Attachment_1_-_Q&As.pdf

Attachment 2

June 18, 2018

Joint Service, Cloud-Hosted Estate Planning Software (JS-CHEPS)

Page #

Section, Paragraph, or Attachment

Question/Comment/Clarification

Statement of Objectives (SOO) Questions

Page 3 III.7 Given that the client website is no longer a required feature, we suggest that this requirement be removed.

RESPONSE RESPONSE Requirement to be modified to delete smartphones and tablets. Client side, if offered should have tablet access.

Page 3 III.8

Does the government intend to require a web application solution for the attorney and administrator functions? This is not recommended given the requirement to integrate with MS Word (Section III.17). Integration with MS Word requires the installation of MSI version of Word. Use of a VDI solution may alleviate this requirement but would still require installable application software (e.g. CITRIX Receiver). We suggest the restriction on “installable application software” for attorneys and administrators be removed.

RESPONSE RESPONSE Government still discussing and updating SOO as necessary.

Page 6 III.19 This Section refers to permission-level for clients. To what extent is it anticipated that client will have access to the drafting system?

If none, then we suggest removing this permission-level.

RESPONSE RESPONSE Client access will be limited to Client-side system, if offered.

Page 10 III.34 Please identify the Recovery Time Objective and Recovery Point Objective in support of the COOP requirement.

RESPONSE RESPONSE Government update SOO to reflect requirement.

Page 10 IV.2 Given that the cloud hosting environment is already FedRamp certified and virtually separated from the software application and data by VPC, what is the IT security requirement for the software application: ATO or System Test & Evaluation?

RESPONSE RESPONSE ATO

Page 10 IV Will the service provider be required to provide an Information System Security Officer (ISSO) for the system?

RESPONSE RESPONSE No

Page 10 IV Can you describe any reporting requirements?

RESPONSE RESPONSE Not currently needed.

Page 10 IV.2 Please describe the PKI integration requirement for software applications.

Joint Service, Cloud-Hosted Estate Planning Software (JS-CHEPS)

Page #

Section, Paragraph, or Attachment

Question/Comment/Clarification

RESPONSE RESPONSE Application must authenticate using PKI Certificates.

General General

In addition to Technical Support, it is our experience that attorneys find it helpful to have access to legal content support, in the event that questions arise relating to particular provisions in a document, or particular options within the system. We recommend that the Services consider adding legal content support to the SOO, as a requirement or preferred feature. If added to the features of the system, please address whether the Services would expect such legal content support to be included in the license fee for the system, or would expect to purchase legal content support on a "per incident" basis.

RESPONSE RESPONSE This is not needed.

General General How does the government anticipate allocating the shared responsibilities imposed by GDPR between the government and the vendor?

RESPONSE RESPONSE The GDPR does not apply to the US Government and we do not require compliance with the GDPR. The United States is a sovereign nation and the EU does not have authority over our systems.

3 III

Will AFLOA consider leveraging a CSP PaaS offering with DISA Impact Level 4 Provisional Authoritization with a partner app layered on top that runs native on the platform, but does not currently have it’s own FedRAMP evaluation? If not, would AFLOA consider an Impact Level 4 PaaS/SaaS offering with additional capability configured on top to provide specific requimenets not already provided by the SaaS offering?

RESPONSE RESPONSE Solution must be SaaS.

4 III Since the CC SRG requires CAC/PKI credentials for authentication for IL4 data, should we assume mobile users have the ability to use CAC, or will they use derived CAC certs?”

RESPONSE RESPONSE Deleted requirement for mobile users in SOO.

10 IV Per Section 5.5.1 of the CC SRG “DISA will evalaute the CSP’s usage of commercial equivalencies (e.g., CIS benchmarks) on a case by case basis.” Salesforce leverages a combination of STIGs and CIS benchmarks. Is this acceptable?

RESPONSE RESPONSE It is acceptable so long as it satisfies DISA requirements.

10 IV Will AFLOA consider third-party digital signature solutions with FedRAMP Moderate ATO?

RESPONSE RESPONSE Do we really need digital signatures?

10 IV Does the requirement for clearances apply to commercial CSP staff or to contractor staff managing the system?

RESPONSE RESPONSE

Contractor staff managing the system?

Joint Service, Cloud-Hosted Estate Planning Software (JS-CHEPS)

Page #

Section, Paragraph, or Attachment

Question/Comment/Clarification

3 7 The intent to be displayed on standard web browsers and tablets seems applicable. The ability to display and manipulate a complex drafting solution on a smartphone seems to stretch the use case. Please describe if the Services truly intend on preparing and manipulating documents with a smartphone.

RESPONSE RESPONSE Requirement modified to delete smartphone.

3 8 The intent to be a SaaS only offering seems to neglect the need of the Navy, who we understand will need offline access. This may be true for all Services. Please confirm.

RESPONSE RESPONSE UNK

5 13 This is a Preferred [P] item. Will the services accept an optional third-party data reporting partnership to fulfill this portion of the requirement, and to have this third-party relationship priced separately, and not part of the primary response costing?

RESPONSE RESPONSE Pricing for feature, if provided must be reflected in license price in year provided and forward rather than being separately priced.

6 19a

Industry standards don't typically provide end users or "Clients" -- i.e. service personnel a plan is being drafted for -- to have access to the "decision tree" system. The reason being, a decision tree system has many cascading values which impact the rest of the document (and may have unintentional tax consequences). By providing Client access to the system, the Services are entering into a territory that established estate planning professionals do not entertain or promote.

RESPONSE RESPONSE Modified to clarify that client access is only to client-side system, if provided.

6 20 Data analytics is considered a Preferred [P] item. Will the services accept an optional third-party data reporting partnership to fulfill this portion of the requirement, and to have this third-party relationship priced separately, and not part of the primary response costing?

RESPONSE RESPONSE Pricing for feature, if provided must be reflected in license price in year provided and forward rather than being separately priced.

7 20f With respect to tracking of time spent on drafting as well as with clients: Is this expected to be passive tracking or active tracking?

For example, is the requirement to provide a means for attorneys and paralegals to track their time by entering the relevant data or is the system expected to track active use of the software?

RESPONSE RESPONSE

Passive. Preferred Cat. 2 (P2) 3.f.

Whichever one means it does the tracking on its own.

7 21b We have a 20-year successful track record in the commercial space with over 6,500 firms utilizing our services. To date, we have not had a request for 508 or vision impaired considerations. Is 508 compliance mandatory right out of the gate, or will the Services accommodate 508 compliance during the implementation and configuration of the project?

RESPONSE RESPONSE Compliance with Section 508 of the Rehabilitation Act of 1973 is required by the end of the integration period.

Joint Service, Cloud-Hosted Estate Planning Software (JS-CHEPS)

Page #

Section, Paragraph, or Attachment

Question/Comment/Clarification

8 27

Allowing Clients to fill out information online to be populated into an estate plan has a lot of attention in the estate planning community. However, there is a large debate as to how much information a client should provide online. That is due to the cascading effect of information and potential tax ramifications. The general consensus is for Clients to fill in basic information only (i.e.

Names, Birthdates, etc.). Have the Services thought through the ramifications of this requirement, and determined how much information they intend to collect as part of the Client intake process?

RESPONSE RESPONSE Information gather on our wills worksheets that our clients currently use.

9 28 It is assumed that the DoD will sponsor and approve this request for a Client-side portal hosted by a commercial entity?

RESPONSE RESPONSE The Client-side must be FedRAMP IL4 and meet all requirements

9 29a The typical retrieval method of estate planning attorneys (in the commercial space) is the usage of a "Matter Name". Do the Services truly intend to circumvent this strategy and ask for a COTS tool to implement a DoDIN number instead? (This seems contrary to a COTS tool selection process.)

RESPONSE RESPONSE DoDIN is not required. Offerors may propose any reasonable retrieval method provided that it does not rely on SSAN.

9 29c

The earlier requirement of having a Client enter information (see 27) and the practicality of only collecting basic information (i.e.

Names, Birthdates, etc.) seems to conflict with the requirement to delete Client entered data after 6 months, yet still maintain client profile data.

Additionally, the back-end data tagging of "client entered" versus attorney entered data for the purpose of purging data is cumbersome and costly (not to mention impractical for a COTS acquisition). Are the Services willing to foot the cost of these modifications, or are they open to discussing the true need of this requirement, and finding other practical solutions?

RESPONSE RESPONSE

- Client profile: A client will be able to create a profile that contains his/her chosen user name and password. From this profile, the client can access/re-access client entered data “worksheet.” Client profiles will be maintained forever. This will allow us to track analytics per profile, such as number of documents created etc.

- Client entered data: This will include all basic information that we collect as part of our current wills worksheet. This information will ideally flow from the client side website into the attorney side and will automatically populate into the documents being created. Client entered data will be purged after 6 months of no logins on the client profile.

- Variables: Once the actual documents are created, they should be saved as is (no requirement to purge client entered data only, as it is currently written). The question we need to answer ourselves is how long do we want to keep these documents? Forever? Or do we just want to make sure the analytics are tracked and the documents themselves should be purged after a certain amount of time?

Joint Service, Cloud-Hosted Estate Planning Software (JS-CHEPS)

Page #

Section, Paragraph, or Attachment

Question/Comment/Clarification

9 30

Again, from what is commercially done, it is rare for clients to be granted access to the system responsible for drafting their estate plans (due to the cascading nature of selections and potential tax ramifications). To provide a Client with direct access is not advisable. Typically, an estate planning attorney may provide client access to a repository of completed (PDF) plans for retrieval and review.

Please clarify the intent of this requirement, and the applicability of finding more practical (and advisable ways) to address.

RESPONSE RESPONSE Client-side only, if offered. Basic information (as defined).

9 32

Per previous conversations, if a Client-side portal is created -- only a minimum amount of basic information should be collected (i.e.

Names, Birthdates, etc.) Expectations should be set accordingly that Client-side support is NOT attorney or legal advice support but restricted to only technical issues.

Please confirm.

RESPONSE RESPONSE Client-side support is for technical issues only.

11 2d Reporting analytics may be difficult in disconnected environments. Please provide more information, and a confirmation of the specific analytic requirements that exist

RESPONSE RESPONSE The Air Force does not currently require this. However the Navy does. Navy would like to see the amount of time (hrs) spent on writing these documents, how many documents are written each year, and any other pertinent information that can be obtained.

General General

As indicated by numerous vendors in the pre-solicitation call, there are few individual firms that can provide all of the services as described. Are the Services taking this into consideration, and expecting line item costs for each of the elements that make up this solution (i.e. software, hosting, integrated services, COTS enhancements, support services) -- or are they looking for a consolidated proposal?

RESPONSE RESPONSE A consolidated proposal is required. Teaming and/or subcontracting arrangements are welcomed. Payment will be made to the named contractor in accordance with contract terms.

General General Would the United States Air Force consider a non-cloud based solution?

RESPONSE RESPONSE No. Requirement is for a SaaS solution.