Summary of Questions and Responses from FEMA SETA Pre-Solicitation Conference June 16 2009.pdf

Summary of Questions and Responses from FEMA SETA Pre-Solicitation Conference - June 16, 2009

General Comments:

1. All questions related to the Small Business Administration (SBA) should be directly addressed to the SBA and are not addressed in this document.

2. Organizational Conflicts of Interest will be addressed at the Task Order level.

Question 1: Can you comment on the nature of data access and Organizational Conflict of Interest (OCI)?

Those with appropriate security clearances may be working with classified data commensurate with their security clearance level and the need to know. Organizational Conflicts of Interest will be addressed at the Task Order level.

Question 2: What is the nature of the data that contractors will be working with?

The initial data will be For Official Use Only. Those with appropriate security clearances may be working with classified data commensurate with their security clearance level and the need to know. The initial data requirements are described in the Statement of Work (SOW) and in the draft task order of the Request for Information (RFI).

Question 3: What encompasses the existing contracts? (And will they stay?)

We have several contracts that are still on going and they will be evaluated when they come to the end of the contract.

Question 4: Stay as Firm Fixed Price?

The FEMA Systems Engineering and Technical Assistance (SETA) Request will be an Indefinite Delivery, Indefinite Quantity (IDIQ), Performance-Based Contract. Individual tasks may utilize various performance based contract types depending on the scope and complexity of the task.

Question 5: Will contractors have to reprocess their security clearances if they already have clearances on other contracts?

Visit the Defense Security Service (DSS) website (home page, scroll to bottom, and click on Industrial Program) and review requirements as outlined in the Industrial Security Program.

(www.dss.mil).

Question 6: What is the highest level of security clearance is required and what percentage of the work does it encompass?

The highest security level requires a TS/SCI. All contracts working IT Security must be able to obtain/maintain a Secret clearance. The percentage of work for other IT efforts on this contract will vary.

Question 7: Who are the incumbent contractors?

We have many companies working under various contracts. A representative list of FEMA contractors can be found at http://www.dhs.gov/xopnbiz/opportunities/gc_1162931616739.shtm

July 6, 2009 1 http://www.dss.mil/ http://www.dhs.gov/xopnbiz/opportunities/gc_1162931616739.shtm

Question 8: From page 4 of the SOW, “… FEMA is part of other government components, how will they have access?

FEMA’s constituency is very broad. Other Government Components includes other elements of DHS; other Departments and Branches of the Federal Government; state, local, and tribal governments, Non-governmental Organizations as well as many volunteer organizations. Access to FEMA information is through Internet, Intranet and Extranet connections. FEMA has 32 fixed sites, components are MWEOS, (4) NPSE, long term recovery offices.

Question 9: Where do IT operations occur?

Principal IT Operations occurs at FEMA offices in Mount Weather, VA, Winchester, VA, Denton, TX, and in Headquarters in Washington DC.

Question 10: How many FEMA FTEs are there?

FEMA has more than 4,500 full time employees. Including support contractors FEMA has approximately 17,000 people supporting FEMA’s mission. FEMA has 470 IT staff around the nation including 300 in the National Capital Region. They work at FEMA headquarters in Washington D.C., at regional and area offices across the country, the Mount Weather Emergency Operations Center, and the National Emergency Training Center in Emmitsburg, Maryland. FEMA also has nearly 4,000 standby disaster assistance employees who are available for deployment after disasters. Often FEMA works in partnership with other organizations that are part of the nation's emergency management system. These partners include state and local emergency management agencies, 27 federal agencies and the American Red Cross.

Question 11: Is it possible for multiple contracts? Is it possible for a contractor to be specialized to get part of the contract or do they have to provide all services in the SOW?

FEMA reserves the right to make multiple awards depending on the evaluation of the proposals received. All awardees will be expected to be capable of accomplishing all task orders as defined in the SOW. FEMA encourages teaming agreements to accomplish this objective.

Question 12: Is this contract a firm fixed price because it says Performance based in the RFI?

The FEMA Systems Engineering and Technical Assistance (SETA) Request will be an Indefinite Delivery, Indefinite Quantity (IDIQ), Performance-Based Contract. Individual tasks may utilize various performance based contract types depending on the scope and complexity of the task.

Question 13: Task orders will be more definitive towards requirements?

Yes, the task order will define the skill set.

Question 14: Will you provide more information about work requiring security clearances?

July 6, 2009 2

Companies will have to have or be able to obtain/maintain facility and personnel security clearances. The DSS Industrial Security website can provide further guidance on obtaining security clearances. Visit the Defense Security Service (DSS) website (home page, scroll to bottom, and click on Industrial Program) and review requirements as outlined in the Industrial Security Program. (www.dss.mil).

Question 15: What are the various COTS used?

The DHS Technical Reference Model (TRM) defines all the approved COTS products that FEMA uses. A representative sample of vendors who are included on FEMA’s approved COTS products list include the following: Adobe Systems, AdentNet, Algor Inc., Appian, ArcSoft, Attachmate, Autodesk, BMC Software, Borland, Brooktrout Technology, Business Objects, Caere Corporation, Captiva Software Corporation, Check Point, Cisco Systems, ClearCube Technology, EMC, Entrust, ESRI, HP, IBM, Internet Security Systems, Inc, Macromedia, Mercury, Microsoft, NetIQ, Network ICE, Opnet, Oracle, Red Hat,. Remedy, Research In Motion, SAS Institute, Inc., SolarWinds, Sun, Symantec, Tandberg, Tango/04, Tower Software, Troux Technologies, and VMware.

We have many legacy applications. If you are looking for targeted platforms, we are very antiquated and use some outdated technologies. FEMA is looking for creative contractors to provide IT solutions.

Question 16: What contract is providing GIS?

FEMA is invested in Enterprise Geospatial technologies. FEMA utilizes the ESRI products to provide Enterprise Geospatial Services. Section 3.5 of the RFI describes FEMA’s Geospatial Information Systems (GIS) and Remote Sensing Engineering requirements.

Question 17: What are the COTS used in GIS?

Enterprise Geospatial Technology, Geospatial Software, Data and Tools are listed on slide 25 of the SETA Pre-Solicitation Conference PowerPoint presentation.

Question 18: Is it sufficient for a team or prime to be cleared?

The Prime Contractor (and its subcontractor) obtain/maintain the appropriate facility and personnel clearance. Visit the Defense Security Service (DSS) website (home page, scroll to bottom, and click on Industrial Program) and review requirements as outlined in the Industrial Security Program. (www.dss.mil).

Question 19: Can you please comment on your evaluation and weighting criteria?

The evaluation criteria will be defined in the RFP

Question 20: Will you assign key personnel requirements?

Yes key personnel requirements will be included in the RFP. Key personnel will be specified in each Task Order issued under this contract. Prior to removing, replacing, or diverting any of the specified individuals, the Contractor shall notify the Contracting Officer and Contracting Officer’s Technical Representative 14 days prior to any action related to the performance of key personnel and shall submit justification (including proposed substitutions) in detail to allow for an evaluation of the impact relative to the

July 6, 2009 3

Task Order. The Government also retains the right, at its discretion, to interview all proposed replacements of key personnel.

Question 21: Will you look at the past performance of the subcontractor or only the primary?

Yes we will be checking references and the past performance of both the primary contractor and the subcontractors. We will evaluate all aspects of the proposal. Also, in evaluating corporate qualifications and accomplishments we will also investigating if the personnel who accomplished the stated qualification are still employed by the firm and whether aforementioned person or persons will be involved in carrying out the tasks as defined in the Statement of Work of the SETA RFP.

Question 22: What is the FTE count?

Each task order will specify number of FTEs.

Question 23: Will you publish the list of attendees to help with team building?

The list of registrants has been posted to FedBizOps (https://www.fbo.gov/ )

Question 24: Who does the integration with other contracts?

It depends and there is no clear cut answer. FEMA will address these issues on a case by case basis. The Contractor will be required to assure that engineering and technical assistance support activities are collaboratively integrated with other FEMA IT contracts as defined in the individual Task Orders.

Question 25: Is Task Order One a standalone?

Yes, all Task Orders are a stand alone.

Question 26: Will companies that have performed well on similar contracts receive greater consideration?

No. With regards to the evaluation process, there are no incumbents. We will evaluate all aspects of the company. FEMA will be calling references listed in the proposals.

We expect the contractor’s proposal to address all task orders as defined by the RFP. The response to each Task Order will be evaluated individually and in the aggregate. We will evaluate the proposals to ascertain if the response to each requirement has been addressed, if the response has not been addressed or if a superior/innovative response to the requirement has been provided.

Question 27: Will solutions be done so as not to upset the apple cart with DHS?

(Including vanilla software) Yes and yes. FEMA has established a string working relationship with DHS. FEMA will continue to work as closely with DHS as possible.

Question 28: What document management systems is FEMA using?

FEMA is using several Document Management systems. The purpose of Task Order 1 (FEMA Document and Enterprise Content Management Services) is to identify and assess the current document management, enterprise content management and business

July 6, 2009 4 https://www.fbo.gov/ process management capabilities within FEMA, to determine and define an enterprise -wide set of solutions that will form the core services in support of these domains. A goal of this effort is to reduce, consolidate and architect a solution based on the defined set of requirements using commercial off the shelf (COTS) software and hardware solutions.

Question 29: Is the DHS Technical Reference Model (TRM) a public document?

The DHS TRM is not a public document.

Question 30: Will there be a CMMI requirement?

A CMMI Level 3 requirement has been added to Section 3.17 of the Statement of Work.

The requirement states, “Contractor shall employ CMMI Level 3 processes to deliver repeatable IT services that are enterprise-focused and produce high-quality, secure applications rapidly and cost effectively.”

Question 31: Would FEMA considering procurement of this effort under the SeaPort Vehicle? FEMA has utilized this efficient and cost/time-effective vehicle for several procurements over the past year (several of which our company has bid on).

There are hundreds of SeaPort SETA small business prime contract holders with teaming arrangements already in place. I would like to request your committee's investigation of the SeaPort procurement vehicle as an alternative.

SeaPort procurement vehicle will not be used. It is intended for the FEMA SETA be a full and open IDIQ Total Small Business Set aside.

Question 32: In the Work Order Statement of Objectives dated 5/26/2009, there is reference made in Para 3.2 on p. 2, for requirements to provide document management and records management support services. Can you elaborate on the records management activities, and advise whether or not any form of classification and/or declassification requirement will be needed to support that function?

FEMA is using several Document Management systems. The purpose of Task Order 1 (FEMA Document and Enterprise Content Management Services) is to identify and assess the current document management, enterprise content management and business process management capabilities within FEMA, to determine and define an enterprise -wide set of solutions that will form the core services in support of these domains. A goal of this effort is to reduce, consolidate and architect a solution based on the defined set of requirements using commercial off the shelf (COTS) software and hardware solutions

Question 33: Are you scheduling meetings with industry to discuss this procurement? If so, we would like to schedule a meeting with you at your convenience to discuss the acquisition strategy and further details regarding the functional areas.

The only meeting with industry was the Pre-Solicitation meeting that was held on June 18, 2009. No further meetings will be held.

Question 34: Would you consider allowing small businesses to bid a subset of the 20 technical areas of the SETA SOW? This could enable FEMA to optimize its mix of

July 6, 2009 5 awardees to include teams with broad but not necessarily deep expertise with awardees possessing unique, specialized niche capabilities in key areas.

No, FEMA will not be considering dividing up the 20 technical area of the SETA SOW.

FEMA is consolidating all technical support contracts into six major contracts. The SETA IDIQ contract is one of these six contracts. All awardees will be expected to be capable of accomplishing all task orders as defined in the SOW. FEMA encourages teaming agreements to accomplish this objective. FEMA reserves the right to make multiple awards depending on the evaluation of the proposals received.

Question 35: Please confirm whether FEMA intends to make IDIQ award to more than one bidder?

More than one award may be made depending on the quality of the proposals evaluated. The final decision will be made based on what is most advantageous to FEMA and the government.

Question 36: The FEMA forecast for this opportunity shows Expected Dollar Range to be $500K to $1M. Can you confirm that this is accurate or provide a revised annual or contract estimate?

The final SETA IDIQ will be much higher for the life of the contract.

Question 37: What is the anticipated Contract Ceiling for this procurement?

The final SETA IDIQ ceiling will be provided at time of release of the Request for Proposal and will be posted to FedBizOps.

Question 38: Will FEMA issue a DD 254 for the IDIQ? Is there a minimum Clearance Level required for the Prime Contractor?

FEMA will facilitate the issuance of the DD 254, in concert with DHS, when required by the contract. Future Task Orders may require that the Prime Contractor be able to obtain or be in possession of a clearance level of TS/SCI.

The contractor shall comply with the Department of Homeland Security’s (DHS) technical, management, and operational security controls to ensure that the Government’s security requirements are met. DHS 4300A policy guide will be used for Sensitive Systems and DHS 4300B policy guide will be used for National Security Systems. No contractor personnel shall be granted access to DHS systems without having a favorably adjudicated Background Investigation (BI) as defined in DHS MD11055, Suitability Screening Requirements for Contractor Employees. In addition, visit the Defense Security Service (DSS) website (home page, scroll to bottom, and click on Industrial Program) and review requirements as outlined in the Industrial Security Program. (www.dss.mil).

The level of background investigation required for contractor personnel depends on the level of risk associated with each contractor position: high, moderate, low. The Table below depicts the type of investigation required for each risk level.

July 6, 2009 6

Table: Types of Background Investigation Required for Each Risk Level

TYPE OF INVESTIGATION

REQUIRED

PRELIMINARY CHECKS

REQUIRED FOR EOD / WAIVER

DETERMINATION

RISK LEVEL SECURITY

FORMS

REQUIRED

IT-Computer

Positions Non-IT

Computer Positions

IT Positions (waiver NTE 100 days)

Non-IT Positions

HIGH BI LBI

Favorable Review of Forms Favorable NAC Scheduling of the

BI**

Favorable Review of Forms Favorable

NAC

Submission of the LBI

MODERATE

− SF 85P

− FD 258

− Credit

Release Form

− Non- Disclosure Statement

− SF 85P-S*

MBI NACIC

Favorable Review of Forms Favorable NAC Scheduling of the

MBI

Favorable Review of Forms Favorable NAC + credit check

LOW

− SF-85P

− FD-258

N/A

Favorable Review of Forms FP and Name Check

N/A

* Only Weapons-Carrying Contract Guards must complete the SF 85P-S in addition to SF 85P ** Eligible for access only to the Moderate Risk Level.

The waiver allows the contractor employee to commence work before the required background investigation is completed. The waiver does not substitute for the required background investigation.

Question 39: Will FEMA please ensure that the Solicitation (RFQ/RFP) includes a clear delineation of any management, technical, experience, past performance and cost/price evaluation criteria (normally Solicitation Section M)?

Yes

Question 40: Will FEMA please explain the relative weighting of any selected evaluation criteria?

There are no relative weightings in the evaluation criteria. Each Task Order will be given equal weight. We will evaluate all aspects of the contractor’s proposal. We expect the contractor’s proposal to address all task orders as defined by the RFP. The response to each Task Order will be evaluated individually and in the aggregate. We will evaluate the proposals to ascertain if the responses to each requirement has been addressed, has not been addressed or a superior/innovative response to the requirement has been provided.

July 6, 2009 7

Question 41: Will FEMA please include the basis of selection in the Solicitation?

Appropriate selection criteria will be included in the Request for Proposal.

Question 42: Often the Government constructs an IDIQ contract (FAR 16.5) that allows for multiple contract types such as cost, labor‐hours/time & materials, and firm fixed price because the specific Task Orders are consistent with FAR recommendations for contract type for the particular Task Order. Will FEMA consider issuing the IDIQ provisions to determine the type at the Task Order Level?

The FEMA Systems Engineering and Technical Assistance (SETA) Request will be an Indefinite Delivery, Indefinite Quantity (IDIQ), Performance-Based Contract. Individual Task Orders may utilize various performance based contract types depending on the scope and complexity of the task.

Question 43: How will FEMA determine price reasonableness of each offeror’s Price/Cost proposal?

Task Order 1, “FEMA Document and Enterprise Content Management Services” will be used to help ascertain the price reasonableness of each offeror’s Price/Cost proposal.

Question 44: If FEMA decides to use a Cost Contract/Task Order are we correct in assuming that the Prime Contractor must have a DCAA reviewed accounting system and a DCAA approved provisional rate letter?

The SETA IDIQ will not use a cost-type Task Order. The SETA Task Orders will be Time and Materials or Firm Fixed Price contracts.

Question 45: The FEMA presenters at the Industry Day made it clear that they fully expected industry to have to form teams of multiple contractors in order to be able to cover the broad set of functional requirements required by the SOW. What will FEMA do to ensure that the Prime Contractor is capable of properly performing technical and contractual oversight of its Team? Will FEMA establish a Past Performance Requirement for the Prime Contractor to have managed Teams of similar size and scope?

FEMA intends to utilize a Multi-Step Process in the selection of the prime contractor. The prime contractor shall be required to address corporate history, viability, relevant past performance and technical capability in the Multi-Step Process statement. The vendor capability statement submission will be used in part to ascertain the prime contractor’s ability to properly carry out technical and contractual oversight of its team. Past Performance will also be used in evaluating and selecting a prime contractor.

Question 46: Who are the incumbents by area of support for the 20 areas of support as outlined in the SOW.

There are no incumbents. It is intended for the FEMA SETA to be a full and open IDIQ Total Small Business Set aside.

Question 47: Please clarify how the level of quality will be assessed (p20 of 28) to determine that there is only one entity capable of providing the services as the services are unique or highly specialized.

Contractor will be required to employ a CMMI Level 3 processes to deliver repeatable IT services that are enterprise-focused and produce high-quality, secure applications rapidly and cost effectively. In addition, the contractor will be required to conduct, using third party certified auditors, periodic audits of SETA projects to assess compliance. Frequent

July 6, 2009 8 appraisals will confirm that the processes remain institutionalized, enable the contractor to accurately predict the quality and timeliness of deliverables, and enable continuous improvement.

Question 48: Will the ‘other government components” (p. 4 of 28) be part of the requirements development – if Yes how will they be accessed and what priority do they have over FEMA offices?

Understanding the requirements of other government components may be part of requirements development. The contractor will be expected to support the review and development of operational and technical systems specifications/requirements through meetings, interviews, research and analysis.

Question 49: Please clarify/confirm the verbiage for sections 3.4 and 3.5 which identify that the Contractor will be providing enterprise systems and GIS and Remote Sensing systems versus expertise to support these systems.

The contractor will be expected to provide expertise to support these systems.

Question 50: To facilitate staffing, if a candidate already has been processed thru eQIP for another DHS contract and been found eligible, will this be accepted or will they need to re-process? Will their Security Awareness transfer?

The FEMA Office of Security Industrial Security Program office will determine if the candidate will have to be re-processed thru eQIP. There will be no Security Awareness transfer.

Question 51: What suite of software/COTS products will be provided on the government furnished laptops for analysis, modeling, design, etc.?

It depends on the requirements of the Task Order.

Question 52: How long has FEMA been working with IBM on adoption of SOMA?

FEMA been working with IBM on adoption of SOMA since the start of the calendar year, 2009.

Question 53: How far in the SOA implementation phase is FEMA? Please elaborate on analysis on business domains (functional areas) and the decomposition of those domains in to business processes, sub-processes and use cases.

We are currently analyzing business domains and performed an initial decomposition of these domains into high level business processes.

Question 54: Please provide FEMA’s road map for SOA implementation and candidate systems for initial deployment, if such documents exist.

No document is available at this time. A candidate system has been identified for the initial development of foundational and business services however, it has not been approved.

Question 55: Is FEMA Enterprise Data Architecture (Logical & Physical) Model developed? Please elaborate on the current data architecture foot prints/road map that roll up/map to disparate systems data model into Enterprise Data Model that will enable FEMA to meet their SOA implementation strategies and forth seen benefits.

FEMA has a draft conceptual data model but it has not been verified by the business owner.

July 6, 2009 9

Question 56: Please explain IBM SOMA adoption vs. Oracle Fusion Middleware from COTS product investment point of view. Does FEMA have licenses for both IBM and Oracle SOA products?

SOMA is a language and platform neutral design technique for defining an overarching service-oriented architecture and specifying services therein. No particular license is required for SOMA.

Oracle Fusion, on the other hand, is a collection of pre-integrated middleware meant to enable a service-oriented architecture and requiring individual product licenses. They are complementary elements. FEMA has licenses for some but not all of Oracle’s fusion middleware products.

Question 57: Please provide the list of current COTS products used for document and content management across various business units/regions.

FEMA is using several Document Management systems. The purpose of Task Order 1 (FEMA Document and Enterprise Content Management Services) is to identify and assess the current document management, enterprise content management and business process management capabilities within FEMA, to determine and define an enterprise -wide set of solutions that will form the core services in support of these domains. A goal of this effort is to reduce, consolidate and architect a solution based on the defined set of requirements using commercial off the shelf (COTS) software and hardware solutions.

Question 58: Please provide details on FEMA IT Security Standards and FEMA IT Security Architecture Design principles.

The FEMA IT Security Standards and IT Security Architecture Design principles will be detailed in the Statement of Work provided for this solicitation. As a minimum, all IT Security and Architectural work will be performed as mandated by the Federal Information Security Management Act (FISMA) and NIST publications.

Question 59: Please provide total number of IT systems in production that enable FEMA business processes and FEMA’s goal to consolidate those to how many systems.

The total number of IT systems in production is classified and will be provided as needed after award of the SETA IDIQ to the prime contractor.

Question 60: FEMA has invested in various COTs products that have been around since 1985. These need to be consolidated consolidate for better control and efficiency going forward. Can you elaborate on FEMA’s vision on ROI with current technologies vs. future evolving technologies? How much investment has been done so far that may affect the decision to invest in future technologies?

This type of analysis will be part of the SETA IDIQ.

Question 61: Will the prime vendor be allowed to add additional subcontractors to assist in the project should findings indicate that this is desirable?

Yes with the approval of the Contracting Officer and the COTR as the need arises. Each request to add additional subcontractors will be decided on its own merits and the qualifications of the subcontractor.

Question 62: Will any of FEMA’s existing IT contracts be rolled up or consolidated into the contract to be issued under this solicitation? If so, which ones?

None of FEMA’s existing IT contracts will be rolled up or consolidated into the SETA IDIQ contract. However, as existing contracts expire it is anticipated that the SETA IDIQ may be utilized in the place of the expired contracts.

July 6, 2009 10

Question 63: Will FEMA provide a pricing model to help bidders price the task orders?

Appropriate information/instructions will be provided in the Solicitation.

Question 64: Will FEMA provide labor categories (with descriptions, years of experience and education requirements? Will any existing price schedule (e.g., EAGLE) be a useful model for bidders to look at for pricing?

FEMA will not be providing labor categories (with descriptions, years of experience and education requirements, etc) with the Solicitation. Existing price schedules such as EAGLE) may be a useful for bidders in preparing their proposals.

Question 65: Will FEMA provide its Enterprise Architecture with the RFP?

No, FEMA will not be providing its Enterprise Architecture with the RFP. FEMA is consolidating to two DHS data centers. FEMA has standardized on Oracle for its data base applications and uses Microsoft Office Suite. FEMA’s Data and Information Architectures will be predicated on the National Information Exchange Model (NIEM). FEMA is developing a Service Oriented Architecture. The DHS Technical Reference Model (TRM) defines all the approved COTS products that FEMA uses. A representative sample of vendors who are included on FEMA’s approved COTS products list is included as part of the answer to Question 15.

Question 66: What levels of clearances will be required?

The highest security level requires a TS/SCI. All contracts working IT Security must be able to obtain/maintain a Secret clearance. The percentage of work for other IT efforts on this contract will vary.

July 6, 2009 11