Amendment 1 with QA.pdf

Food and Drug Administration RFI for Commercial Off-the-Shelf (COTS) Task Management Tool (TMT)

RFI no. FDA-RFI-2026-131587 Amendment 1

11/15/2025

Amendment 1

The purposes of Amendment 1 are the followings:

1) To provide answers to vendor questions.

2) To extend the response due date to 11/20/2025 at 5PM EST.

End of Amendment 1

Vendor Questions Government Responses

1. Which mission-critical processes or communications currently create the highest operational burden and what impact do delays have on public health or regulatory timelines?

This would be flushed out when the exploratory stage of the engagement is entered.

2. How does FDA leadership define a successful future state of enterprise task management?

FDA would define a successful future state in which recurring tasks and workflows have been templated, and FDA staff have fully adopted the tool. We anticipate that 60% of FDA process tasks are repetitive and 40% are ad hoc. Success would also show demonstrated reduction in time spent and an increase in efficiency.

3. What outcomes would demonstrate real transformation vs. incremental improvement?

Real transformation will be demonstrated by moving the 60% of repetitive FDA process tasks into a TMT. The use cases listed in the RFI would provide the highest impact if streamlined.

4. What metrics (beyond cycle time and compliance) matter most to the Commissioner and HHS stakeholders?

Efficiency in processes, shortened response times, ability to clearly and concisely address stakeholders concerns in a timely manner, greater transparency in our processes.

5. How do congressional inquiry workflows drive urgency and visibility into this requirement?

Congressional Inquries are highly visible, have short deadlines, and demand meticulous answers that must be vetted and approved internally. This is labor intensive and would benefit from a better management solution.

6. Who are the primary task creators vs. task responders and what percentage of the workforce falls into each group?

Task creators may only be around ~10% of the FDA would be creators and ~30% are task responders at one time. We are open to suggestions on the best licensing structure based on previous impimentation experience.

7. What are the major differences in maturity, culture, and workflow among FDA Centers that must be preserved?

CDRH - heavily staffed with engineers of all disciplines experts in a variety of FDA regulated devices CBER - highly advanced scientist specialized in biologics and advanced biotech CDER - advanced knowledge in drug approvals, new drugs, combination products, with strong existing processes in place.

CTP - Specialized expertise in tobacco regulated products and Electronic Nicotene Devices CVM - Specialized experience in veterinarian medicines and application for use HFP - Expert knowledge of human food rules, laws, regulations, labeling, working with state and tribal partners Cosmetics - Experts in cosmetic regulations, laws, rules, safe ingredients Inspections and Investigations and Imports - specialized experience in FDA regulations, enforcements, and import laws spanning across the interagency.

8. How important is “zero-training adoption” for rotating staff, contractors, and field agents?

Little to no training needed is preferred, or a train-the-trainer approach is acceptable.

9. What accessibility or mobile-first requirements are tied to field enforcement operations?

Necessary as a redundant function to ensure timely responses to tasks

10. How much process standardization is desired across Centers and where must variances remain?

This is highly desired, however there will be nuances basd on each commodities specific regulatory and statutory authorities.

11. Are there requirements to harmonize workflows across scientific, legal, policy, operational, and emergency domains?

Yes, these will need to be mapped and understood.

12. How will governance be managed to avoid workflow fragmentation as adoption scales?

The agency intends to have a team of employees stand in as a governance board to ensure timely and consistent implementation across FDA.

Questions and Answers for TMT RFI

13. Which compliance regimes (NARA, Part 11, FOIA, internal directives) create the greatest friction today?

Ensuring the agency meets NARA requirements is paramount, followed by timely responses to FOIA requests.

14. Where do approvals break down including content approval, decision authority, and digital signature availability?

Breakdowns typically occur at the final stages of review in the senior level immediate offices, due to bandwidth and shortened clearance times due to the review time taking the most space, and unclear decision authority at times.

15. How long should audit logs remain active before transition to the Records Archive Delivery System (RADS)?

These are dependent on the NARA records schedules.

16. What documents must retain chain-of-custody traceability from field inspection → legal action → public communication?

This would be flushed out when the exploratory stage of the engagement is entered.

17. Which systems must remain the single source of truth for documents, user identity, and operational data?

This will depend on the business process that is being managed.

18. How should SharePoint, Documentum, Teams, ServiceNow, Power Platform, and Salesforce roles evolve in the new ecosystem?

FDA uses role-based access for all systems. Groups are used to grant individuals the appropriate permissions to systems.

19. What is the expected direction for enterprise data lake usage including analytics only or operational integration?

Operational integration is prefered.

20. How critical is true federated search (cross-system visibility) vs. basic linked-record navigation?

FDA has integrates systems via connectors or APIs if two-way data is needed. All integrations must be approved by the Cybersecurity team and generally must stay with the FDA boundaries, which may limited a true federated search.

Navigation links are acceptable to view ancillary information such as regulations, etc.

21. Where could AI provide tangible mission acceleration including document synthesis, risk scoring, routing, and decision support?

FDA has inplemented Elsa as its inhouse AI tool. It is expected that Elsa will speed the compliation of needed information, prep the body of draft documents, and offer analysis.

22. What level of model explainability is required for regulatory defensibility? For general Chatbot functions, FDA staff use Elsa which is Generative AI Chatbot where the LLM’s are trained on publicly available information. Elsa is designed to assist in informing decisions and actions, not to make them. All regulatory outcomes, decisions, and enforcement actions must be determined by human experts.

23. Do you expect AI to automate congressional response first drafts or scientific review summaries in the future?

FDA has inplemented Elsa as its inhouse AI tool. It is expected that Elsa will speed the compliation of needed information, prep the body of draft documents, and offer analysis.

24. Which federal AI governance policies must workflow intelligence comply with? FDA conducts work in compliance with OMB Memo M2521, M2522 . The tool is required to comply with all federal policies, and will be required to align with Agency policies, too.

25. Is FDA expected to be the pilot agency for wider HHS adoption or will requirements originate cross-departmentally?

FDA would pilot the chosen tool internally using a small office, then hopfully expand FDA-wide. HHS adoption would come at a later time.

26. What is the anticipated concurrency load for emergency operations and regulatory surges?

The assumption should be supporting a high workload in an agency of 20,000 users.

27. How must licensing adapt when scaling from 20,000 (FDA) to 80,000+ (HHS) users? It is anticipated that FDA will focus on implementing the new tool enterprise-wide. Then HHS may wish to also adopt the tool and would most likely implement as Agencies and small OpDivs select to join in a rolling fashion.

28. Which operational constraints drive TCO sensitivity including licensing model, admin staffing, and integration costs?

Since integration costs tend to be one-time expenses, licenses would be the largest TCO component.

29. How important is minimizing external professional services after go-live? FDA would expect that once the tool is implemented and staff has been trained, the users would be able to implement future workflows internally, reducing the need for ongoing professional services to support the tool.

30. Does FDA want to centralize system administration or empower local office configuration independence?

FDA would prefer that once the tool has been implemented and adopted, that individual offices would be allowed to implement business cases on their own.

31. Which failure modes (data loss, access lockout, missed deadlines) would create the highest mission risk?

Data loss would be the largest failure of the tool. Access lockout of the tool would certainly affect the mission but the impact is isolated to that timeframe. Missed deadlines is highly undesirable.

32. What level of failover, load balancing, and degraded-mode operation are required for crisis response?

FDA believes it is the responsibilty of a FedRAMP Cloud Service Provider to manage a redundant system with failover, if a SaaS Cloud solution is chosen. If an on-prem solution is chosen, FDA maintains infrastrucure with failover and load balancing, and monitors for degradation.

33. How are change management and versioning controls currently governed across Centers and programs?

FDA has a Change Management process for all IT system updates, both on-prem and cloud-based. CRs are submitted, approved at a CCB, scheduled and tracked.

34. What workflows or Centers are expected to onboard first? The FDA ExecSec office under the COO is expected to onboard first as part of a pilot. Additional offices will then be rolled in.

35. How quickly should minimum viable value be realized including days, weeks, or months?

A minimum viable value should demonstrate savings of time and effort immediately upon implementing each workflow.

36. What future initiatives (digital clearance modernization, emergency readiness reforms) must this platform enable?

This would be flushed out when the exploratory stage of the engagement is entered.

37. Does the government anticipate the tool replacing any existing platforms, or augmenting current systems? If so, can you provide a list?

This tool is expected to eventually replace various internally developed spreadsheets, power apps and an Appian tool.

38. Can you provide a breakdown of user types for both the FDA Enterprise total user count of 20,000 and the HHS Enterprise user count of 80,000. Looking for the number of Admin users, Power Users and View Only Users?

While this is not currently known, it is reasonable to assume that there will be a potential of 90% View Only users, 10% Power Users, and perhaps 50 Admin Users across the Agency.

We are open to suggestions on the best licensing structure

39. Which compliance standards are required at minimum (e.g., FedRAMP Moderate, FISMA, Section 508, RMF)?

FDA requires FedFAMP Moderate for Cloud Solutions, FISMA, Section 508, and NIST 800-53 for ATO.

40. Is deployment required in a government-managed enclave, or are SaaS environments acceptable?

FDA requires either a FedRAMP Moderate Cloud Solution hosted by the vendor, or an on-prem FDA environment. Cloud is preferred.

41. Is the FDA looking for On-Premises licensing or FedRAMP SaaS licensing? FDA is open to either but prefers a FedRAMP SaaS solution.

42. Will the government provide API documentation for internal systems? FDA does not yet have all the APIs implemented that would be useful. Solutions would most likely need to be developed within FDA security constraints.

43. Should the solution support both inbound and outbound data synchronization? This is not yet fully known and probably not needed initially. The tool would need to have capability for future growth in this area.

44. Does the FDA prefer configuration over customization to minimize code maintenance?

FDA strongly prefers Configuration and would like to keep Customization to the bare minimum.

45. Are low-code extensions permitted (e.g., custom forms, triggers, plugins)? FDA is open to low-code extensions where practical.

46. Does the FDA require on-site training, virtual training, or a hybrid approach? Real time Virtual Training that is recorded, and Computer-based

Training (CBT) are preferred. Some on-site sessions may be appropriate to train Power Users and Executives.

47. Does the FDA prefer enterprise-wide pricing or user-based pricing models? FDA is interested in Enterprise-wide pricing.

48. Is this RFI expected to lead to a Request for Proposal (RFP) or a multiple-award vehicle?

No decision has been made yet as to whether this RFI will lead to an RFP solicitation.

49. Does the government have a target implementation timeline?

No, due to the impact of recent government shutdown

50. As we could see, we have to provide an estimate of 20,000 users for the FDA and 80,000 users for the HHS. Please confirm the estimated number of agents who will actually be working on the tasks, including creation and assignment. However, we recommend that 10% of the total agent count will suffice for this requirement.

Moreover, your clarification would surely help us to suggest the right set of products and their optimum cost.

The solution is intended to support various business processed within the agency. The RFI listed 26 use cases that are anticipated. It is reasonable to assume that there will be 90% View Only users, 10% Power Users, and perhaps 50 Admin Users across the Agency.

We are open to suggestions on the best licensing structure based on previous impimentation experience.

51. What is your existing footprint in Atlassian products such as Jira/JSM/Confluence? FDA has 2,000 Jira users, 3,000 Confluence users, and does not use JSM at all.

52. When you say model-agnostic, are you referring to the solution's ability to work across different cloud platforms (Azure, AWS, etc.) without major changes?

Correct, FDA uses the term model-agnostic to indicate the universal data structure that would make the data portable to other platforms, and useful to Elsa, FDA's AI solution.

53. Can you elaborate on your existing Organization AI capabilities? FDA has implemented Elsa as its inhouse AI tool. Claude is the LLM that is utilized.

54, Please define "External User" in the External Collaboration and Communication section. Is this a user that does not have an account within the tasking tool or a user outside of FDA altogether?

FDA refers to users as external if they are outside the FDA boundaries, and are not using FDA provided GFE with SSO PIV to authenticate.

55. Can you please elaborate on what content is leaving the system and where it is going when you say "Digital certificates are needed for content that leaves the system and shows a valid signature by FDA."

HR documents, pay documents, Interagency Agreements, MOUs, other agency policy documents requiring FDA review/comment, OMB memorandums, White House reports, Reports to Congress, Congressional Inquiries, Legislation, Final Rules, Federal Register Notices, etc.

56. In order to provide the government an adequate response to the detailed requirements:

5. Scope of Information Requested (items 5.1- 5.25);

6. Use Cases (items 6.1- 6.11);

7. Other Pertinent Information (items 7.1 - 7.2)

8. Information Requested (items Cost Estimate and Past Performance) Please confirm an increase in page count to a maximum of 15 pages.

FDA is limiting responses to 8 pages of text to make review more manageable. Please note that as stated in the RFI, that graphics tables, diagrams and spreadsheets do not count toward the page limit.

5.7 Is there a hosting preference within the FDA, being hosted within the FDA environment or a full vendor SaaS environment (private tenant)?

FDA requires either a FedRAMP Moderate Cloud Solution hosted by the vendor, or an on-prem FDA environment. Cloud is preferred but we are open to an on-prem solution.