Vendor Questions Response Template.xlsx
XLSX spreadsheet 25 KB Posted
- Solicitation number
- GG000000-26-00063
About this file
This is a Vendor Questions Response Template document providing clarifications and government answers to 40+ vendor inquiries regarding solicitation GG000000-26-00063 for a Cloud-Based GRC/Cyber Risk Compliance Automation Platform.
The solicitation seeks a commercial, cloud-based Governance, Risk, and Compliance (GRC) automation platform to support the Department of Commerce Office of the Secretary's requiring office. The platform must hold an active FedRAMP High authorization at time of quote submission and support automated FISMA documentation, AI-assisted control drafting, and continuous monitoring reporting for five systems. Key mandatory requirements include: inventory and vulnerability scanning integration, configuration management integration, evidence source system integration, JCAM reporting integration, AI-assisted drafting capability with human approval workflows, secure data transmission via private B2B connectivity (Azure Private Link or equivalent), and two federal customer references demonstrating successful FedRAMP High FISMA High deployment experience. The government confirmed the 12-month base year contains no option periods (Base Year Only), pricing format is vendor discretion with no government template provided, and technical quotations are limited to three pages (excluding cover page, table of contents, past performance references, and FedRAMP authorization documentation). Implementation must occur within 12 weeks of award, with an anticipated award date of September 30, 2026. All data and processing must be CONUS-only with US citizen-only vendor administrator access. The platform must support up to 3-4 users with tiered access capabilities, integrate with industry-standard scanning and configuration management tools, and provide data portability compliant with JCAM standards. Questions deadline was September 21, 2026, with quotation deadline of September 28, 2026, at 11:00 AM Eastern Standard Time.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Amendment 0001.pdf | ||
| Competitive Solicitation_GG000000-26-00063_vF.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Vendor Questions - GG000000-26-00063 / Cloud-Based GRC / Cyber Risk Compliance Automation Platform | |||
| Vendor Name | Vendor POC | Question | DOC Response |
| May a prime contractor quote a FedRAMP High authorized platform as an authorized reseller of the platform owner, with the platform owner or its documented implementation partner performing the deployment engagement under REQ-DEP-02? | Yes | ||
| For REQ-DEP-03, may the two federal customer references be those of the implementing subcontractor or partner performing the work, rather than references of the prime contractor? | Yes | ||
| Section 3 of the Statement of Work refers to a timeline specified in Section 3.5.3, but the document does not contain a Section 3.5.3. Please confirm that the twelve (12) week period in REQ-DEP-01 is the controlling timeline. | TYPO SECTION 3.2.3 instead of 3.5.3 | ||
| Section 3.2 of the Statement of Work refers to non-conformance under Section 4.4, but the document does not contain a Section 4.4. Please advise which provision governs. | Disregard, no additional provisions other than those already listed in the RFQ are required | ||
| Section 2 of the Statement of Work lists only CLIN 0001, Base Year. REQ-LIC-02 refers to option year pricing. Should quoters price option years, and if so, how many? | Base Year Only | ||
| Do the three (3) page technical limit and two (2) page price limit include the FedRAMP Marketplace package identification and the customer references, or may those be provided as separate attachments? | Those may be provided as separate attachments. | ||
| The solicitation requires an active FedRAMP High authorization. Would the Government consider a FedRAMP Moderate authorized platform that has been independently assessed for operation within FISMA High environments, provided the offeror can demonstrate applicable compensating controls and third-party assessment validation? | No | ||
| For the requirement to provide two successful federal deployment references, may qualifying references be provided by a teaming partner, subcontractor, OEM, or platform provider participating in the proposed solution, or must both references be directly attributable to the prime offeror and/or proposed GRC platform? | Yes | ||
| Would the Government accept a GRC platform that is fully compliant and is currently FedRAMP Moderate? | No, FedRAMP HIGH only | ||
| May an offeror propose and resell an OEM platform whose active FedRAMP High package covers all required modules, and may the OEM or documented implementation partner’s federal references and FISMA High implementation experience be used to satisfy REQ-DEP-02 and REQ-DEP-03? | YES, as long as the offeror can access and implement the solution in a FEDRAMP HIGH environment. | ||
| Must the AI-assisted drafting capability described in REQ-AUT-03 itself be expressly included within the proposed solution’s current FedRAMP High authorization boundary, and will the Government require boundary documentation specifically identifying that capability? | Yes | ||
| Please identify the inventory, vulnerability-scanning, configuration-management, and evidence-source systems that must be integrated under REQ-AUT-01 and REQ-AUT-04, including available APIs, data volumes, and authentication methods. | The proposals must make their best guess at the scope of the effort needed based upon common federal government executive branch system(s). | ||
| Please provide the required JCAM integration method, interface documentation, Government onboarding dependencies, and objective acceptance criteria for pilot validation and full operational capability within the 12-week period. | The offeror should already be aware of and understand the JCAM integration process sufficiently to understand these requirements. | ||
| REQ-LIC-02 references option-year pricing, but the provided CLIN framework identifies only the 12-month base year. Please confirm the number and duration of option periods and the pricing format required for each option. | No options, Base Year Only. | ||
| REQ-LIC-02 references "option year pricing," but Section 2 (Period of Performance) and the CLIN table define only a 12-month Base Year under CLIN 0001. Will the Government exercise option periods, and if so, how many, what are their lengths, and what is the corresponding CLIN structure so Offerors can price options consistently? | No options, Base Year Only. | ||
| REQ-LIC-01 requires Offerors to state incremental per-system licensing cost for systems beyond five (5). Should this incremental pricing be presented by Offerors as a separately priced CLIN/line item within the 2-page Price Quotation limit, or as an informational schedule/attachment excluded from that page count? For maximum clarity, can the Government provide an example scenario illustrating how additional-system pricing would apply? | Either option is acceptable, any additional system requests would require contract modification/requests, pricing is for informational planning purposes if needed | ||
| What scanning, configuration-management, and asset-inventory/CMDB tools does OIG currently use, and will the Government provide existing system inventory data, scan tool exports, or sample data as Government-Furnished Information to support automated ingestion under REQ-AUT-01 — or is the Offeror solely responsible for establishing these data feeds and inventory from scratch? | Assume industry standard tools in use, existing government data exists, the offeror will be responsible for coordinating and setting up the data feeds into the GRC system with OIG support as needed for access/configuration of OIG managed tools. | ||
| What is the current state of OIG's JCAM onboarding — is JCAM integration already active, or does it need to be established as part of this effort? Given REQ-DEP-04 identifies JCAM onboarding as a potential dependency outside the contractor's control, will Government-caused delays in JCAM onboarding excuse the contractor from the 12-week Mandatory implementation timeline in REQ-DEP-01, or is that 12-week period strictly contractor-attributable regardless of JCAM readiness? | OIG currently uses standard JCAM integration processes, any government caused delays by OIG/JCAM will excuse the 12-week timeline. | ||
| Please provide technical specifications for the JCAM system - integration method (API, file exchange, or manual upload), authentication model, and data schema/format expected for POA&M reporting - including a data dictionary or sample export if available, so Offerors can accurately scope the required integration and any data migration within the 12-week implementation window. Please also confirm which JCAM/Cyber-GRC integrations are mandatory for go-live and whether any data migration from JCAM is required. | Vendor should already be aware of standard JCAM technical specifications required. The process is for OIG to submit to JCAM. | ||
| Could the Government specify the desired pricing format and provide a template? | Pricing is vendor's discretion. No template. | ||
| What AI tools, if any, does OIG currently use (Microsoft Copilot, ChatGPT Enterprise, etc.), and is there an existing approved-AI-tools list this platform would need to align with? | The OIG COR will obtain necessary approvals for AI use within the OIG. | ||
| Does the Government have an approved asset inventory and configuration management database that includes the necessary assets that would be required as part of this effort? | Assume industry standard tools in use, existing government data exists, the offeror will be responsible for coordinating and setting up the data feeds into the GRC system with OIG support as needed for access/configuration of OIG managed tools. | ||
| The SOW jumps from Section 3.2.3 (Deployment and Professional Services) directly to Section 3.5.4 (Secure Data Transmission) and 3.5.5 (Licensing Scope), skipping Sections 3.3 and 3.4. Were sections omitted in error, or is content missing? Please confirm the complete, corrected section structure. | Error. | ||
| The Technical Quotation is limited to 3 pages, yet Section 4.0 requires Offerors to address 9 distinct evaluation bullets (SaaS modules, each Mandatory requirement with cross-references, FedRAMP package ID, implementation approach, M365/Azure and JCAM integration approach, customer references, and assumptions/exceptions) covering 14 Mandatory requirements. Given the volume of required content, will the Government consider expanding the technical page limit, or permit Offerors to submit a separate requirements traceability matrix/appendix that is excluded from the page count? | Absolutely NOT, if you cant meet the page limit you don’t understand the request. | ||
| Will past cover page, table of contents, assumptions, performance reference contact sheets and FedRAMP authorization letter/ATO documentation count against the 3-page technical limit, or may they be submitted as separate, non-counted attachments? Additionally, may the government provide clarity regarding the required format for past peformance should be seperate attachments? | YES, do not add unnecessary information to the proposal, focus on meeting requirements. Past performance can be a separate attachment. | ||
| Please clarify the technical evaluation methodology under Section 4.0. Will quotations be evaluated solely on a technicall acceptable/unacceptable basis, or will the Government assign technical ratings and identify strengths, weaknesses and risks? If a Best Value Tradeoff is intended, please describe how technical advantages, including satisfaction of Mandatory requirements will be weighed against price and whether a higher priced quotation may be selected based on superior technical merit. | Evaluation methodolgy has no bearing on the offerors proposal on meeting the requirements. | ||
| Is there an incumbent contractor or existing GRC platform currently in use by OIG? If so, please identify the incumbent and describe any data migration, legacy POA&M, or transition-of-records requirements not currently addressed in the SOW. | No | ||
| REQ-FIS-01 requires the solution and all proposed modules to hold an active FedRAMP High authorization at time of quote submission. If AI-assisted drafting or automation modules are provided via a sub-authorized component, integrated add-on, or a component hosted within a separately-authorized cloud (e.g., an AI service operating within the CSP's existing FedRAMP High boundary), does that satisfy the requirement, or must every module be explicitly enumerated within a single FedRAMP Marketplace package? | All GRC system/data must reside in a FEDRAMP HIGH authorized boundary. Multiple boundaries could be acceptable if the vendor demonstrates appropriate data transfer security controls are in place. | ||
| REQ-AUT-03 requires human approval of "each AI-generated statement" prior to submission. Please clarify the intended unit of review/approval — is per-control, per-paragraph, or per-narrative-section approval acceptable, or must approval occur at the individual sentence/statement level? | This is for the vendor to describe and show best value in their proposal. | ||
| Is a dedicated/single-tenant SaaS environment required, or is a properly authorized multi-tenant FedRAMP High architecture acceptable, given OIG's law enforcement oversight mission and data sensitivity? | Mult-tenant FEDRAMP HIGH architecture is acceptable as long as data transfer security controls are demonstratable. | ||
| Are there specific data residency requirements (e.g., CONUS-only, U.S. persons–only administrative access) beyond FedRAMP High baseline controls? | YES, all data and processing is CONUS-ONLY, vendor administrator access to OIG data must be US citizens only. | ||
| REQ-SEC-02 requires a private, non-public-internet B2B connectivity option (e.g., Azure Private Link, ExpressRoute, or equivalent). Will the Government provide the target Azure tenant/subscription details, or is the Offeror expected to propose the specific connectivity architecture for Government approval during implementation? | The OIG has our own Azure tenant/instance ready and available for B2B connectivity. | ||
| The SOW does not specify minimum Service Level Agreement (SLA) terms (uptime, support response times, backup/disaster recovery, incident notification timeframes). Can the Government please clarify SLA requirements or expectations? | There are no specific uptime requirements for this system, it is not mission critical, so vendors should provide their system availability specifications in the proposal. | ||
| What data portability/extraction provisions apply at contract expiration or termination (e.g., export of SSPs, SARs, POA&Ms, evidence artifacts in a non-proprietary format) to support transition to a follow-on contractor? | All data portability should comply with JCAM standards for data review and accessability. GRC should easily allow for export, printing of all deliverables into standard formats PDF/Office documents. | ||
| Approximately how many named users/roles will require training under CLIN 0001, and is a specific training format or approach (e.g. train-the-trainer, live instructor-led, recorded/on-demand) expected by the Government? | Training sufficient to provide security staff the knowledge and skills to use the capabilities of the GRC tool. There will be up to 3 named users/roles. | ||
| The RFQ states that questions and quotations are due at 11:00 AM EST on September 21 and September 28, respectively, while the SAM.gov quotation deadline is recorded with an Eastern Daylight Time offset. Please confirm the controlling time zone and deadline for each submission | The time is 11:00a.m. Eastern Standard Time (EST). | ||
| Section 2 identifies a 12-month base period and the pricing framework lists only CLIN 0001 for the Base Year. However, mandatory requirement REQ-LIC-02 requires option-year pricing. Please confirm the number and duration of option periods and provide the intended option-year CLIN structure. | Base Year Only | ||
| The RFQ limits the Technical Quotation to three pages while requiring a mandatory-requirements crosswalk, FedRAMP package identification, implementation approach, integration approach, customer references, and assumptions or exceptions. Please confirm whether a compliance matrix and customer-reference information count against the three-page technical limit. | OIG currently uses standard JCAM integration processes, any government caused delays by OIG/JCAM will excuse the 12-week timeline. | ||
| Does OIG currently have an existing ServiceNow instance or license (or any other GRC/IRM platform already deployed)? | No | ||
| How many users will require access to the platform (analysts, approvers/reviewers, read-only stakeholders), and are there distinct user tiers OIG anticipates (e.g., full contributor vs. view-only)? | 3-4, user tiers based on GRC solution | ||
| What scanning/configuration-management tools (e.g., Tenable, Qualys, Rapid7, SCAP-based tools) are currently in use or planned, that the platform's automated ingestion capability will need to integrate with? | Assume industry standard tools | ||
| How are the RMF documentation and POA&M tracking for OIG's five systems currently managed? | Manual documentation processes | ||
| Is there an existing data source the awardee will need to migrate from? | No | ||
| Is OIG currently reporting into the Joint Cybersecurity Authorization Management (JCAM) system today, and if so, through what mechanism (manual upload, existing API, file transfer)? What data format or interface does JCAM expect for POA&M/SSP reporting from a connected GRC platform? | YES, expect standard existing JCAM processes that already exist | ||
| Is there an existing NIST SP 800-53 Rev. 5 control baseline/tailoring already established for OIG's five systems, or should the awardee assume this needs to be developed during implementation? | Both | ||
| Please confirm the option period structure referenced in the SOW's licensing scope requirement — the CLIN table in Section 2 of the SOW identifies only CLIN 0001 (Base Year). How many option years are anticipated, and what are the corresponding CLIN numbers? | Base Year Only | ||
| Is the five (5) system count fixed for the duration of the base period, or could OIG's system count fluctuate? | No more than 5 systems in scope | ||
| What is the anticipated award date, so offerors can plan the twelve (12)-week implementation timeline against a realistic start? | Anticipated award date is September 30, 2026. | ||
| Is implementation expected to be performed remotely, on-site at OIG facilities, or a hybrid arrangement? | This is a SaaS platform solution, implementation is at vendor cloud solution | ||
| For the two required federal customer references, is a brief written reference narrative sufficient within the three-page Technical Quotation limit, or does OIG expect reference contact information provided separately from the page-limited narrative? | References can be a separate document |
File details come from the government source that posted it. Updated .