Responses to Questions.doc

Responses to Questions Received from Potential Offerors for HQ0013-10-R-0001 (Information Technology Support Services for the Foreign Military Financing/International Military Education and Training (FMF/IMET) Budget Web Tool)

1) Is the tool developed from scratch by DSCA or is it a COTS product modified for DSCA?

The tool is a contractor-developed, custom-built application with the exception of the integrated Cognos BI software, which is the reporting engine for the web tool.

2) Is there any incumbent vendor who is currently developing/maintaining this Budget web tool? Please name the incumbent(s) involved.

The incumbent vendor is Deloitte Consulting LLP (formerly BearingPoint, Inc.)

3) Where is the system currently hosted?

The web tool is currently hosted in one of the incumbent vendor’s hosting facilities.

4) Is the system’s accreditation tied to the hosting environment?

No, accreditation is required regardless of the location or “ownership” of the hosting environment.

5) Is it acceptable to DSCA if the prime vendor subcontracts the hosting portion of the project to a vendor that specializes in that area?

While it is an “acceptable” approach to subcontract the hosting services, DSCA prefers that the prime vendor directly provide the hosting services as this is a critical component of the requirement. DSCA believes subcontracting this requirement will likely introduce certain risks that may impact performance. If the offeror’s approach includes subcontracting this component of the requirement, then the proposal should provide the following:

· Name of the subcontractor

· An overview of the company and an outline of the services it provides

· An assessment of the facility and services relative to Information Assurance requirements

· A list of at least five current customers and the scope of the support provided to each, which is similar to or greater than that required in the solicitation

· An assessment of the prime/subcontractor relationship that demonstrates the mitigation of risk

6) What is the current size of the database? How many tables, triggers and stored procedures, etc. are part of the schema?

The database is currently 2.63 Gigabytes. There are currently 109 tables, 40 views, 350 stored procedures and 13 functions associated with the web tool.

7) How many reports (Cognos) are being generated by the current application? What percentage of these reports would be considered complex? How many modifications to the reports occur during each release?

The tool currently has 28 Cognos-based reports. Approximately ten or 36% could be characterized as complex. Also, other factors that make the reporting complex are the type and relationship of data and, therefore, the metadata model and the number of report views necessary to support the business requirements. The number of modifications to reports varies in each release. On average there are four report requirements per release.

8) What is the current architecture of the application?

The current application is a 4 tier framework, that consists of SQL Server 2005 as the data layer and uses .NET 3.5 in all other tiers (UI, BLL, DAL) as well as Windows 2003 IIS. There are currently no 3rd party frameworks or tools being utilized other than the custom application code that is being maintained by the current vendor. WCF is not considered the backbone of the application, but there are several XML Web Services that are utilized to varying degrees, although it should be noted that those services are only consumed from the application and not from external parties. The architecture contains several areas of code that pertain to system performance and availability monitoring. Those values are then utilized to determine overall system performance metrics and health. Based on the collected performance metrics, areas of the system can be isolated for performance improvement. Since the architecture is component based and tiered, performance improvements can be made in a small compartmental fashion.

9) Please provide a high-level overview of the existing server architecture, including number of virtualized servers, communication paths, and service capacities?

The production environment is currently hosted in a VMware, load-balanced server farm using two virtual servers (one database and one web with a firewall in between) with switch over failure capability. Communication between the servers is controlled via a gigabit switch. The pipeline in/out is via a T3 connection. Direct access to the servers is accomplished via VPN connection. The current configuration represents the minimum requirement and should not necessarily be considered the solution. Offerors should detail in their proposal the solution for meeting the web hosting service requirements to include Information Assurance compliance.

10) What is the approximate load on the system, in terms of page requests per hour and database requests per hour?

On average, there are 800 database and 75 page requests per hour. During peak processing times, there can be over 1000 database and 125 page requests per hour.

11) What mechanism/tool does the current system use for online help?

The online help is a feature of the application itself. It is a custom HTML-based delivery mechanism with data stored directly in the database.

12) What is the current process followed to generate test scripts? Are you using any tool(s) to test the application?

Test scripts are prepared manually on a per requirement basis and executed manually through both unit and regression testing. There is a third party tool that is applied to test web security and vulnerabilities prior to production release.

13) Can DSCA provide either a current user manual or any use case documentation for the application to assist in designing an effective solution?

DSCA believe paragraph 5 of the solicitation provides adequate information regarding the tool to provide an effective proposal. To be clear, the requirement is to provide maintenance and enhancements (when requirements dictate) for the existing tool. This is not a consultative and wholesale design/re-design where more in depth knowledge of the existing application may be necessary to appropriately scope and respond to that type of effort. A use case example is attached, which is indicative of the scope of this type of documentation.

14) Approximately how much time is allocated for an average production release?

The average production release cycle is approximately 6 weeks.

15) How many releases are envisaged in a year? What is the approximate magnitude of each enhancement (In terms of UI, Business logic, Database, etc.)?

The average number of standard releases is approximately eight per year. The magnitude, in terms of the items listed, is highly dependent on the specific enhancement. In general and on average for a particular enhancement, there is a 50% impact to the user interface, a 30% impact to business logic, and a 20% impact on the database.

16) How much time does DSCA need to verify each release given by the contractor?

In terms of government testing prior to production release, the amount of time is contingent on the scope of the changes in the release. On average, government testing time is approximately 3 business days.

17) How many resources (development, Testing, DBA and Systems Support) are currently supporting this application and their roles?

There are approximately two full time equivalents (FTEs) that provide a range of development, testing, DBA, systems, and management support for the application exclusive of individuals involved in web hosting activities. The aforementioned information is provided for historical perspective. The requirements in the solicitation should be the basis for the resourcing provided in the solicitation response.

18) For transition planning purposes, approximately how many developer-hours are currently spent on maintenance for the application?

There are approximately two full time equivalents (FTEs) that provide a range of development, testing, DBA, system, and management support. A rough estimate of the percentage of time targeted to development and testing is 75%. The aforementioned information is provided for historical perspective. The requirements in the solicitation should be the basis for the resourcing provided in the solicitation response.

19) In maintaining this system, what percentage of work will involve in maintaining current use cases as compared to creating new use cases?

On average, 65% of the work is maintenance related and 35% is directed to new requirements.

20) What is the metric used for determining error rates in use cases (90% error-free drafts, 99% error-free final versions - object 4.1.2)

Draft version error rates will be determined based on number of changes required to scope content (which as a result of a preceding requirement meeting were not adequately or accurately addressed ) and spelling/grammar (which is based on total document word/sentence count). Final version error rates will be determined based on the proper incorporation of changes and comments provided as a result of the draft review.

21) What is the baseline for the 20% efficiency gain noted in objective 4.3.1? Is the 20% efficiency gain system-wide, or just in the database subsystem?

The baseline is determined based on load testing prior to major database efficiency projects and the percentage gain is measured against the database subsystem.

22) Other than US citizenship, are there other security qualifications for personnel that will work on this project?

No, there are no additional security qualifications (e.g. security clearance). However, the data contained in the web tool is For Official Use Only/Sensitive But Unclassified designated and proper handling and dissemination is required as outlined in paragraph 6 of the solicitation.

23) After reviewing the RFP, our team has noted that several pieces of software are required to execute specific task orders. For example Cognos, SQL Server 2005, and Windows 2003 are necessary to the task items. We did not note the any mention of licensing cost requirements. Should our team consider the cost for specific licenses or shall we assume there is no mention of it, due to the fact that the contract is FFP with cost reimbursable?

The only recurring licensing requirements and costs that currently exist and are chargeable to the contract are for Cognos BI license maintenance, which is a billable reimbursable cost of approximately $22,000 per year. Also, there are incidentals such as Web Site address registration and SSL Certificate costs that are billable reimbursable costs and covered under a $1,000 incidental line in the contract.