AMD 0010 Questions Answers - HC108424R0005.pdf

Amendment 0010 Amendment

(AMD)

Number

RFP Attachment (PWS, QASP, Clauses, etc..) Section/ Paragraph/ Text

Page Number Question/Comment/Recommendations Government Response

AMD 0001 PWS Prior Task Orders 74 Is this a completely new requirement or is there an incumbent? If the latter, please provide the incumbent contractor name and contract/task order number. Yes. This is a new completely new requirement with no incumbent.

AMD 0002 PWS 6.3 76 Does this tool need to be FedRAMP and/or Impact Level 4 compliant See PWS tasks 6.4 & updated 6.4.7 in red font.

AMD 0003 PWS Is the EBS System Oracle EBS, No, DeCA EBS does not use any Oracle applications.

AMD 0005 PWS

Data Structure and Optimization Parameters: How should the tool manage different regions with distinct pricing strategies, considering regiona competition and margin requirements? See updated PWS task 6.2.17 in red font.

AMD 0005 PWS

KVI and Special Programs: Could you clarify the criteria for KVIs and their impact on pricing strategies, especially regarding competitor pricing and margi limitations? See updated PWS task 6.2.5.1 in red font.

AMD 0005 PWS

Product Grouping and Price Family Dynamics: How are price families determined and managed, particularly concerning parent-child relationships and regional pricing variations? See updated PWS task 6.2.18 in red font.

AMD 0005 PWS

Import and Export Functionalities: Are there specific formats or templates for importing data into the system and exporting optimized pricing for integratio with DeCA EBS? See updated PWS tasks 6.1, 6.2.1 and 6.2.2.

AMD 0005 PWS

Forecasting and Impact Analysis: Could you provide more details on preferred forecasting models for predicting sales, margin impacts, and competition savings? See updated PWS task 6.2.2.1 in red font.

AMD 0005 PWS Visibility and Reporting Requirements: What visibility level is required for different user roles, and how should the tool facilitate this See updated PWS task 6.2.9.4 in red font.

AMD 0005 PWS

Multi-Level Approval Workflow: What specific workflow features or functionalities are needed to support the approval hierarchy before finalizing optimize retails? See updated PWS task 6.2.19 in red font.

AMD 0005 PWS Historical Data and Reporting: How should the tool archive and report on historical pricing decisions See updated PWS task 6.2.7.3 in red font.

AMD 0005 PWS Elasticity and Competitor Data Utilization: Can you elaborate on the role of competitor data and elasticity in the pricing optimization process See updated PWS task 6.2.20 in red font.

AMD 0005 PWS Data Ownership and Security: What measures are expected to ensure the security and proprietary control of data DeCA's proprietary information such as costs, margins, business strategies are expected to be secured as CUI

AMD 0005 PWS

Budget and Pricing: Is there a predefined budget range for this project, and are there any cost limitations or guidelines for the solution’s development an implementation? No.

AMD 0005 PWS

Change Management: Could you detail the expected change management processes, especially how changes to the project scope or technology should b communicated? See PWS task 6.3.3 and 6.7.1

AMD 0005 PWS

Post-Development Support: What are the expectations for post-development support and maintenance, and are specific SLAs or maintenance schedule required? See PWS task 6.7 - Lifecycle Sustainment.

AMD 0005 PWS Performance Metrics: What KPIs and metrics will be used to assess the solution's success, and how frequently will these evaluations occur See PWS 7 Performance Standards.

AMD 0005 PWS

DeCA EBS Integration Capabilities: Does DeCA's Enterprise Business Solution (EBS) provide an Application Programming Interface (API) to facilitate integration with the retail price and promotion optimization tool? If so, could you provide details on the API specifications, including available endpoints, authentication methods, and data exchange formats? See updated PWS tasks 6.1, 6.2.1 and 6.2.2 At present, DeCA does not foresee a need for development of an API for live data to the price optimization tool.

AMD 0005 PWS

Technical Documentation for DeCA EBS API: Is there technical documentation available that outlines how to integrate with the DeCA EBS API, including guidelines on usage, rate limits, and security protocols? We seek to ensure our solution aligns with DeCA's IT policies and optimizes data synchronization and real-time access. See updated PWS tasks 6.1, 6.2.1 and 6.2.2. At present, DeCA does not foresee a need for development of an API for live data to the price optimization tool.

AMD 0005 PWS

Support and Assistance for API Integration: In the event of API integration, does DeCA offer technical support or assistance to address potential challenge or questions that may arise during the development and implementation phases of the project? See updated PWS tasks 6.1, 6.2.1 and 6.2.2. At present, DeCA does not foresee a need for development of an API for live data to the price optimization tool.

AMD 0005

Appendix B – DeCA Sample Optimization Data

Tab - Data – Column AE Tab – Optimization Rules – Column C

Appendix B – Data tab – column AE references pricing region, references multiple values, while Appendix B – Optimization Rules tab -column C reference lower 48, OCONUS and AK, HI for Optimization. Please provide confirmation whether the scope of the Price Zones is to be optimized based on pricing region/ lower 48, OCONUS and AK, HI, or a different number See updated PWS task 6.2.19.1 in red font.

AMD 0005

PWS

Appendix B – Data Sample Optimization

Section 6.1.2 Tab – Optimization Rules – Row 14 and Row 22 75

Appendix B – Optimization Rules – Row 14 and 22 reference Future Cost. Please provide guidance and/or an example of how the government would like respondents to utilize future cost from a workflow perspective in a price optimization. See updated PWS task 6.2.2.1 in red font.

AMD 0005 PWS Section 6.1.2 75 This requirement states “The retail price and promotions optimization solution will be customizable without added technical support”. Please provid guidance on the types of customizations and/or personalization that the government anticipates being provided by respondents See updated PWS task 6.2.9 in red font.

AMD 0005 PWS Section 6.1.15 75 This requirement states “the product should be scalable across product categories” based on this requirement is the intended scope of a price optimization intended to be possible at multiple levels of the product hierarchy, inclusive of optimization the of multiple categories in within a single set of objectives? See updated PWS task 6.2.15 in red font.

AMD 0005

PWS

Attachment 1 – CLIN Pricing Worksheet

Section 6.1 Tab – CLIN Summary – CLIN x001 – Software Subscription 75 Please provide guidance on the planned and expected number of end-users expected to access the Price Optimization solution. See updated PWS task 6.2.7.2 in red font.

AMD 0005 RFP

Item D – Page 47 Task 3 – Page 76 and 77 47, 76, 77

The RFP states “(D) If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered defense information performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/resources/documents/) and that the cloud service provider complies with requirements in paragraphs (c) through (g) of this clause for cyber incident reporting, malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment. Does this provision allow respondents to propose an alternative to the FEDRAMP requirement and remain i compliance with the RFP? See updated PWS task 6.4.7

RFP - HC108424R0005 - Question & Answers

AMD 0005 RFP

Item 3 - Page 25 Item 11 - Page 21 FAR 52.212.4 – Page 1 and Page 14

25, 21, 1, The RFP states (1) (page 25) “In response to this RFP, no terms, conditions, or assumptions will be entertained. If terms, conditions, or assumptions are included in a proposal, the proposal may be excluded on grounds that it failed to comply with the RFP’s instructions; and (2) (page 21) “If the offer is not submitted on the SF 1449, include a statement specifying the extent of agreement with all terms, conditions, and provisions included in the solicitation. Offers that fail to furnish required representations or information or reject the terms and conditions of the solicitation may be excluded from consideration.”

Consequently, any deviations from the stated RFP terms and conditions aren’t permissible

Yes, the Contracting Officer will allow the Contractor to submit tailored language for review. However, there is no guarantee the revised language will be accepted.

AMD 0005

However, the RFP includes FAR clause 52.212-4 “Contract Terms and Conditions--Commercial Products and Commercial Services” (NOV 2023) and the associated FAR prescription states: “The clause at 52.212-4, Contract Terms and Conditions-Commercial Products and Commercial Services”: This clause includes terms and conditions which are, to the maximum extent practicable, consistent with customary commercial practices and is incorporated in the solicitation and contract by reference. The contracting officer may tailor this clause in accordance with 12.302 “Tailoring of provisions and clauses for the acquisition of commercial products and commercial services”. 12.302(a) states that contracting officers may tailor FAR 52.212-4 to adapt to the market conditions for each acquisition, within the limitations of this subpart. While 12.302(b) identifies the subparts that are not tailorable, other subparts are tailorable as long as it is consistent with customary commercial practice for the item being acquired.

That said, the Contractor desires to submit certain permissible tailoring language to FAR 52.212-4 consistent with its commercial practices. Will DeCA allow such tailoring in the RFP response which, by FAR guidance, shall be by addenda to the solicitation and contract?”

AMD 0005 RFP Item 7 - Proposal Due Date 26 Based on the level of work required to submit a complete and comprehensive response would DITCO consider an extension of the Due Date to Friday 1 Marc 2024. The Government provided an extension to March 8, 2024 at 12:00 CST.

AMD 0005 PWS

Regarding the solicitation HC108424R0005, we seek clarification on the pre-award testing process outlined for the retail price and promotion optimizatio solution. Could you please provide detailed guidance on how prospective contractors are expected to prepare for this testing? Specifically, we are interested in understanding if the testing is anticipated at the algorithm level or requires a demonstrable prototype, and what criteria or scenarios will be used to evaluate ou solution's compliance with Appendix A. See updated PWS task 6.2.16.2 in red font.

AMD 0005 PWS

Additionally, we seek guidance on the methodologies preferred for predicting and optimizing pricing within the proposed solution. Specifically, should w adhere to predefined guidelines/rules/formulas derived from historical data, or is the application of machine learning algorithms expected? If machine learning is recommended, could you please specify any preferred models or approaches? There are currently no predefined guidelines / rules / formulas derived from historical data.

AMD 0005 RFP Receive an extension to submit this proposal, until March 8, 2024? Yes, The Government has granted an extension to March 8, 2024 at 12:00 CST.

AMD 0005 RFP 24 Page 24 says response to Technical/Management (volume II) is 50 pages, but page 26 says 20 page The page limit is 50 pages and the file size of each document shall not exceed 20 MB. FAR 52.212-2(1) updated to 50 pages AMD 0005 PWS 6.8 Cyber Security Compliance and NIST requirements, can we develop the processes to meet the requirements during the implementation See updated PWS task 6.4.7, 6.8.4 and 6.8.5

AMD 0005 PWS 12. Section 508 Accessibility Standards Where are the standards? What is ICT? What do chapters 4,5,6 refer to?

Information and communication technology (ICT) Standards are to ensure information and communication technology is accessible and usable by individuals with disabilities. Chapter 4 Hardwar Chapter 5 Software and Support Documentation and Service.

AMD 0005 PWS 6.3.1 Who is paying for hosting? Does the contractor manage hosting? See PWS task 6.4 Fedramp compliant.

AMD 0005 PWS Who and how many people currently decide on the price rules and changes? Is this done centrally or do local stores have own authority over (some) prices?

There are currently 6 people on the DeCA Pricing team that contribute to the final determination of the DeCA price rules and changes. The store ability to change retails is established within DeCA current Enterprise Business System (EBS), as opposed to the pricing optimization tool.

AMD 0005 PWS

Can you describe your current pricing workflow and how you generally want to change it in the future? What are your short term and long-term goals in th regard? See PWS task 6.2.19.2 in red font.

AMD 0005 PWS

How are cost zones, retail price zones and store zones currently determined/defined and what is the resulting number of stores / store zones with individua pricing (for the same items) at the moment? See PWS task 6.2.17.1

AMD 0005 PWS

Referring to the last question: Should this existing structure also be changed/optimized, e.g. to provide more granular price optimization with smaller stor clusters or individual stores? If yes, what is the planned timeline for such changes? No, this structure is not expected to change.

AMD 0005 PWS

How many SKUs does a store have? Do all stores have the same (or similar) assortment or are there differences between the different regions, within an outside of the US? See PWS task 6.2.3.2.

AMD 0005 PWS How many sales transactions take place each day in one store?

DeCA supports 235 stores. Sales volume will naturally vary from one store to the next. For high-level reference, DeCA is 'mid-pack' in terms of the top 100 food retailers in North Americ https://progressivegrocer.com/pg-100-ranking-top-food-retailers-north-america

AMD 0005 PWS What is the approximate distribution between fast and slow movers in the assortment? The top 40th percentile of movement within the category would be considered a fast mover. All remaining units would be considered a slow move AMD 0005 PWS Is the pre-award testing listed in Appendix A that which is described in Appendix B? Appendix A contractor will need to meet the Salient Criteria listed and for Appendix B lists the pre award testing.

AMD 0005 PWS When is the test described in Appendix B going to be carried out? After the awarding and signature of contracts, as a PoC First the contractor will need to meet the Salient requirements on Appendix A and Appendix B will be performed pre-award

AMD 0005 PWS

Competitor/Market data is provided in the test case (appendix B) but not mentioned in the RFP. Can we assume that such data will be provided by DECA and should be considered in the final deployment as well? Yes, Competitor Market data will be provided by DeCA and imported into the tool.

AMD 0005 PWS

Promotions are mentioned at a high level but not further described in the requirements or test case. Could you please elaborate to what extend a solution shoul provide promotion optimization functionality and what your plans and timeline is to include those in the pricing process? Contractor needs to include their promotion solution and reference PWS task 6.6.1

AMD 0005 PWS

The PWS states that the solution must integrate with NCR’s EBS Power HQ full item product assortment catalog. Is there an existing API or integration service in Power HQ that will facilitate this integration effort?

DeCA does not foresee a need for development of an API for live data to the price optimization too See updated PWS task 6.2.1 and 6.2.2, for the technical information on how to integrate into DECA EBS interfaces.

AMD 0005 PWS Program Analyst Support - is support for the specified daily time period limited to working days, Monday thru Friday, less U.S. federal holidays? See PWS task 6.3.1.

AMD 0005 PWS The PWS states that the SaaS solution is required to be FEDRAMP/Moderate, does this infer Impact Level 2 See PWS tasks 6.4 & updated 6.4.7 in red font.

AMD 0005 PWS

Although the PWS requires FEDRAMP/Moderate, would SaaS delivery by secure private cloud (software and cloud provider) accredited to NIST 800-171 an 181 standards be acceptable? See PWS tasks 6.4 & updated 6.4.7 in red font.

AMD 0005 PWS Based on the previous question, can the solution offered go through the accreditation process during system implementation See PWS tasks 6.4 & updated 6.4.7 in red font.

AMD 0005 PWS During system implementation does DeCA desire all training courses to be conducted on site vs. virtually See PWS task 6.5.1

AMD 0005 PWS

This paragraph suggests that an over the shoulder training capability is available to users at the time of need. Can you provide an estimated number o monthly hours for this service? DeCA is unable to measure unknown system training requirements but encourages industry to provide a best estimate for maximum 25 users, not to exceed 40 hours per month.

AMD 0005 PWS

"Deliverable - PWS Task 6.4.5, last column, states that DeCA requires five (5) business days to review and approve final training materials. Is this five (5 days prior to the timeframes outlined in the Due Date column?"

Yes. The 5 business days is based on having training materials ready for user testing. The final materials are due prior to predeployment end-user training See Deliverable PWS task 6.5.5 & 6.5.5.1

AMD 0005 PWS

The Table that outlines the deliverables for this paragraph states that failover testing is required. During which test event does DeCA intend failover testing t be done or is it a separate test event? Updated PWS task 6.6.9 deliverable to remove "Fail Over".

AMD 0005 PWS Does Operational Test and Evaluation Testing include user testing? See PWS task 6.6.17 AMD 0005 PWS Is it DeCA's intent to conduct a TRR before and after IT&E, DT&E 1 and 2, Security testing and Operational Test and Evaluation See PWS tasks 6.6.12, 6.6.13,66.14.6.6.15 & 6.6.17

AMD 0005 PWS

This paragraph states that the Contractor shall make changes to configuration of their solution when directed by the Government Program Manager. Is it th Government's intent to have the prime contractor perform all configurations and system administration or will the contractor be working with designated DeCA system administrators to perform these functions? See PWS task 6.6.9 - failover has been removed.

AMD 0005 PWS Technical

Can you provide a description of the DeCA’s Enterprise Business Solution (EBS 1.a Is it Oracle EBS ?

1.b What type of integration (API) interfaces (i.e. REST, SOAP, Streaming, etc.) does the system have ? No, DeCA EBS does not use any Oracle applications. DeCA does not have the technical information on how to integrate DECA EBS interfaces.

AMD 0005 PWS Technical What is the expected result/format of the DeCA data for presentation to the End User ?

Will it always be the format of the Data set provided ? See PWS task 6.2.7.1

AMD 0005 PWS Technical Is the expectation that the SaaS solution will perform some type of Predictive Analysis on the retrieved data Set retrieved from DeCA ? Can you provide the Formulas required for Analysis ? See PWS task 6.2.2.1

AMD 0005 PWS Technical

Can you provide more detail for the following Salient Requirements:

“Rule based price scenarios with manual override.” (Are these fixed algorithms, or is the expectation the offeror will recommend the scenarios, or will it be a collaborative effort?

“Ability to utilize product grouping and category specific parameters” Based on a review of the Data Tab provided, can you explain the formula for the different Rules required for Transformation/Analysis of the core Data set(i.e.)

Optimization Priority 1CompetitionLower 48, OCONUS

Programs 3EDLP All Regions

Price Family 5Retail EndingsAll Regions See updated PWS task 6.2.11 & 6.2.12 Rule based and Product Grouping

AMD 0005

“Interface with enterprise business systems and/or import and export capabilities.” Can you please provide more detail on the types of expected interfaces and export capabilities.

“Scalable across product categories, regions, and countries.” Are you requesting a multi-lingual solution? If not, please provide the degree in which the Scalability should be implemented.

“Pricing optimization with a promotional component capable of leveraging historical demand and financial information to generate demand forecasts based on optimization results.” Can you please describe the Historical Data and the expected Optimization Scenarios? Do you have Optimization algorithms or do you want the Offeror to recommend the different Scenarios. If the latter, can you please provide data set examples?

“Customizable without added technical support.” What elements of the SaaS solution is expected to be Customizable without Technical Support?

“Parameters are easily accessible to create necessary dashboards.” Can you provide examples of the parameters/flexibility of the ability to create Dashboards ?

AMD 0005 PWS Pricing

Is the expectation associated with this line item:

0003 - FEDRAMP Cloud and Services

To account for the effort to integrate the SaaS solution with the FEDRAMP Environment, or is it for the SaaS solution to be audited for compliance ? See PWS tasks 6.4 & updated 6.4.7 in red font.

AMD 0010 PWS 6.7.4 30 Can government confirm that the vendor is responsible to upload documents in E-MASS or will this be done by DeCA’s cyber team? Yes, the vendor is responsible to upload documents into E-MASS

AMD 0010

Attachment 1 CLIN Pricing Worksheet The CLINs listed on the Price Summary tab of the Pricing Workbook do not match the PWS. Can the government please update the Pricing Workbook? Attachment 1 CLIN Pricing Worksheet updated with AMD 0009

AMD 0010

Attachment 1 CLIN Pricing Worksheet How does the government want to offerors to represent non-labor items such as hosting costs in the Pricing Workbook? Added a Tab for Materials, any non-labor hours would be entered there.

AMD 0010

We are performing independent research on the Combined Synopsis/Solicitation (HC108424R0015).

We would like to know if this is a brand new contract OR if there is (was) an incumbent performing these services.

If not brand new, could you please provide the current / previous contract number? This is a brand new requirement.

AMD 0010

I have heard that there will be an amendment to the DeCA Retail Price and Promotion Optimization tool, can you advise when this will be posted on Sam.gov?

Also will the date now be extended due to the amendment? Updated Amendment was been posted on October 8, 2024.

AMD 0010 Will there be an updated posting for the Retail Price and Promotion Optimization? Updated Amendment was been posted on October 8, 2024.

AMD 0010

Is there a specific format requirement for responses, since RFI/RFP questions seem to be more in statement form?

What are we sending to DeCA (Word doc / PPT deck / Excel doc)? Please refer to FAR 52.212-1 for formatting questions.

AMD 0010

Do program Rules take priority over competitor rules?

When Rounding do you round up down or to the nearest valid ending point?

If Price Move is violated to meet competitor rules enforce Comp?, Price Move? Split the difference (Relaxation of Rules)?

Same question applies to Margin Rules and Comp Rules?

When referring to CONUS is that only Lower 48 Region? everything else is considered CONUS?

Some products in family are not Price the same today and seem to be a mistake? Should we fix them? see Family code 4831 What if EDLP rules end up with a higher price than the starting price, do we stay on the starting price? Then round down i f starting price rounding is invalid Quite a few starting prices do not follow the rounding rules, is that just because this is sample data?

What comp Price should I use looking at Family Code 305, some products have C3 with a price and other products have C2 with a different price. Do I take and average comp price for the family or apply the Master items Comp price to the entire family?

Do program Rules take priority over competitor rules?

-Competitor rules have first priority. Rules shall have a hierarchical order of priority as determined by the DeCA depending on the nature of the product, product grouping, region, etc. The program rules shall be adaptive and applied in order of priority. PWS 6.1.17 has been updated to reflect.

When Rounding do you round up down or to the nearest valid ending point?

-Round Up if above .02 - additional rounding rules maybe applied. The system shall have a rounding rule component that best denotes end digits of retails. PWS 6.1.17 has been updated to reflect.

If Price Move is violated to meet competitor rules enforce Comp?, Price Move? Split the difference (Relaxation of Rules)? Same question applies to Margin Rules and Comp Rules?

-Recommended price shall reflect hierarchy (priority). The system shall programmatically optimize the retails without violation. For example, if the margin floor is prioritized over competition retail, the margin floor will lead the decision path. The system shall not automatically apply retails as the Pricing Analyst will review all recommended changes prior to release. PWS 6.1.17 has been updated to reflect.

When referring to CONUS is that only Lower 48 Region? everything else is considered CONUS?

-Lower 48 is CONUS. Alaska/Hawaii are their own regions, everything else is OCONUS Regions. PWS 6.1.4.2 has been updated to reflect.

Some products in family are not Price the same today and seem to be a mistake? Should we fix them? see Family code 4831 -This is sample data and not expected to match current retails in stores

What if EDLP rules end up with a higher price than the starting price, do we stay on the starting price? Then round down if starting price rounding is invalid.

EDLP rules are based on agreed upon retails with a promotional component outside of the routine process. The Agency will determine the EDLP approach based on the customizable Rules Based Pricing approach that shall be a core component of the selected system. PWS 6.1.17 has been updated to reflect.

Quite a few starting prices do not follow the rounding rules, is that just because this is sample data?

-Correct. This is sample data. If the proposed solution can recommend different rules, the technical demonstration provides a venue of proof of concept.

What comp Price should I use looking at Family Code 305, some products have C3 with a price and other products have C2 with a different price. Do I take and average comp price for the family or apply the Master items Comp price to the entire family?

For exercise purposes, the priority order is C1,C2, C3. If C1 exists withing the Price Family, use C1, if not, use C2, then C3.

The solicitation provides a high-level review of data concepts that shall be optimized via the proposed pricing optimization solution. The Agency seeks a software solution and the requisite expertise best implement the tool, apply best past practices, and optimize the DeCA retails in a manner that supports the savings/margin/performance goals of the agency within a viable and properly forecasted system. PWS 6.1.20 has been updated to reflect.

AMD 0010

HC108424R0005 AMD

0008.pdf

PWS "6.3.1.1 This will also be encompassing IaaS, PaaS, SaaS, and other commercially available CSOs as aligned with either the IaaS, PaaS, or SaaS service delivery model in accordance with the Cloud Computing Security Requirements Guide, at moderate Impact Level, as defined in the NIST Special Publication 800-145."

6.3.1.1 states that the solution must align with the DoD Cloud Computing Security Requirements Guide (CC SRG), a moderate impact level". Since the FedRAMP requirement was replaced with SOC2 Type2, what is the expectation for alignment with the DoD CC SRG since it still references 'moderate impact level' compliance?

Contractor shall provide the required level of logging and log review. For example, SOC 2 compliance requires the retention of log events for a minimum period of 365 days. The log group retention period is an essential control for maintaining audit trails and preserving log data for a sufficient duration.

Contractor alignment shall include the following:

Be able to demonstrate their ability to identify and manage risks associated with data security and privacy (e.g., Effective access control mechanisms, such as strong authentication, role-based access, and least privilege principles) .

Be able to demonstrate their ability to secure an independent auditor to evaluate the effectiveness of controls over a specified period, and ensure assessments confirm adherence to the prescribed security measures.

Be able to maintain comprehensive documentation of security practices and controls, and effectively address issues related to access controls, perform incident response, and data protection (e.g., reporting findings and demonstrating compliance).

PWS 6.3.7 has been updated to reflect.

AMD 0010

HC108424R0005 AMD

0008.pdf

6.5.3 The Contractor shall perform

system and development testing in DeCA’s Developmental Test & Evaluation (DT&E) environment - DEV/DT&E1; DeCA personnel will perform testing in the DT&E2 environment.

6.5.9 The Contractor shall maintain the

final release package in DT&E2 after testing in DT&E 1 and 2. 27 to 28

Can DeCA clarify the expected use of "DeCA's DT&E1 and DT&E2 environments" since the solution is expected to be a cloud-based and not deployed within a DeCA environment?

Although the system is cloud-based, testing with the DeCA environments insures valid connectivity and security paramaters exists that allows users in a government setting to access the full suite of software functionality without issues of latency or transmission of data. Developmental Test & Evaluation is the type of testing which verifies that the system under test meets all technical requirements. Vendor verifies their solution in DT&E1 and when it is complete they pass it to DeCA (DT&E2) with test cases. In DT&E2 - DeCA verifies that the vendor's solution is satisfactory and that all technical specifications and contract requirements have been met. The Contractor shall have a development/testing enviornment (DT&E1) in which the contractor shall test the solution or changes to the solution prior to providing this to the Government. The Contrctor shall provide test cases to the Government and shall assit the Government in validating the solution and verifying the solution is satifactory prior to the government implementing the solution within the Governments Prodcution enviornment. PWS 6.5.12 has been updated to reflect.

AMD 0010

HC108424R0005 AMD

0008.pdf

6.7.15 The system shall comply with

DoD requirements for the installation and configuration of DoD’s end point security point products (to include anti-virus) per DeCAM35-31.01. DeCA shall provide the end point software. 31

If a SaaS based solution is used, the ability to deploy DeCA provided end point software may not be feasible. Recommend this requirement be removed for SOC2 Type 2 SaaS-based solutions.

SOC 2 Type 2 compliance requirements, specifically under the Security trust services criteria, emphasize the necessity of implementing anti-virus/anti-malware measures. These controls are crucial for ensuring the protection of our systems and data against malware and other threats. Contractor shall ensure they are able to comply with the specified standards.

AMD 0010

HC108424R0005 AMD

0008.pdf

CLIN 0001 extended description CLIN 0002 extended description CLIN 1001 extended description CLIN 1002 extended description CLIN 2001 extended description CLIN 2002 extended description CLIN 3001 extended description CLIN 3002 extended description 2 to 17

CLIN 0001 and CLIN 002 appear to have duplicate extended descriptions.

CLIN 1001 and CLIN 1002 appear to have duplicate extended descriptions.

CLIN 2001 and CLIN 2002 appear to have duplicate extended descriptions.

CLIN 3001 and CLIN 3002 appear to have duplicate extended descriptions.

CLINs 0001, 0002, 1001, 1002, 2001, 2002, 3001, and 3002 removed the word "FEDRAMP" and updated to "SOC2 Type 2 Compliant"

AMD 0010

HC108424R0005 AMD

0008.pdf

In the Technical/Management volume, address your proposed approach to meeting or exceeding the minimum performance or capability requirements under Factor 1 and Factor 2 Subfactors 1 through 3, as well as any risks in your proposed approach in terms of technical/performance, price, and/or schedule. 55 Factor 2 corresponds to the Technical Demonstration. What is DeCA's expectations for the Technical/Management volume addressing Factor 2 requirements?

FAR 52.212-1 has been updated.