The file's text, extracted by GovTribe without its formatting.
UNCLASSIFIED // FOR OFFICIAL USE ONLY
PPML Software Development Services Solicitation # HQ0034-17-R-0127 Questions and Answers Amendment 01
| Question # |
| Question / Comment |
| Government Response |
| 1. |
| Based on Enclosure 1, Item 1.0, Point b on Page 8 of the PWS (regarding process model packaging scenarios), our understanding is that the development requested in this PWS pertains to development of the “repository and meta data management and search” and not to development of a “process model design engine”. Can you confirm this understanding? |
| The understanding is confirmed. |
| 2. |
| It is our understanding that actual modifications to the process models themselves will/can be performed in their native application (e.g. Appian, Adobe or other such design products). Can you confirm this understanding? |
| Any modifications will be done by the model owners within the native application or by subscribers who download the models within applications or tools of their choosing. Any such modifications will be external to the PPML. |
| 3. |
| Can you provide a list of the current known process model design applications being used throughout the user community? |
| A partial list can be provided at the time of award to begin the initial effort. Identifying the full spectrum of existing process models to be incorporated into the application will be inclusive to the contractor effort in the development phases. During the operations and sustainment phases the contractor should be prepared to incorporate procurement process models submitted by process owners desiring to share their process model in the PPML environment. |
| 4. |
| Will there be input into the design and development from groups/departments/agencies other than the DoD? |
| No. |
| 5. |
| Is multi-tenancy on the roadmap for this development? (In support of data and access segregation for different organizational entities.) |
| No. |
| 6. |
| Is there an estimate of the number of models that are expected to be cataloged? |
| No. There is no specific, quantitative estimate of the number of models expected to be cataloged in the PPML at this time. The Government does intend to provide an initial list of existing process models to be cataloged in the PPML. This will be part of the data conversion effort mentioned in the PWS Section 6.5. |
| 7. |
| How many users are expected to have access to this system? |
| 500-1,000 |
| 8. |
| How many organizations are expected to have access to this system? |
| 75 |
| 9. |
| Please confirm that the Proposal Adequacy Checklist is not intended to be submitted with the proposal. |
| 252.215-7009 Proposal Adequacy Checklist has been removed from the solicitation. |
| 10. |
| Please confirm the due date of Sunday, August 13 at 2:00 pm. |
| The due date has been extended to Thursday, August 17 at 3:00 pm. |
| 11. |
| Please confirm the number of copies required, as the solicitation states:“original and 1 copy.” Sect. L.3.10 states: “Offerors shall provide three hard copies of their proposal in three ring loose leaf binders.” And Sect. L.3.11 states: “The Offeror shall submit two complete copies of the proposal in electronic format using non-rewriteable compact disks (CD-R).” |
| The requirement of L.3.10 has been removed from the solicitation. |
| 12. |
| Has the data classification for the patterns and artifacts in the PPML been determined? If the data is CUI, does DFARS clause 252.204-7012 apply? |
| All model data furnished to the contractor to support software development will be unclassified. No CUI will be provided. |
| 13. |
| Will the solution require CAC authentication to enable sign-on capability? In Enclosure 2, 1.1 Use Case: Manage Subscribers, Basic Flow step 10, Subscriber accesses the PPML login page and establishes user name and password. Does this mean that the application does not need to comply with DoD requirements on strong authentication? The Preconditions note that the prospective subscriber must be a government employee or a contractor employee affiliated by a government contract, so normally they would have a PIV/CAC for identification. |
| CAC authentication is required. |
| 14. |
| Can the government please clarify which "business rules" are being referenced under Use Case: Submit Process Model? The PWS states, "This use case works against a “draft” record already in the system. Using the given record, the process owner and the librarian validate the record against the business rules, and makes the record visible to reports and other users." |
| The business rules are found in Section 4.0 of the PWS. |
| 15. |
| There is a stated 3 page limit for the executive summary. The instructions indicate that the acknowledgement of amendments does not count toward that page count. Additional information is also requested in a cover letter in section L.4.1, residing in the executive summary section. Should vendors assume that the entire cover letter does count toward the 3 page limit? |
| Yes. Also, a compliance matrix has been added to the executive summary which does not count towards the page count. |
| 16. |
| The due date is stated as August 13, 2017, which is a Sunday. Because hardcopy deliverables need to be provided, recommend the Government change the due date to Monday, August 14, 2017. |
| See the answer to question #10 |
| 17. |
| Is the requirement in 5.3 to edit or alter key properties of the artifacts to be read as changes to the artifacts themselves, or as changes to the metadata for the artifact? |
| It is envisioned that these will be changes to the artifacts themselves by a subscriber that is adapting an artifact to its processes. |
| 18. |
| What are the elements of 6.3.6 A013 Network Security Plan? How does this relate to the larger System Security Plan required by the RMF, especially since the network will be the responsibility of the hosting DoD Procurement Environment? |
| Cybersecurity/software assurance is addressed in software development planning per Paragraph 3.7.d.2. of DI-IPSC-81427B, Software Development Plan (SDP). Also, offerors who demonstrate familiarity with the DoD Risk Management Framework (RMF) articulated in DoD Instruction 8510.01, “Risk Management Framework (RMF) for DoD Information Technology (IT),” March 12, 2014, Incorporating Change 1, Effective May 24, 2016, and have incorporated compliance with RMF or an equivalent risk management process in their planning and technology implementation shall receive more weight. See Section M.3.1. Element C: Quality Control Plan. |
| 19. |
| For environments where DoD PKI mechanisms are expected, what trust should be assumed as acceptable, e.g. DoD trust anchors only, ECA PKI trust anchors, or DoD Approved External PKI Trust Chains rooted at Category I, Category II, or Category III? |
| Since the PPML will have CAC enabled access, the trust level is expected to be “DoD trust anchors” only. |
| 20. |
| Is there legacy content the successful firm will be required to migrate over to the PPML? |
| Yes. |
| 21. |
| The PWS requires development of several documents under Section 6.3 and listed in Section 8 as deliverables including Functional Requirements Document, Database Design Document, Interface Control Document, Software Requirements Specification, Requirements Traceability Matrix, and Network Security Plan. These documents are also identified in CLIN 0003, however CLIN 0003 is marked as 'optional'. Is CLIN 0003 optional? If so, the PWS tasks and deliverables should also be noted as optional. Note the same issue occurs for CLINs 0004, 0005, and 0006 all of which are marked as optional in the Solicitation but appear to be firm requirements in the PWS. |
| The Government intends to exercise the options pending successful conclusion of the Critical Design Review. The PWS reflects the total requirements for the PPML, while the CLIN structure reflects the Government’s approach to manage the contract performance risk. |
| 22. |
| The PWS refers to a 'Software Requirements Specification', while the CLIN refers to a 'Software Specification'. Are these the same document? If not how do they differ? |
| They are the same document. The CLIN description has been updated to read 'Software Requirements Specification'. |
| 23. |
| Will the successful firm also be expected to provide the hosting? |
| No. |
| 24. |
| CLIN 0001 refers to a milestone payment for 'Offeror's Design Approach'. We cannot determine how this ties to the PWS requirements and deliverables - we don't see a task to create a Design Approach or a matching deliverable. What effort would be included under this CLIN and how will it be determined to be complete? |
| CLIN 0001 ties to the requirements in Section 6.1 of the PWS and the Solicitation Section M3.1, Criteria for Technical Factor, Element A: Technical Approach and Methodology, that "Proposals shall describe the PPML offeror's understanding of the requirement, assessment of the objectives to be accomplished, and methodology for accomplishing the requirement." The Government desires to review the contractor's documentation, shortly after award, that demonstrates the contractor's initial conceptual design and development/production/sustainment approach that it described in the proposal. CDRL ELIN A005 can be used as a guide for preparation of the design approach documentation. |
| 25. |
| The pricing instructions state "The cost details should display the unburdened labor rates for each category applicable and the wrap rate (indirect rates) used to derive the overall price." Is it correct that this instruction applies only to the CPFF CLINs, and that for the FFP CLINs only the fully burdened rates used to create the price need to be provided? |
| The requirement originally found at L.4.4 (d) v. has been removed from the solicitation. |
| 26. |
| Will classified information be housed in the PPML? |
| No. |
| 27. |
| These CLINs appear to be very similar with one titled 'Testing Support' and the other titled 'Test Reports' and each with the same milestones. Both appear to be tied to the effort described under PWS 6.4. Please clarify what effort should be priced under each CLIN, or whether the CLINs should be combined. |
| The CLIN Testing Support provides for the test planning activities. The CLIN Test Reports provides for the performance and reporting of the testing. |
| 28. |
| Does the enterprise procurement hosting environment exist, if so, can more details be provided on it? (i.e. Servers, Operating Systems, Content Management system running on it if any, databases running on it if any?) |
| The current hosting Procurement Integrated Enterprise Environment (PIEE) will be incrementally maturing and will provide the high level of flexibility, control and convenience of the Cloud. The environment will enable Single Sign On and host various procurement related custom applications that will cover a wide variety of technical stack, including open source products. The PIEE will cater to the PPML solution. |
| 29. |
| Is the government providing the environments hardware (servers) for development, testing, UAT and Production? Will the service provider have to provide such environments to support the development efforts? |
| The contractor will provide the development environment. |
| 30. |
| Will the service provider have to provide development, test and UAT environments and help the government procure and set up the production environment? |
| Yes. However, UAT will be in Government environment. |
| 31. |
| Will the government consider an implementation using AWS cloud? |
| No. The PIEE is being established at an IBM cloud facility. |
| 32. |
| If any the government will be responsible for software licenses cost? |
| No – this system solution should be completely free-of-charge to users. |
| 33. |
| At the very list the government will be responsible for the purchase of non-wildcard SSL certificate to minimize risks associated to operations over the internet in accordance with 4.2 last bullet point? |
| The developer is expected to provide the total capability for the system. |
| 34. |
| If the government providing any environment (servers, database etc.) what operating system will be installed on these servers? |
| The Operating System need is dependent on the PPML solution and is not limited. |
| 35. |
| Will the government envision this application running in more than one server per environment? (e.i.one or more front end servers, one or more database servers, one or more services servers ) |
| No. The Government anticipates one server to host the PPML but is open to an innovative PPML solution and is not restricted to one server. |
| 36. |
| How flexible will the government be in respect to fault tolerance and performance in such environment? |
| See response to Question 35. In any server environment, the Government will have very little or no flexibility to tolerate faults or substandard performance. |
| 37. |
| Will disaster recovery plan development be a requirement for the implementation team? |
| No. |
| 38. |
| Does the application have to be 508 compliant? |
| Yes. |
| 39. |
| Does the application requires to be mobile friendly? |
| No. |
| 40. |
| Is the government they trying to open source everything that is developed by the contractor and then let everybody else contribute to it? Or is the government talking about the content that goes into the system is open-source? |
| The application should employ open source standards and software and preferably not require proprietary licenses. The artifacts stored in the library may have been developed using a variety of proprietary formats, but the content developed with government funds, thus the government has general purpose rights to that content. The plan is to store those artifacts in their initial format and if modified by a user, those formats might be: 1) enhanced in the original format or 2) converted to BPM notation format or 3) a different format at the discretion of the user. The library will not impose a standard on the format of the artifacts. |
| 41. |
| Is the ultimate goal to build a service integration platform rather than an application? |
| No. The government intends to manage this application within a larger integrated PIEE. |
| 42. |
| Can we get a sample of these “process models”? Are these just document or actual algorithms that need to be executed on DoD’s side? |
| A sample will be provided upon contract award and include documents and actual algorithms. |
| 43. |
| Are any of the mentioned actors external to the organization? Are there any security requirements related to these users accessing the solution? |
| The actors are internal to the DoD or DoD-sponsored external business partners. All actors are subject to the same security requirements. |
| 44. |
| How many users will use the solution or will require onboarding to the solution? |
| 500-1,000 |
| 45. |
| Is there an access management solution already in place or is it assumed this would be part of the open source solution? |
| The PIEE will provide a single sign on (SSO) capability as it matures. However, the vendor should provide a pluggable access management solution that can be decoupled once the PIEE SSO matures to support at the enterprise level. |
| 46. |
| Is this solution stand alone, does it require integration into a larger enterprise solution? |
| Although the PPML is stand-alone, the Government may elect to utilize integration with the PIEE SSO, which is currently under development. |
| 47. |
| Reference Paragraph 3.3. Any requirements regarding performance or usability? |
| No. |
| 48. |
| Reference Paragraph 5.1. “Any proprietary artifact that can be run directly by a computer’s hardware with no further processing will not be registered.” Please provide clarification to this statement. |
| Any model that requires a license will not be registered in a format that would permit operation of the model without purchasing the license. |
| 49. |
| Reference Paragraph 5.4 Data from business process management tools can be exported in Business Process Model Notation (BPMN) format. Are these standards validated manually by the administrator or librarian? |
Models would be registered in the PPML and downloaded from the PPML in their native format. The librarian should confirm that artifacts are loaded successfully.
| 50. |
| Reference Paragraph 5.5 The initial release of the system will be deployed in a government specified computer environment accessible as a web service to registered subscribers. Is the government envisioning a tool that will translate Business Processes to BPMN? |
| No. |
| 51. |
| Reference Paragraph 6.1 “… and launch a PPML software application using open-source software…” Does this means that the initial release of the tool should not have a user interface (UI)? |
| No. |
| 52. |
| Will classified information be housed in the PPML? |
| No. |
| 53. |
| Reference Paragraph 7.0. Will the government be following industry standards that set forth one development, one testing and one UAT environment? |
| The developer is expected to select the appropriate standards for its solution. |
| 54. |
| Reference Paragraph 9.0 Government Furnished Information. ***Please confirm this is an option and not part of the basic requirements |
| The Government will furnish a sample of models upon contract award. They will be documents and actual algorithms. |
| 55. |
| How many different formats and how many process models does the government envision to provide? |
| The Government is in the process of selecting a sample. |
| 56. |
| Will that be the total of formats and process models that the application will need to import the data from? |
| The sample will be representative. The applicable business rule is; Structured Representation Formats. Any process model that contributors can provide will be accepted. Any structured representation formats, e.g., xpdl, pnml, epml, bpmn, xml, and unstructured information, e.g., txt, ppt, pdf, xls that can describe a process model, such as text documents, bitmap pictures of process models, and diagrams drawn in Power Point or Visio, will be permitted. |
| 57. |
| Reference E1 1.0 d “…The classification of a process model will be extendable to subscribers’ desires, where applicable.” Will PPML be the only source for Process Models import/export for the DoD? |
| No. Model owners could have capabilities for import/export within their process operations. PPML would be a central source for model discovery for procurement. |
| 58. |
| Does it mean a process model can have more classifications than the ones stated above? And those classifications will be added by editors at will or by an stablished process? |
| Any model registered in the PPML will be classified by the PPML standard metadata, notwithstanding any other classification that may exist. |
| 59. |
| Reference E1 4.0 h “…comma-separated values file import…” For communications between the different actors can the government provide an email server that can and will be used by the application implemented? Will the government pay the licensing fee for an email server? |
| There is no expectation that the system will include or employ an email capability because there is no intent to manage any workflow or other communication process between users in the library. |
| 60. |
| Reference “…or an XML transaction”. Can this option be de-scoped? Seems vague to upload a process solely based in a coma delimited file and if so the expectation will be that the user will have to edit the process in the PPML UI? |
| The software developer determines the model upload process as part of its solution. |
| 61. |
| Reference E1 8.0 b. XML Transaction? Does a service has to be exposed to ingest metadata? |
| The software developer determines the model upload process as part of its solution. |
| 62. |
| Reference E2 1.0 Table 6. Will the subscribers be surveyed on the usefulness of the process model based on a 1 to 10 criteria? Will the results of the survey be displayed on the PPML to all users?) |
| See Section 1.8.c. “A mechanism shall be established for obtaining online feedback from subscribers on the usefulness of models downloaded from the library.” Survey results would be displayed to all users. |
| 63. |
| Reference E2 1.3 Flow of Events. Post condition 1. Retire a process model data record need to be visible to subscribers? Please clarify. |
| The question relates to E2 1.6. All PPML records associated with a registered model would be visible to the users of the model. |
| 64. |
| Reference E2 1.4 Basic Flow, Step 4. There will be NO update functionality available for Process Models? Please clarify. |
| The process model owners would update the models in their own environments and register the updated model as a separate version. |
| 65. |
| Reference E2 1.4 Extension Point: Add Historical Update. Will this add a new record to the Db with a new version number and flag the previous record as updated? |
| Yes. |
| 66. |
| Reference E2 1.6 Flow of Events. Post condition 1. Do users have the ability to update previous records of a process model? If so, does the record updated becomes the top record for the process model or just stays updated at that point in time record? Also is it required to show what the change was to users? |
| The process model owner can update a point in time record of a process model. The update may or may not become to top record for the process model, depending on the nature of the update as determined by the process model owner. The system keeps a link from the new updated model with the older version. The system adds an audit record showing the subscriber making the change, the date and time of the change, and the values captured in the change. |
| 67. |
| Reference Request Report. So no update to a record to indicate retirement but new record added indicating that process has been retired? |
| Yes. |
| 68. |
| Reference View Report Holding Area. What would be a predefine report? Will the government provide example of data needed for these reports?) |
| The intent is for the developer to determine useful predefined reports. |
| 69. |
| Reference E2 1.7 Table 8. Saved reports intent for queried only values or data queried at some point in time, who have rights to save reports? |
| Any subscriber could view saved reports. |
| 70. |
| What is: “The system properties and data?” |
| System properties are the metadata elements that describe the library itself. Data are the model records themselves and the meta data that describe them; and the data elements within models and their associated metadata. |
| 71. |
| “Enterprise-wide licenses will be issued to subscribers of the PPML. It is envisioned that a libre license approach will be used. With a libre license, the owner of the rights to a resource grants subscribers the freedom to read it, to learn from or with it; to copy, adapt and use it for any purpose; and to share derived works for the benefit of the community”. |
Please clarify the above statement. Is the government trying to open source all aspects of what is developed by the contractor and then let everybody else contribute to it, or is the government referring to the content that resides within the system as open-source?
Please see the response to Question #40.
| 72. |
| “The PPML system will be a web-service application within an enterprise procurement hosting environment” |
Is the government trying to build a service integration platform rather than an application?
No. The government intends to manage this application within the larger integrated PIEE.
| 73. |
| Can a sample of these “process models” be provided? Are these just document or actual algorithms that need to be executed on the government’s side? (Enclosure 1 – PPML Functional requirements) |
| A sample will be provided upon contract award. The sample will be representative. The applicable business rule is; Structured Representation Formats. Any process model that contributors can provide will be accepted. Any structured representation formats, e.g., xpdl, pnml, epml, bpmn, xml, and unstructured information, e.g., txt, ppt, pdf, xls that can describe a process model, such as text documents, bitmap pictures of process models, and diagrams drawn in Power Point or Visio, will be permitted. |
| 75. |
| The proposal due date is listed as 13 August 2017 2 PM. Since this is a Sunday, can the government confirm that the intended due date is 14 August 2017? |
| See the response to question #10. |
| 76. |
| Where will the PPML be hosted (e.g. private, 3rd part service, internal servers)? |
| Please see the response to Question #31. |
UNCLASSIFIED // FOR OFFICIAL USE ONLY
DOD Washington Headquarters Service