44 | Which identity provider and federation will authenticate users (for example Login.gov, an Okta/ICAM broker, or Active Directory Federation Services), and will PIV/CAC be presented directly or through a federated broker? | Microsoft Entra ID. |
| 45 | What information should requesters provide when placing an order, beyond the reason for purchase and fund/source? | Requester selects Name (self or other)/Component’s Office(with the accounting number) and either types or system populates Building 2 /Floor 3 / Room 305/Phone numbers, enters delivery instructions and justification. The system should remember information that was previously entered by Requester. |
| 46 | Are approvals and spend controls expected to vary by fund, department, item type, or order value? | Each Component will have their own Approver(s). Spend control is performed by Approvers. |
| 47 | For per-product order limits with approver or admin overrides, do exemptions apply to individual named users, to defined roles/groups, or both? | The exemptions should be applied to individual users or groups. |
| 48 | Are there any required integrations or downstream systems for order, inventory, or fulfillment data? | No integrations are required at this time. |
| 49 | For a cloud SaaS deployment, what security authorization baseline does EOP anticipate requiring in a future solicitation, including any FedRAMP authorization level, agency ATO, FISMA impact level, Section 508 conformance, data-retention, audit-logging, or continuous-monitoring requirements? | EOP will review the system and if finding it satisfactory, will issue an internal ATO. 508 conformance, data retention, and audit logging, are required parts of the system. As well as, |
Data Ownership and Control: Agree to EOP terms and conditions for protection of EOP data, including, but not limited to:
- EOP data remains the property of EOP;
- EOP data may not be shared with other applications, services, providers, or external parties without the written approval of EOP;
- EOP data must be returned to EOP and then purged (erased, destroyed, and rendered unreadable) from third-party systems within 60 days of the termination of the agreement with written documentation of destruction provided to EOP;
- EOP data may not be disclosed in response to any subpoena or legal process and any such requests must be redirected to EOP; and
- EOP data must be isolated from and not intermingled with data from other customers or external parties.
Roles and Permissions: Implement roles or permission levels so that users may be assigned only the access they need to perform their assigned functions (that is, least privilege).
Encryption: Enforce encryption for EOP data in transit and at rest.
| 50 | Please identify the anticipated Entra ID integration requirements, including SSO protocol, user and group provisioning, component and approver attributes, office-location fields, SCIM or API requirements, and whether EOP will provide the authoritative attribute mapping. | EOP will provide authoritative attribute mapping. |
| 51 | Does the required inventory capability include tracking on-hand quantities, receiving, replenishment, backorders, cycle counts, and warehouse locations, or is the intended scope limited to catalog administration, order routing, fulfillment status, and audit history? | The current scope encompasses catalog administration, ordering, order routing, fulfillment status, and audit history. |
| 52 | Are funds certification and account-string reporting intended to be workflow attestations captured within the solution, or must the solution validate funds and accounting data through an external financial or procurement system? If integration is required, please identify the target system and available interfaces. | Account string is captured with the name of the Office. See detailed explanation on item #64. |
| 54 | The RFI describes the requirement as a "CRM solution." Does the Government prefer a specific solution category (e-commerce COTS, service catalog, low-code workflow platform, or custom development), or should respondents propose the best fit for the requirements provided? | Please propose the best fit solution for the provided requirements. |
| 55 | Should "channels" in requirement (a) be interpreted as logical queues within the solution, or as a specific collaboration or ticketing platform construct? | Logical queue within the solution. |
| 56 | For the cloud SaaS option, must the solution hold an existing FedRAMP authorization, and at what impact level? | FedRAMP authorization is not required. |
| 57 | How often do component structures and approver assignments change, and must Government administrators be able to make these changes without vendor services? | Components, Offices, and Approver assignments change often and government system administrators should be able to easily change them (Add, Remove, Revise). |
| 58 | How often do ordering rules (per-product limits, justification requirements) change, and must administrators be able to update them without vendor involvement? | System Administrators (gov't employees) should be able to easily change per-product or $ limits. Justification requirements are added by Requesters before submitting supply orders. |
| 59 | Is the workflow described in Section C fixed, or must routing, notifications, and order statuses be configurable by the Government as policy evolves? | The workflow should be easy to modify if EOP's requirements change. |
| 60 | Does the Government anticipate and/or want the flexibility to extend the capability beyond office supplies, and should the proposed architecture and ROM account for that in follow-up phases? | Yes, separately from office supplies, you can provide an option for an inventory management system. |
| 61 | Does the named component approver also certify funds availability, or does certification involve a separate official or an interface to a financial system? | The named Component Approver(s) certify the funds' availability by reviewing information in the external system. |
| 62 | Is there a single approver per component, or must the solution support alternates, delegation, escalation, and higher-level approvals? | Multiple approvers per component. |
| 63 | Does "supply inventory" include warehouse functions (stock-on-hand, receiving, replenishment), or only catalog and order administration? | Only catalog and order administration. |
| 64 | Where does the "account string" originate (user entry, Entra ID, or a financial system), and must it be validated against an authoritative source? | Account string is added by gov't system admin to the Component's Office. As an example, WHO is a Component, DPC is an Office within WHO. Each Office has an accounting string. When the user signs into a system, by the virtue of their email the system recognizes their Component. If the user works in WHO their email would be user@who.eop.gov. Once the WHO DPC user makes an order, they need to select their office DPC -12345678, where 12345678 is an accounting string. WHO user will only see WHO Offices, OVP user will only see OVP Offices, etc. |
| 65 | Are orders immutable once submitted, or must the solution support modification and cancellation after approval? | If the orders were not approved, they could be cancelled by the Requester. If they were approved by Component Approver, the Requesters would need to email Supply Store team. |
| 66 | Could you confirm whether an international technology firm may respond directly, or whether participation requires a U.S.-registered prime? | Participation requires a US-registered prime. |
File details come from the government source that posted it. Updated .