IVA_SOLICITATION_QUESTIONS_and_ANSWERS_06212013.pdf

In

Solic ndividua citation al Ident

H n Que tity Ver Suppo

HSFE80

Procure estions ification ort Serv

0-13-R-ement Sensit s and n and A ices

-0005 tive

Answ

Authenti wers ication

Solicitation HSFE80‐13‐R‐005 Identity Verification and Authentication Questions and Answers

2 | P a g e

1. Referring to Factor 1, what is the current or historical “success rate” performance for identity authentication?

Response: The success rate is 99%.

2. Referring to Factor 1, for the request for an “Investigation Tool”, will the functionality required be 100% electronic batch transmissions or is a desktop query-by-query functionality also needed?

Response: Section 5.5 Investigation Tool will be deleted from the Statement of Work and the requirement.

3. Section 5.1: Can FEMA provide a complete list of all required data elements that are to be provided to FEMA in response to both an identity verification request and for an identity authentication request? What initial data will be provided to the contractor by FEMA as part of the identity verification request and as part of the identity authentication request?

Response: Refer to SOW Section 16.0, Pg. 16-17.

4. Section 5.1: Can FEMA clarify the relationship between the requirement to “scale to support transactions from a maximum of 750,000 concurrent users” and the “ability to surge to support load capacity of 25,000 transactions per hour”? It is likely that 750,000 concurrent users would generate a load capacity in excess of 25,000 transactions per hour.

Response: Capacity of this level is not representative of steady-state or normal business operations; however, the vendor’s infrastructure must be able to handle load capacities of this magnitude in the event of a catastrophic disaster were to occur and survivor demand surges significantly beyond the steady-state capacity.

These instances may be rare but survivor application processes are dependent upon the availability of these services. The inability to handle load capacities of this magnitude could significantly delay FEMA’s ability to process aid to survivors.

5. Section 5.1: Can FEMA clarify the requirement to use IVR data supplied by FEMA to pre-populate call center screens? How will this data be provided to the contractor, and how is the contractor expected to pre-populate call center screens that are not provided by the contractor?

Response: FEMA would provide the same information used for identity verification and for non IVR based pre-population, using the data transfer mechanism established with the contractor. The contractor will provide pre-population data through the same mechanism. FEMA would be responsible for populating the call center screens in our application.

Solicitation HSFE80‐13‐R‐005 Identity Verification and Authentication Questions and Answers

3 | P a g e

6. Section 5.2: Can FEMA please provide a complete list of all required data elements that are to be provided to FEMA in response to a vehicle search request? Response: Vehicle Make, Model and Year.

What initial data will be provided to the contractor by FEMA as part of the vehicle search request?

Response: Applicants & Co Applicants First, Last Name

7. Section 5.2: Can FEMA provide the permissible purpose under DPPA (Drivers Privacy Protection Act) that would apply to the provision of this data?

Response: Personal information referred to in subsection (a) shall be disclosed for use in connection with matters of motor vehicle or driver safety and theft, motor vehicle emissions, motor vehicle product alterations, recalls, or advisories, performance monitoring of motor vehicles and dealers by motor vehicle manufacturers, and removal of non-owner records from the original owner records of motor vehicle manufacturers to carry out the purposes of the Automobile Information Disclosure Act, the Motor Vehicle Information and Cost Saving Act, the National Traffic and Motor Vehicle Safety Act of 1966, the Anti-Car Theft Act of1992, and the Clean Air Act, and may be disclosed as follows:

(1) For use by any government agency, including any court or law enforcement agency, in carrying out its functions, or any private person or entity acting on behalf of a Federal, State, or local agency in carrying out its functions.

8. Section 5.3: Is FEMA aware that this type of insurance data is not generally available and that the bundling of this requirement will impact the number of competitive responses?

Response: Aggregate Insurance Data is generally available but may require special agreements with the insurance industry.

Would FEMA be willing to acquire this data directly and provide this to the contractor as Government Furnished Data?

Response: No

9. Section 5.4: Is FEMA aware that this type of insurance data is not generally available and that the bundling of this requirement will impact the number of competitive responses?

Response: Homeowner’s Insurance Information is generally available but may require special agreements with the insurance industry.

Would FEMA be willing to acquire this data directly and provide this to the contractor as Government Furnished Data?

Solicitation HSFE80‐13‐R‐005 Identity Verification and Authentication Questions and Answers

4 | P a g e

10. Section 5.6: Can FEMA clarify what assumptions the contractor should use to price this requirement since there will be a separate SOW released for each technical assistance task order?

Response: Section 5.6 Technical Assistance will be deleted from the Statement of Work and the requirement.

11. Section 5.6: Can FEMA please confirm which fraud indicators listed are to be delivered as part of 5.1, or are these only to be supplied under separate task orders to be issued under section 5.6?

Response: Section 5.6 Technical Assistance will be deleted from the Statement of Work and the requirement. Refer to Section 16 to determine which fraud indicators are to be delivered.

12. Section 5.6: Applicant has Previously Submitted a Fraudulent Application. Will FEMA allow the Contractor to check Government databases by allowing the Contractor to send an inquiry to those databases to confirm fraudulent activity? Or will the Contract receive regular updates from Government databases that they will be responsible for housing and then use that data to confirm fraudulent activity?

13. Section 16: Can FEMA confirm whether or not owner/occupancy verification, the renter occupancy verification, and the residency status are required under this SOW? If so, can FEMA please insert these requirements in the relevant section of the SOW, as there are no CLIN’s associated with these requirements? Are they bundled with Identity Verification or Identity Authentication?

Response: Yes, these are required under the SOW of Section 16. Yes, they are bundled under the Verification on Identity CLINS.

14. 5.1 Identity Verification and Authentication Services Is the FISMA compliance required to be maintained at low, moderate, or high level of security?

Response: The FISMA compliance is to be maintained at a high level of security.

What information is collected via the IVR? Should we assume it is the same applicant information that is collected from an online submission?

Response: Currently, the name, address, phone, social security number and DOB are collected via the IVR; therefore, the assumption is correct.

How will the IVR information be transferred to the Contractor?

Solicitation HSFE80‐13‐R‐005 Identity Verification and Authentication Questions and Answers

5 | P a g e

Response: Through the same data transfer mechanism as all other data. Refer to the “As-Is” process, Section 16.0 of the SOW. Graphs and flowcharts are below.

Will the Contractor have to convert the IVR information from a .wav to a text format?

Response: No. FEMA will perform any conversions within our system and send data in the same format using the same data transfer mechanism as all other data.

Does FEMA request that additional natural language-processing routines be performed on the IVR data?

Response: No.

Will the analysis of the IVR information by the Contractor be billable?

Response: The contractor does not need to provide analysis of the IVR information, this is information the contractor will use to provide pre-population of data. The pre-population of the data is billable under the Verification on Identity CLINS.

How will FEMA assess the contractor performance meeting the standard of “near perfect performance” in fraud detection?

Response: The contractor shall track and provide FEMA with metrics on success rates for verification and authentication services. Additionally, pass / fail rates for authentication quiz questions shall be tracked and provided to FEMA for review, with the flexibility of adjusting the set of questions offered by eliminating questions with low pass rates.

Given the request for 750,000 concurrent users and 25,000 transactions/hour, will FEMA's own production environment (which supports 30,000-45,000 concurrent users) be a limiting factor?

Response: FEMA’s production capabilities are migrating to a scalable virtualized environment which will expand the capacity levels beyond its current infrastructure as demands increases. While FEMA’s production environment and staffing can be a limiting factor, the agency has a robust surge plan that can significantly increase the number of concurrent users. Additionally, there is a proven trend for applicants unable to contact us through the call center to attempt mobile and internet registrations. Historical capacity of our system should not be considered as a fixed ceiling.

Is the current transactional data from the application source systems run through a data quality routine?

Response: FEMA performs address correction on registrations. Other data is sent as provided by our registrant.

15. 5.4 Homeowner’s Insurance Information This section states, “All information that will be obtained by FEMA will be saved in order to help make a determination on the applicants request for assistance.” Does this refer to all information collected on an applicant, or all homeowner’s insurance information?

Solicitation HSFE80‐13‐R‐005 Identity Verification and Authentication Questions and Answers

6 | P a g e

Response: All homeowner’s insurance information

Does this information need to be pulled in the disaster assessment phase, or only upon application?

Response: Section 5.4 Homeowner’s Insurance Information is during the application. It should be noted that 5.3 Aggregate Insurance Data is for the assessment phase in which FEMA would like to receive the following data:

Type of Policy (flood, homeowners etc.)

Type of Coverage

Status of Policy

16. 5.6 Technical Assistance How soon after the task order or modification is in place does FEMA expect the

Contractor to begin work on the new project?

Response: Section 5.6 Technical Assistance will be deleted from the Statement of Work and the requirement.

What information should be available in the case reports?

Response: Section 5.6 Technical Assistance will be deleted from the Statement of Work and the requirement.

The SOW references "end-to-end workflow" and "case management functionality". Is the vendor supposed to supply this capability?

If so, is the vendor then where should the cost for such a system be incorporated in the matrix because there is no separate line item.

17. 13.3 Multiple Application Report Is the weekly multiple application report expected to comingle all disaster applicant data onto one report, or will each disaster require its own report?

Response: Section 13.3 Multiple Application Report will be deleted from the Statement of Work and the requirement.

18. General . Is there a requirement for an offline mobile application? How would inclusion of such an option be assessed in terms of scoring?

a. Is the contract resulting from this RFP open to other Government Agencies for services?

(For example, HUD?)

Solicitation HSFE80‐13‐R‐005 Identity Verification and Authentication Questions and Answers

7 | P a g e

b. Will the contractor be allowed to query other government-DBs (IRS, SSA) as part of the solution? Which ones and what are the access methods (web-service, batch/real-time, etc.)?

Response: FEMA does not prohibit this. FEMA is not able to provide which agencies or methods to access.

c. Can you provide any information on how FEMA is currently handling the integration of the data sources (e.g., types of data, locations, transfer, and aggregation)? What level of integration exists today among the source systems?

Response: Based on FEMA understanding of the question provided, IV&A data is handled on a transactional basis with the vendor during each application via XML transfer. FEMA then stores the results of the data requests in FEMA’s Oracle database per transaction ID. FEMA sends a call for data with an identifier (i.e.:

Identity, Occupancy, Ownership, Insurance, Transportation, Combination of these) with PII fields included and then receives the results back from the vendor per request. FEMA currently deals with transactional registration data and does not currently have an aggregate data mechanism with the existing vendor. FEMA does not ask for multiple data forms for each transaction. FEMA sends a request (i.e.: to verify Identity) and the vendor shall use their data sources to determine if the Identity is passed or failed and send FEMA the pass/fail result.

d. Are dashboards in use today at the FEMA office? If so, are they in production status?

Response: We do have disaster dashboards as part of our business intelligence approach. We do not expect the successful offeror to develop dashboards for this contract.

e. Can you give an example of the end-user’s job title/description who need access to all of these systems in order to better perform the mission of FEMA?

Response: FEMA employees associated with providing assistance to disaster survivors under the Individuals and Households Program (IHP) would require access to the output of verification services.

19. Can the contractor proposed solution utilizing similar in place state verification and authentication systems?

Response: Offeror to provide their solution to meet SOW requirement.

20. Can the contractor leverage any existing agreements (federal, state, local) for authoritative data to support this procurement? If so, how do we capture and reflect the cost in our proposal?

Response: No. FEMA will only provide National Flood Insurance Information for Sections 5.3 and 5.4. Reference the Aggregate Insurance Data and Homeowner’s Insurance Data CLIN’s.

21. Is there an incumbent? Who provide this service today?

Solicitation HSFE80‐13‐R‐005 Identity Verification and Authentication Questions and Answers

8 | P a g e

Response: Yes, LexisNexis provides this service today.

22. SOLICITATION DOCUMENT -HSAR 3052.215. Please clarify if FEMA intends to specify roles for Key Personnel, or is asking the Response: Offeror to propose key roles. FEMA provided an example of an organizational chart for Key Personnel refer to the SOW 9.0 TRANSITION, CONTRACTOR STAFFING AND KEY PERSONNEL PLANS.

23. STATEMENT OF WORK DOCUMENT

a. Section 2: Please identify the OCONUS locations that need to be considered as within the scope of this contract.

Response: American Samoa, Guam, Marianas, Puerto Rico, U.S. Virgin Islands

b. Section 3, Section 5.1, Section 5.4: Please clarify the process which is planned for supporting “pre-population” of the registration form. At what point in the process does pre-population occur?

Response: Any Disaster Survivor applying for assistance through the call center generates a pre-population of information for various registration screens.

Does FEMA identify individuals for pre-population purposes, or alternatively is the contractor to identify homeowners in specified geographical areas?

Response: FEMA expects pre-population data to be available for potential applicants in all states, territories and other dependencies of the United States.

Where is the pre-population function to be bid on the pricing sheet?

Response: The pre-population for Vehicle Information shall be billed under the Vehicle Search CLIN and pre-population for IVR shall be billed under the Verification on Identity CLIN.

c. Section 5.1: Is authentication limited to only those applicants applying online?

Response: Authentication applies to those applicants accessing their Disaster Assistance Center (DAC) online account.

What percent of applicants have applied online versus through teleregistration?

Response: Since September 2011, 55% of all registrations have been processed via a teleregistrar, with the remaining 45% processed via the website and mobile devices.

For Hurricane Sandy, 57% of registrations were submitted via the website and mobile devices, with the remaining 43% processed by teleregistrars.

Solicitation HSFE80‐13‐R‐005 Identity Verification and Authentication Questions and Answers

9 | P a g e

d. Section 5.1: Please clarify whether the recommended quiz questions are considered as part of the page count.

Response: No; the recommended quiz questions are not considered part of the page count.

e. Section 5.1: Please clarify the role for the contractor in situations in which the applicant does not have necessary documents.

Response: There is no action for the contractor. The contractor only provides a pass/fail response. If a fail occurs the registration is flagged via business rules for FEMA to send the applicant a Request for Information to clear up the fail response which is part of their eligibility for grant assistance with FEMA.

f. Section 5.2: Please clarify the role to be fulfilled by the Offeror in terms of vehicle search requirements, as distinct from the cited ongoing development within FEMA. Please specify the information to be reported for a vehicle search.

Response: Offeror is to provide the Vehicle Make, Model and Year based on data provided by FEMA during the registration process.

g. Section 5.1 and Section 13.3: If the contractor is not bound to save information, please provide additional information regarding the requirements for the contractor to identify multiple applications, capture overall matrix measurement metrics and conduct metrics-based process improvement.

Response: Refer to section 5.1. Contractor shall not be contractually bound to save FEMA-provided information in their database but may store the transactions in the accounting system for the duration of the contract. Section 13.3 Multiple Application Report will be deleted from the Statement of Work and the requirement.

h. Section 5.1: Please clarify the nature of data capture associated with the IVR process, specifically, what data elements are collected, at what point in the process is it provided to the contractor, what percent of applicants provide IVR information, nature of platforms used and any unique interface requirements.

Response: Please refer to section 5.1.1 of the SOW.

i. Section 5.3: Please clarify the nature of the contractor prepared deliverable as it relates to aggregate insurance data; specifically, is the requirement for aggregate insurance data for a nationwide data delivery with quarterly updates? At what geographical level is the data to be aggregated? What data fields are required? Are we correct in assuming that FEMA, and not the contractor, be responsible for any analysis using this data?

Response: Data should be aggregated at the county level. Aggregate insurance data should include at a minimum types of policy (e.g. homeowners, renter contents, Solicitation HSFE80‐13‐R‐005 Identity Verification and Authentication Questions and Answers

10 | P a g e mobile home, flood insurance, condominium master, etc.), average policy limit, average deductible, and rate at which policies include Additional Living Expenses. FEMA would be responsible for analysis.

j. Section 5.4: Will FEMA provide the contractor with access to the National Flood Insurance Program Policyholder file as a source for residential flood insurance coverage?

Response: Yes

k. Section 5.5: Please clarify whether the Investigation Tool includes credit related data subject to FCRA.

Response: Section 5.5 Investigation Tool will be deleted from the Statement of Work

l. Section 5.6: Please clarify whether FEMA or the contractor is providing the generic rules engine.

m. Section 5.6: Please clarify the requirement for Service-Oriented Architecture (SOA) compliance, given the specification for an XML based interface.

n. Section 9: Please clarify if the Offeror is required to submit a Communications Plan and a Project Plan as part of the proposal. If so, are these plans subject to the 20 page total page limitation.

Response: Yes. This is a supplemental piece that will not count towards the page limitation.

o. Section 9: Is the Insurance Implementation Plan and Transition Plan subject to the 20 page limitation.

Response: Yes, the insurance implementation plan is part of the page limit but the Transition plan is not part of the page limit.

p. Section 16: Is renter occupancy verification to be one of the functions to be provided with a 6 second response time?

Response: Yes.

q. Section 16: Please clarify the specific contractor data requirements associated with renter occupancy and residency status. Will the contractor have automated access to E-verify to satisfy this requirement?

Solicitation HSFE80‐13‐R‐005 Identity Verification and Authentication Questions and Answers

11 | P a g e

Response: Refer to section 5.1 for requirements associated to renter occupancy and residency status. FEMA cannot provide access to e-Verify.

r. Section 16: Please clarify the meaning of the bulleted item “Submit Quiz (with quiz 10 as inputs).”

Response: Quiz 10 is a typographical error. It shall read Quiz ID. The Quiz ID, along with 4 questions are generated by the Contractor and provided to FEMA. The user answers the four questions and then FEMA sends back the answers along with the Quiz ID to maintain the association between the contractor service and the FEMA user. The contractor shall validate the question and answer combination and send back a pass/fail response to FEMA.

24. (Statement of Work– “Verified Address Does Not Match”) What does FEMA consider to be the “verified address” for the applicant? Is the Contractor to provide the most current address for the applicant and compare it to the damaged dwelling address? Or will FEMA provide the verified address?

Response: FEMA will pass the address provided by the applicant to the vendor for comparison.

25. (Statement of Work,– “Current Address Belongs to an Institution”) What does FEMA consider to be the “current address” for the applicant? Is the Contractor to provide the most current address for the applicant and compare it to the mailing address in the application for disaster assistance? Or will FEMA provide the current address?

Response: FEMA will pass the address provided by the applicant to the vendor for comparison.

26. (Statement of Work,– “Valid Dependent(s) in Household”) What is FEMA’s definition of a “non-dependent”?

Response: FEMA considers a non-dependent to be someone who is not claimed on the federal tax return.

27. One of the key questions we would like to know is if we have to be on the GSA schedule to respond?

Response: An Offeror does not have to be on the GSA schedule to respond to this full and open solicitation.

28. In terms of key bid milestones, we noticed that the response date was extended to June 13, 2013 via amendment modification number P00001. Does this also mean that the due date for posing any questions has been extended past May 20, 2013? If so, when is the new deadline for questions?

Solicitation HSFE80‐13‐R‐005 Identity Verification and Authentication Questions and Answers

12 | P a g e

Response: The question response date has not been extended.

29. Section 5.3 and 5.4 of the Statement of Work (SOW) Insurance Data

a. Please clarify whether the government is looking for an existing database or system, or is the government looking for a database/system to be created upon contract award?

Response: FEMA would consider either, but it must be operational within the 90 day time frame.

5.3 Aggregate Insurance Data: As FEMA needs access to the aggregated insurance data, it would be the offerors solution to determine if a new database to be setup from the vendor in order to house and provide the aggregated data.

b. Additionally, the second paragraph states that “The insurance data would be stored and accessed within the FEMA Operational Data Store (ODS) where the Reports and Analysis team would utilize the data for reporting and analysis. The data would be linked to data stored in the FEMA Mobile Enterprise Damage Assessment System (MEDAS) through street address and/or GPS coordinates in combination with current FEMA data.” Is the government requiring an interface be established with whatever database/system houses the insurance information, or would access to the system be sufficient?

Response: FEMA would need access to the data, and the ability to extract a subset of the data related to a particular disaster or event.

5.3 Aggregate Insurance Data: the preferred method would be for the vendor to establish an automated data feed from the source database to feed the FEMA ODS. This would ensure the most updated aggregated data set was being utilized by FEMA.

c. Please clarify how the government expects insurance data to be stored, and how the government intends to interface with the system.

Response: 5.3 Aggregate Insurance Data: FEMA will require the aggregated data to be stored within the FEMA ODS. The preferred method would be for the vendor to establish an automated data feed from the source database to feed the FEMA ODS. This would ensure the most updated aggregated data set was being utilized by FEMA. FEMA will be matching data obtained during the preliminary assessment phase (also housed within the FEMA ODS) with the aggregated insurance data to provide a more accurate estimate of the overall impact.

Solicitation HSFE80‐13‐R‐005 Identity Verification and Authentication Questions and Answers

13 | P a g e

30. SOW Section 5.2 VEHICLE SEARCH - “Utilize DMV records” indicates: “This capability is currently under development with FEMA.” Will FEMA provide this capability to the contractor?

Response: No. FEMA has not established policies or procedures for use of this data.

31. SOW Section 5.1 IDENTITY VERIFICATION AND AUTHENTICATION SERVICES states

“FEMA has a requirement to authenticate applicants who establish on-line (web-based) profiles and ensure that the applicant is who s/he says s/he is and has not stolen wallet information…” “In terms of strong Identity Authentication, FEMA requires level two authentication service. (See Attachment 5 NIST Special Publication 800-63 for more information). For example, FEMA authentication service uses a Personal Identification Number (PIN) and an authentication “quiz” that ask questions based on Personal Identifying Information (PII).”

This indicates the requirement to obtain a license under U.S. Patent 6,871,287, System and method for verification of identity (http://patft.uspto.gov/netacgi/nph- Parser?Sect1=PTO1&Sect2=HITOFF&d=PALL&p=1&u=%2Fnetahtml%2FPTO %2Fsrchnum.htm&r=1&f=G&l=50&s1=6,871,287.PN.&OS=PN/6,871,287&RS

=PN/6,871,287)

Has the government obtained this license, or will the contractor have to obtain this license?

Response: Seeking a license to this particular patent is not a requirement.

32. Regarding the proposal, would it be acceptable to use 10 point font and will the cover page be included in the page count?

Response: No

33. We have reviewed the information regarding "Identity Verification and Authentication" (Solicitation Number: HSFE80-13-R-0005) posted on FedBizopps.gov.

However, our collaborative team was unable to find information pertaining to the available funding amount so we can structure our budget accordingly.

Response: Information pertaining to the available funding amount will not be provided. However, Section 11.0 entitled “TRANSACTIONAL VOLUME” provides a historical range of annual applicants.

34. Vehicle Search, SOW Section 5.2: Section 5.2 of the SOW states “this capability is currently under development with FEMA”, will FEMA provide this capability to the contractor?

Response: No. FEMA has not established policies or procedures for use of this data.

35. Homeowner’s Insurance Information, SOW Section 5.4: Section 5.4 of the SOW states “utilize the homeowner insurance data received to pre-populate the Intranet Registration Intake application…” will FEMA be providing this data to the contractor?

Solicitation HSFE80‐13‐R‐005 Identity Verification and Authentication Questions and Answers

14 | P a g e

Response: No, the contractor shall provide this data.

36. System and Method for Verification of Identity License, SOW Section 5.1: Section 5.1 of the SOW states that in order to authenticate applicants who establish on-line (web-based) profiles and ensure that the applicant is who s/he says s/he is and has not stolen wallet information there is a requirement to obtain a license under U.S. Patent 6,871,287 “System and method for verification of identity. Has the Government obtained this license or will the contractor have to obtain this license?

Response: Seeking a license to this particular patent is not a requirement.

37. In Attachment 1 SOW Section 5.2 Vehicle Search, is there an additional purpose of obtaining Driver’s License registration other than for pre-population of application? Can you elaborate on the rational for requesting and verifying Driver’s License information?

Response: Not at this time. Obtaining this information will save time and improve the accuracy by eliminating typographical errors by Human Service Specialist during Registration Intake. Data returned may verify that an applicant does own a vehicle by providing a list of vehicles returned from DMV records and used as a drop down list of vehicles for the HSS to select from.

38. How many legacy Information Technology systems and applications are we expected to integrate with upon initial roll out?

Response: Refer to 3.0- Background and 14.0- Technical Environment of the SOW.

39. Is FEMA looking for a formal System Security Plan with this proposal or just an overview of the processes and capabilities at this time expecting that a complete Security Plan will be developed post award?

Response: A formal plan is required with as much detail as possible. A final plan will be approved after award. Please refer to Attachment 2.a 4300A Sensitive Systems Policy v.10 and Attachment 2.b 4300A-N Interconnection Security Agreements.

40. RFP Sub Factor 1.1 -Verification and Authentication Service states, “The successful Offeror will demonstrate the best methods in the fastest time and suggest surveillance criteria for applicant verification methods of identification and authentication”. Please advise what is meant by “surveillance criteria”?

Response: “Surveillance criteria” refers to the quality control method used to ensure the incumbent is providing/verifying true identities.

41. RFP Sub Factor 1.1 -Verification and Authentication Service states, “The offeror shall discuss incorporating a flagging process to alert FEMA during the process of evaluating applicant responses that an individual may need further investigation on identity status”.

Please clarify what is meant by the flagging process and, if currently in use, describe how it is integrated into FEMA’s business processes.

Solicitation HSFE80‐13‐R‐005 Identity Verification and Authentication Questions and Answers

15 | P a g e

Response: Yes, the flagging process is currently in use. Please refer to Section 16.0 of the SOW. Flagged data generates a Request for Further Information (RFI) letter to the applicant.

42. SOW, 5.1 IDENTITY VERIFICATION AND AUTHENTICATION SERVICES

The requirement states that “Identity Verification shall verify that an applicant's name, address, SSN and Date of Birth (DOB) exists and is related to the person applying.” Shortly thereafter, reference is made to determining that an “identity is reliable”.

Identities can exist in multiple databases but that does not necessarily provide insight into their reliability. What is more helpful to FEMA – determination that an asserted identity exists in one or more databases or a risk score/confidence factor that it is reliable or associated with less risk?

Response: The offeror shall propose their solution to meet this requirement of the solicitation.

43. Question 4: (5.6 TECHNICAL ASSISTANCE) Many of the fraud indicators listed (SSN belongs to minor, deceased individual, address is a prison, etc.) are part of standard identity verification and authentication offerings that can support the verification and authentication requirement (RFP Sub Factor 1.1 - Verification and Authentication Service). And, it appears that FEMA’s process does factor these items in according to the Current “As Is” description on SOW.

Please clarify if FEMA is currently receiving these fraud indicators or if this is a new requirement or perhaps for a different purpose? If FEMA is receiving these fraud indicators, please advise which ones are currently being supplied or used.

44. Question 5: SOW, 16.0 Current “As Is” Description, SOW

Additional information is requested to better understand FEMA’s current environment and what off the shelf solutions are most appropriate to meet FEMA’s goals. Please advise if any of the following information is available and, if so, provide available details on:

1. Identity Verification

Annual volume of identity verification transactions Peak volume periods Existing fraud detection rate Slip through Fraud rate (fraud not stopped up front but identified later) Amount of and frequency of the following types of identity fraud:

o Stolen identities o Misuse of deceased individuals identities

Solicitation HSFE80‐13‐R‐005 Identity Verification and Authentication Questions and Answers

16 | P a g e o Manipulated identities – example, SSN altered by one digit to avoid a “do not pay” or negative list of some sort o Synthetic identity fraud – o Family identity fraud – example, son uses elderly parents info without permission to apply for assistance o Straw man fraud – example, a recruiter buys or collects identity information from others to apply for assistance Response: Refer to 14.0- Technical Environment, 11.0- Transactional Volume and

pg. 5 of the SOW. Existing fraud rates, slip through fraud rate and the amount of/frequency is not able to be provided.

2. Quiz

Quiz generation rates Quiz abandonment rates Quiz pass rates Quiz fail rates Number of cases referred to a manual review/alternative processing after the quiz

Response: Not relevant to source selection.

3. Ownership & Occupancy Validation rates Annual number of transactions Peak volume periods

Response: Refer to 14.0- Technical Environment, 11.0- Transactional Volume and

pg. 5 of the SOW.

4. Occupancy

Validation rates Annual number of transactions Peak volume periods

Response: Refer to 14.0- Technical Environment, 11.0- Transactional Volume and

pg. 5 of the SOW.

45. General Questions: 16.0 Current “As Is” Description, SOW

A. Please describe or reference (i.e. a public report) the most typical types of fraud encountered by FEMA, how have fraud techniques evolved in the last few years and what evolving fraud techniques do you see?

Response: Fraud involves falsifying claims for disaster housing needs, with related false documentation. Providing more specific techniques at this time would expose FEMA to higher vulnerability.

B. What is the average dollar amount of assistance per applicant?

Response: Information will not be provided. Not relevant to source selection.

Solicitation HSFE80‐13‐R‐005 Identity Verification and Authentication Questions and Answers

17 | P a g e

C. Does FEMA currently utilize mobile devices or mobile applications to facilitate the disaster assistance process? If so, please describe how this helps FEMA meet its goals.

Response: Yes: Disaster survivors have the ability to apply for assistance using a computer or smartphones at www.disasterassistance.gov

D. How do mobile devices and mobile applications fit into FEMA’s future plans?

Response: Captured in C.

E. Does FEMA collect e-mail or IP address data during the application process?

Response: FEMA collects e-mail addresses for correspondence purposes. FEMA does not collect IP address data.

46. Question 7: SOW, 5.5 Investigation Tool Please advise if FEMA currently utilizes such as tool, product name, level of access, most frequently conducted searches and how it is used. It would be helpful to understand the role of the end user to determine which datasets and related services (link and time line analysis, etc.) are appropriate for FEMA’s end users. For example, if the end user is a law enforcement official, arrest record data might be available to them but not others.

Response: Section 5.5 Investigation Tool will be deleted from the Statement of Work and the requirement.

47. Question 8: SOW (5.6 Technical Assistance, paragraph 1) Performance related targets include: a) hit rate of 99% or better for being able to identify the applicant, b) pass rate 95% or better for allowing applicants to proceed with assistance, and

c) error rate such as false negative and false positives are 2% or less.

Does current vendor currently meet these targets?

Response: Section 5.6 Technical Assistance will be deleted from the Statement of Work and the requirement.

Has FEMA tested any vendors’ capability to meet these targets? If so, please provide all available information about the test and lessons learned.

Response: Section 5.6 Technical Assistance will be deleted from the Statement of Work

48. Question 9: RFP, Evaluation Process

Government agencies and commercial businesses routinely test the efficacy of identity verification and authentication technologies as part of their market research and/or procurements.

Vendor encourages FEMA consider a test as part of the procurement evaluation process to see which vendor and capabilities work best for FEMA. A test would supplement the written response by demonstrating to FEMA how capabilities actually work and would be able to best meet FEMA’s performance targets (see SOW, paragraph 1).

Solicitation HSFE80‐13‐R‐005 Identity Verification and Authentication Questions and Answers

18 | P a g e

Response: FEMA will not test the offeror’s approach as part of the procurement evaluation process.

49. Question 10: RFP, Sub Factor 1.1 -Verification and Authentication Service

RFP states that the “Government will evaluate the scope and availability of the Offeror’s selected source databases for purposes of checking identity information to provide a verification pass/fail outcome or ‘identity score.’

FEMA’s current As Is description suggests an identity verification solution that is based on data matching (i.e. identity exists) and filters (i.e, an SSN matches a death record).

Please advise if FEMA agrees with this characterization of its current solution and why?

Response: FEMA agrees with this solution but is open to new innovative solution

Also, please clarify FEMA’s understanding of an ‘identity score’, describe any experience researching or utilizing an identity score as well as how you differentiate an identity score from your current solution.

Response: Scoring requirements have been removed from the solicitation; therefore will no longer be part of the evaluation. FEMA will require the outcome of “pass/fail” with reason codes provided by the contractor. Refer to revised SOW for details.