Amendment_A00001_ _Q A.pdf

1. CONTRACT ID CODE PAGE OF PAGES

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT 1 2

2. AMENDMENT/MODIFICATION NO. 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQ. NO. 5. PROJECT NO. (If applicable)

A00001 March 28, 2016

6. ISSUED BY CODE 1. ADMINISTERED BY (If other than Item 6)

CODE

U.S. Department of Homeland Security Transportation Security Administration 601 South 12th Street Arlington, VA 22202

Katya D. Cruz, Contract Specialist PFPAcqTeam@tsa.dhs.gov

8. NAME AND ADDRESS OF CONTRACTOR (No. Street, county, State and ZIP: Code) (4) 9A. AMENDMENT OF SOLICITATION NO.

X HSTS01-16-R-HRM036

9B. DATED (SEE ITEM 11)

03/03/2016

10A. MODIFICATION OF CONTRACT/ORDER NO.

10B. DATED (SEE ITEM 13)

CODE FACILITY CODE

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended, is not extended.

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing Items 8 and 15, and returning one 1copy of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATA SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and data specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

N/A

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

(4) A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return 1 copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

See Page 2

Except at provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print) 16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

Evelyn S. Tyndell

CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR 15C. DATE SIGNED 16B. UNITED STATES OF AMERICA 16C. DATE SIGNED

(Signature of person authorized to sign)

BY _____________________________________________

(Signature of Contracting Officer)

NSN 7540-01-152-8070 30-105 STANDARD FORM 30 (REV. 10-83)

PREVIOUS EDITION UNUSABLE Computer Generated mailto:PFPAcqTeam@tsa.dhs.gov

The purpose of amendment A00001 to Solicitation HSTS01-16-R-HRM036 is to:

1. Incorporate answers to questions received in response to the solicitation by the question deadline of March 7, 2016 no later than 3:00pm local time (Washington DC), to include questions received prior to Industry Day held on February 29, 2016. Questions & Answers can be found in Attachment 1, entitled “Questions & Answers” to this amendment.

2. Extend the due date for submission of proposals, as follows:

FROM: Thursday, April 7, 2016 no later than 3:00 pm local time (Washington DC)

TO: Wednesday, April 13, 2016 no later than 3:00 pm local time (Washington DC)

3. Provide a copy of the updated Request for Proposals (RFP). See changes in Blue-Italicized

Font. See deletions in red strikethrough font.

4. Provide a copy of the updated Statement of Work (SOW). See changes in Blue-Italicized Font.

5. Provide a copy of the updated Attachment II – Historical Contract Data.

6. All other terms and conditions of this solicitation remain unchanged.

-END OF AMENDMENT-

TSA RFP# HSTS01-16-R-HRM036 Amendment A00001 Attachment 1

# RFP Document or Attachment Reference (or "General") Offeror Question Answer

1 Not Provided I wanted to know if the above mention solicitation a multi contract award? No, as outlined in RFP Section 9.4, this solicitation will result in one contract award.

Not Provided

The solicitation states that bidders’ Small Business subcontracting plans must outline the “NAICS codes assigned to each subcontract that are based on the nature of the work subcontracted using the 2012 NAICS Coding Manual and that clearly match the work subcontracted.” Does the language mean that Small Business credit will be provided for companies that qualify as a Small Business under NAICS codes other than 541612 if they are doing work that is aligned to a different NAICS (e.g.

Small Businesses performing IT services associated with this contract would be “small” under NAICS 541519, which carries with it a $27.5M size standard, rather than the smaller size standard of $15M under NAICS 541612)?

Yes. This information is requested to validate the proposed subcontractor qualifies as a small business under the NAICS for the work in which they will perform. See Section 8.5 D(d).

HSAR 3052.204-71 Contractor Employee Access (JUN 2006)

(c) Contractor employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability. Completed forms shall be submitted as directed by the Contracting Officer. Upon the Contracting Officer's request, the Contractor's employees shall be fingerprinted, or subject to other investigations as required. All contractor employees requiring recurring access to

Government facilities or access to sensitive information or IT resources are required to have a favorably adjudicated background investigation prior to commencing work on this contract unless this requirement is waived under

Departmental procedures.

We believe that this only applies to contractor personnel that are performing the solution implementation services and not the Cloud Services Provider (CSP) personnel that are hosting the solution. For example, Cloud Service Provider engages the services of a background screening vendor to conduct background checks, as on employees at the time of hire in the U.S. Can TSA please modify these requirements accordingly?

No, the successful offeror(s) shall not present or incorporate the deployment of new/replacement software applications, SaaS, IaaS, PaaS, and/or CSP based solutions. TSA OHC will provide access to all applicable TSA-owned/provided systems, which will be provided via Trusted Internet Connection (TIC). Offerors will utilize existing TSA-owned/provided applications to execute HR Support Services requirements in the Statement of Work.

All proposed system solutions must meet the DHS/TSA IT security requirements as per the Solicitation. All contractor and subcontractor employees who access TSA systems or data are subject to badging and security requirements. The requirements remain as written.

# RFP Document or Attachment Reference (or "General") Offeror Question Answer

4.5. 5200.204.004 REQUIREMENTS AND DUTIES FOR HANDLING SENSITIVE SECURITY INFORMATION (SSI)

(JUL 2015)

e) Breach. In accordance with 49 C.F.R. Part 1520.9(c), the Contractor agrees that in the event of any actual or suspected breach of SSI (i.e., loss of control, compromise, unauthorized disclosure, access for an unauthorized purpose, or other unauthorized access, whether physical or electronic), the Contractor shall immediately, and in no event later than one hour of discovery, report the breach to the Contracting Officer and the COR. The Contractor is responsible for positively verifying that notification is received and acknowledged by at least one of the foregoing Government officials.

In the event that an SSI breach occurs as a result of the violation of a term of this contract by the Contractor or its employees, or the Contractor’s covered persons, the Contractor shall, as directed by the Contracting Officer and at no cost to the Government, without delay correct or mitigate the violation.

For unauthorized disclosure of SSI, the Contractor and Contractor's employees and Contractor’s covered persons may also be subject to civil penalties and other consequences as set forth in 49 CFR Part 1520.17.

45.8 Additional PII and/or SPII Notification Requirements.

(1) The Contractor shall have in place procedures and the capability to notify any individual whose PII resided in the

Contractor IT system at the time of the sensitive information incident not later than 5 business days after being directed to notify individuals, unless otherwise approved by the Contracting Officer. The method and content of any notification by the Contractor shall be coordinated with, and subject to prior written approval by the Contracting Officer, in consultation with the Headquarters or Component Privacy Officer, utilizing the DHS Privacy Incident Handling Guidance. The Contractor shall not proceed with notification unless the Contracting Officer, in consultation with the Headquarters or

Component Privacy Officer, has determined in writing that notification is appropriate.

The Cloud Service Provider is a service provider and TSA would be one of hundreds of thousands of customers using the service. Cloud Service Provider can contractually commit to incident response reporting timeframes in a customer contract. One component driving the timeframes are the Cloud Service Provider’s ability to communicate to a wide customer base in the event of an incident. In a multi-tenant cloud environment, the Cloud Service Provider could be reporting to thousands of customers if there is a security incident impacting multiple customers. Cloud Service Providers utilize one incident response process for all customers. Utilizing one approach allows for scalability and ease of operations. As such, we would like to request the requirements for breach notifications should align with the existing CSP reporting requirements that also align with FedRAMP.

Additionally, due to the nature of the Cloud Service Provider’s service, the Cloud Service Provider can only report actual breaches, not attempted breaches not suspected, threatened, or foreseeable breaches. As a multitenant environment, an attempted breach against another tenant would not be reported to TSA.

In the event of a security breach and if negotiated in the agreement, the Cloud Service Provider can notify TSA identified points of contact. The CSP cannot notify affected parties because the CSP does not view customer data. The Cloud Service Provider is responsible for maintaining access in terms of performance and availability to the data. The data is owned by the customer.

Therefore, can TSA please adjust each of these requirements accordingly?

See response to Question# 3

31.3 The Contractor shall be privy to sensitive organizational information. A Privacy Management Plan and signed DHS Non-Disclosure Agreements (NDAs) for Contractor personnel are required within (30) calendar days of the contract start date.

We believe that this only applies to contractor personnel that are performing the solution implementation services and not the Cloud Services Provider personnel that are hosting the solution?

Cloud service provider personnel are required to sign an NDA, that covers all customer data, not specifically the data belonging to a single tenant of the system. Additionally, we assume that the NDA language that is incorporated as part of the overall cloud/SaaS subscription agreement will meet this requirement.

We request that this requirement to be modified to reflect that this is not required for Cloud Service Provider employees hosting the solution.

See response to Question# 3

# RFP Document or Attachment Reference (or "General") Offeror Question Answer

31.8 All Contractor employees shall receive initial TSA IT Security Awareness Training within 60 days of assignment to the contract.

We believe that this only applies to contractor personnel that are performing the solution implementation services and not the Cloud Services Provider personnel that are hosting the solution?

For example, the CSP adheres to FedRAMP requirements without tenant specific training. The CSP’s process requires employees to sign and acknowledge receipt of the Employee Handbook, the Code of Conduct, and the Employee Proprietary Information and Rights Agreement. Employees also take code of conduct and legal compliance training. Initial and annual Security Awareness Training includes security best practices, threat recognition, compliance and policy requirements, and reporting obligations. Follow-up security awareness training is presented to all personnel.

We request that this requirement to be modified to reflect that this is not required for Cloud Service Provider employees hosting the solution.

See response to Question# 3

32.1 Hardware or software configuration changes shall be in accordance with the DHS Information Security Performance Plan (current year and any updates thereafter), the DHS Continuous Diagnostics and Mitigation (CDM) Program to include dashboard reporting requirements and TSA’s Configuration Management policy. The TSA Chief Information

Security Officer (CISO)/ Information Assurance and Cyber Security Division (IAD) must be informed of and involved in all configuration changes to the TSA IT environment including systems, software, infrastructure architecture, infrastructure assets, and end user assets. The TSA IAD will approve any request for change prior to any development activity occurring for that change and will define the security requirements for the requested change.

We are proposing a SaaS/PaaS solution to achieve TSA's requirements. The infrastructure is fully hosted and managed by the Cloud Service Provider and not by TSA. The SaaS/PaaS solution will be configured to TSA's specific requirements. Therefore, can TSA adjust the requirement to reflect this and remove that configuration changes to the infrastructure architecture and assets are not applicable to SaaS/PaaS solutions being proposed?

See response to Question# 3

32.2 The Contractor shall ensure all application or configuration patches and/or Requests for Change (RFC) have approval of the Technical Discussion Forum (TDF), Systems Configuration Control Board (SCCB), and lab regression testing prior to controlled change release under the security policy document, TSA Management Directive (MD) 1400.3, and TSA Information Assurance Handbook, unless immediate risk requires immediate intervention. Approval for immediate intervention (emergency change) requires approval of the TSA CISO, SCCB co-chairs, and the appropriate Operations Manager, at a minimum.

32.3 The Contractor shall ensure all sites impacted by patching are compliant within 14 days of change approval and release.

Cloud Service Provider offers SaaS/PaaS in a multi-tenant cloud environment and provides multiple major release upgrades annually that do not affect customers' configured solutions on the CSP's platform and which customers can typically opt-in to upgraded functionality. CSP has one maintenance and upgrade schedule that supports thousands of customers. Can TSA please adjust this requirement accordingly?

See response to Question# 3

32.6 The Contractor shall establish processes and procedures for continuous monitoring of Contractor systems that contain TSA data by ensuring all such devices are monitored by, and report to, the TSA Security Operations Center

(SOC). The Contractor shall perform monthly Nessus scans on servers that contain TSA data, and shall send monthly scan results to the TSA IAD.

Cloud Service Provider conducts scanning as a part of continuous monitoring in accordance with FedRAMP requirements. Any vurablities found will be published in our monthly POA&M. Can TSA please adjust this requirement accordingly?

# RFP Document or Attachment Reference (or "General") Offeror Question Answer

36.2 Private Sector System Requirements: TSA shall conduct audits at any time on the private sector systems, and the system shall be entered into the TSA FISMA Inventory as a system of record using the Control Implementation Summary (CIS) provided by the Cloud Service Provider. Security artifacts shall be created and maintained in the DHS Information Assurance Compliance Tool (IACS). The private sector systems are required to go through the Security Authorization Process and the Risk Management Framework in accordance the Federal Information Systems Management Act and NIST SP 800-37 Rev. 1. The cloud internet connection shall be behind a commercial Trusted Internet Connection that has EINSTEIN 3 Accelerated (E3A) deployed. Security event logs and application logs shall be sent to the TSA SOC.

Incidents as defined in the TSA Information Assurance 1400.3 Management Directive and Handbook shall be reported to the TSA SPOC 1-800-253-8571. DHS Information Security Vulnerability Management Alerts and Bulletins shall be patched within the required time frames as dictated by DHS.

The Cloud Service Provider solution is a multi-tenant service. Annual site visits can be negotiated, but in consideration of our other customers, random access cannot be permitted. As a multi-tenant service, compartmentalization is virtual, not physical. The Cloud Service Provider contracts with third party auditors to inspect and review our security. The results of these audits can be provided as desired. Can this requirement be removed or adjusted for a multi-tenant service?

See response to Question# 3

36.1 FedRAMP Requirements: Private sector solutions will be hosted by a Joint Authorization Board (JAB) approved Infrastructure as a Service (IaaS) Cloud Service Provider (CSP) (http://cloud.cio.gov/fedramp/cloud-systems) and shall follow the Federal Risk and Authorization Management Program (FedRAMP) requirements.

Will TSA also accept Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS) solutions that have received an Agency FedRAMP ATO? See response to Question# 3

37.1 All services, hardware and/or software provided under this task order must be compliant with DHS 4300A DHS Sensitive System Policy Directive, DHS 4300A Sensitive Systems Handbook., TSA MD 1400.3 Information Technology

Security Policy, TSA Information Assurance Handbook and Technical Standards.

There is significant overlap, but some contradiction between the requirements listed in 2.14 H.1.

Since many of these are based on the NIST sandrards is FedRAMP compliance sufficient to meet TSA's standards? If not, please specify which requiremts from each document would be applicable for this service

See response to Question# 3

38.1 Unless otherwise directed by TSA, any storage of data must be contained within the resources allocated by the Contractor to support TSA and may not be on systems that are shared with other commercial or government clients.

Can TSA please remove this sentence, "Unless otherwise directed by TSA, any storage of data must be contained within the resources allocated by the Contractor to support TSA and may not be on systems that are shared with other commercial or government clients."

The CSP’s PaaS/SaaS multi-tenant architecture and secure logical controls address separation of customer data. CSP has configurable security features that allow customers to customize security based on the sensitivity of data customers store in the application consistent with the requirements in NIST SP 800-53 Rev. 3 for moderate impact systems. Our rationale is also in alignment with FedRAMP requirements using virtual isolation between related entities.

See response to Question# 3

41.1 The contractor must satisfy requirements to work with and safeguard Sensitive Security Information (SSI), and Personally Identifiable Information (PII). All support personnel must understand and rigorously follow DHS and TSA requirements, policies, and procedures for safeguarding SSI and PII. Contractor personnel shall be required to complete Annual online training for SSI, Informational Security, and TSA Privacy training, which take approximately one hour each.

We believe that this only applies to contractor personnel that are performing the solution implementation services and not the Cloud Services Provider personnel that are hosting the solution?

For example, the CSP adheres to FedRAMP requirements without tenant specific training. The CSP’s process requires employees to sign and acknowledge receipt of the Employee Handbook, the Code of Conduct, and the Employee Proprietary Information and Rights Agreement. Employees also take code of conduct and legal compliance training. Initial and annual Security Awareness Training includes security best practices, threat recognition, compliance and policy requirements, and reporting obligations. Follow-up security awareness training is presented to all personnel.

We request that this requirement to be modified to reflect that this is not required for Cloud Service

# RFP Document or Attachment Reference (or "General") Offeror Question Answer

42.1 At the expiration of the contract, the contractor shall return all TSA information and IT resources provided to the contractor during the contract, and provide a certification that all assets containing or used to process TSA information have been sanitized in accordance with the TSA MD 1400.3, TSA Information Assurance Handbook and Technical Standards. The contractor shall certify in writing that sanitization or destruction has been performed. Sanitization and destruction methods are outlined in the NIST Special Publication 800-88 Guidelines for Media Sanitization, and TSA

Technical Standard 046 IT Media Sanitization and Disposition. The contractor shall email signed proof of sanitization to the COR. In addition, the contractor shall provide a master asset inventory list that reflects all assets, government furnished equipment (GFE) or non-GFE that were used to process TSA information.

To provide the best quality of service to our customers, the CSP retains backups for 90 days. The certification of assets that have been sanitized may be impractical, but the CSP follows NIST 800-88.

Can the TSA further specify this requirement to be more flexible based on the Cloud Service Provider's processes and adjust this requirement accordingly?

See response to Question# 3

44.4 Applicability of Internet Protocol Version 6 (IPv6) to DHS-related components (networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the DHS Enterprise Architecture (per OMB

Memorandum M-05-22, August 2, 2005) regardless of whether the acquisition is for modification, upgrade, or replacement. All EA related component acquisitions shall be IPv6 compliant as defined in the U.S. Government Version 6

(USGv6) Profile (National Institute of Standards and Technology (NIST) Special Publication 500-267) and the corresponding declarations of conformance defined in the USGv6 Test Program.

Does this refer to all systems in the stack or just the interface between the browser and the SaaS service? Is it your desire to allow users to connect to a cloud service via IPv6? Is it mandatory that a Cloud Services Provider be IPv6 compliant today or is it acceptable to respond with a path to become compliant?

See response to Question# 3

1.1 Can TSA please provide additional information on the field performance processing work expected to be performed by the contractor as part of CLIN 6 in the base period and CLIN 5 in the option periods? See Section 8.4 of SOW which has been updated for Amendment A00001.

1.1 Can TSA please provide additional information on the one job unit specified for CLIN 5 in the option periods? This CLIN covers the performance of field performance processing, which is an annual activity.

19 3.3 Can TSA please provide a template of the mission assurance goals spreadsheet being requested for the operational management measure? See Section 3.3 of the RFP, which has been updated for Amendment A00001.

SOW 8.2, 10.1, 11.1, 15.6, 18, 19

Can TSA please provide additional clarity on what you are defining as completion of processing?

Does this mean the action has been reviewed, remarked, QC'd and ready to submit to NFC or does it mean that the action has applied to the NFC mainframe? For example, we can process certain NOACs that may not apply to NFC within two days (i.e. future effective date actions).

Completion processing is defined by TSA as the documentation is prepared, reviewed, QC'd, entered into NFC, and ready for processing by NFC.

SOW 10.1

For separation actions received by the contractor where there are outstanding actions that require TSA intervention, will those transactions be excluded from consideration in determining whether separation transactions were completed within 2 business days of receipt?

Yes, for outstanding actions that require TSA intervention, those transactions would be excluded for consideration.

SOW 20.1

Can TSA please provide additional clarification on the level of application support they expect from the contractor on the eTAS Kronos WFC application? For example, is there an expectation that the contractor will resolve defects in the eTAS Kronos WFC application?

eTAS Kronos WFC system is maintained by the eTAS contractor and the support by PP&B contractor is related to end user issues.

23 SOW 22.11.3 Does TSA expect candidate data in any existing Orientation system in use by TSA to be migrated to the new eOrientation system being proposed by the contractor? Yes.

SOW 28.2.6 Can TSA please clarify the contractors role in providing queue management? Will TSA provide the contractor with development rights on the case management tracking system?

The Contractor's role in Queue Management will be to respond to escalated contacts by referring contacts to the appropriate subject matter experts for resolution. If required, ensure that contacts in the queue that require TSA intervention are escalated in a timely manner to TSA OHC.

The contractor will not have full development rights on the case management tracking system.

# RFP Document or Attachment Reference (or "General") Offeror Question Answer

8.5 & SOW 47.2 The proposal instructions do not include a system integration plan. Can TSA please clarify whether the system integration plan is to be included in the proposal submission?

Yes, a system integration plan shall be included in the proposal response. See Section 8.5 of the RFP, which has been updated in Amendment A00001.

SOW 21.2 Re-employeed annuitants are not referenced in the SOW. Please confirm vendor support is not needed for this area.

Yes, contractor support is needed for re-employed annuitants. Section 21.2 of the SoW provides examples of types of cases that would require special handling to address. The list is not all-inclusive.

27 SOW 22 Is the Contractor expected to collect mail and documents for work performed by TSA, e,g., death and retirements?

Yes, the contractor is expected to collect mail and documents for work performed by TSA.

See Sections 10.2, 11.9, 26.2 of the SOW that references "mail". Additionally, see section 26.8 of the SOW, which has been updated in Amendment A00001.

SOW 10 Completion of SF75s for separating employees is not referenced in the SOW. Please confirm vendor support is not needed for that area.

Yes, vendor support is required. See Section 10.5 of SOW which has been updated for Amendment A00001.

General

Understanding attendees at the non-mandatory pre-RFP Industry Day had an opportunity to review non-public information specifically related to IT Security materials related to the requirement, when will TSA provide an opportunity to industry to review the non-public information specifically related to IT Security materials now that the government has published an official RFP?

No additional industry days and/or IT Security reading rooms will be held. All of the Government's requirements are contained in the Solicitation and proposals will be evaluated according to the stated requirements.

30 General Please confirm the system licenses that will need to be provided by the contractor, besides the contractor provided system such as eOrientation. See Section 28.2.4 of the SOW, which has been updated in Amendment A00001.

# RFP Document or Attachment Reference (or "General") Offeror Question Answer

RFP Section 1.1, Page 3 Regarding the Transition-In CLIN (0001). Is the Government open to conducting an initial strategic planning and performance expectation setting process during the Transition-In period, or will the winning Offeror be provided with pre-determined strategic initiatives, performance targets, and action plans?

Consistent with the requirements of the SoW, the government is open to conducting an initial strategic planning and performance expectation setting process; however, the Contractor should include its plan, approach, performance targets, action plans, etc., within its proposal response and ultimately affected and appropriate contract deliverable (e.g., Ingress Transition Plan, Project Management Plan, Quality Control Plan, etc.)

RFP Section 1.1 (page 3-6) and 1.2 (page 6)

The table in 1.1 Contract Line Item (CLIN) Structure, for New Hire Document Processing (Optional CLIN) and eOPF Maintenance (Optional CLIN), the quantity is shown as “To Be Proposed (TBP)” and the pricing unit is shown as “MONTH.” In 1.2 Contract Line Item (CLIN) Summary, these two CLINS are shown as Firm Fixed Price. Does the Government plan to provide historical data for these two

CLINS?

Please see Attachment II of the Solicitation "Historical Contract Data", which has been updated in Amendment A00001.

RFP Section 3.3 (page 13) Under the 99.5% acceptable performance standard for new hire document processing, will there be any consideration given if transfer information is not complete at the time of processing/transfer? No

RFP Section 8.3.A (page 80), Section 8.4.B and (page 80)

Two dates in the RFP, Section 8.3.A. (page 80), Questions or Clarifications, due by March 7 and Section 8.4.B (page 80), Proposal Due Date and Time, no later than March 23, provide very little time to compete and complete subcontractor agreements, produce a proposal to address the complexities of the requirement, or incorporate answers to industry questions. Will TSA consider providing at least 45 days from final RFP issue date until proposal due date?

Please see Section 8.3 of the RFP, which has been updated for Amendment A00001.

RFP Section 8.3.C (page 80) "All proposal text font (including graphs, charts, and other informative visuals) will be Times New Roman 12-point type…" Would the Government consider allowing a reasonable reduction in font size for graphs, chats, and other informative visuals, e.g., 10 points?

TSA will allow no smaller than 10 point font in graphics only.

RFP Section 8.5.D. (page 84), RFP Section 5.2 (page 51)

FAR 52.219-9 Small Business Subcontracting Plan (OCT 2015) calls for a Plan with goals “….expressed in terms of percentages of total planned subcontracting dollars…” The referenced RFP Section identifies goals for the varying categories of Small Business concerns resulting in an overall Small Business utilization goal of 45%. Please provide clarification as to whether the goals presented in the RFP are percentages, as required in the FAR Plan, of “planned subcontracting dollars”, of total Contract Value or, as is the case in typical Small Business set-asides, of total contract “Labor” dollars.

As outlined in RFP Section 8.5 (D), the goals and dollars must be provided. The goals presented are percentages of planned subcontracting dollas (and goals) of the total proposed price (and resulting contract value).

RFP Section 9.3 (page 88)

Section 9.3 Statement of Relative importance states "Factors 1-5... individually and when combined, are significantly more important than Factor 6.” Given the stated relative importance of Factors 1 through 5, with each being more important than Factor 6, and when combined, Factors 1 through 5 are significantly more important the Factor 6, please confirm Factors 1 through 5 individually are all significantly more important than Factor 6; is Factor 5 truly significantly more important than Factor 6?

In accordance with Section 9.3, Factors 1-5, “Technical Approach”, “Management Approach”, “Staffing Plan and Resource Approach”, “Small Business Participation”, and “Past Performance”, individually and when combined (emphasis added) , are significantly more important than Factor 6, “Price”; as proposals become more equal in the non-price factors the price factor will become equal to the non-price factors.

SOW Section 2.5 (page 9) Can the Government please provide an overview or estimated number of new initiatives the Agency might want to launch in the base period (next 6 months) and Option Years in order to respond with an appropriate estimate for support? Is an overview of the most pressing issues available?

No. It varies per year.

# RFP Document or Attachment Reference (or "General") Offeror Question Answer

SOW Section 3 (page 11) "However, there are instances when on-site support may be required." Does historical data exist that can be shared regarding the frequency and location of this possible support?

See Section 3 (page 11) of the SOW, which has been updated for Amendment A0001.

SOW Section 4 (page 13) "The Contractor may host their online tool within an appropriate contractor owned/controlled facility."

Is this facility required to be FedRAMP approved? If not, will a facility certification of any type be required?

All contractor provided systems will undergo a certification and accreditation process, requiring an ATO to be utilized by TSA.

SOW Section 4.21.2 (page 15)

"Benefits Election Forms contained within the tool are available for viewing and easy print out and are available for the employee up to 60 calendar days post-employment." What are the benefits forms in the tool?

SF-2809 and SF-2817.

SOW Section 4.21.3 (page 15)

"Wet Signature Forms (e.g., Employment Eligibility Verification, Computer Access Agreement, Appointment Affidavit, Mobility Agreement, Submission Acknowledgement forms, etc.) are available within the tool ..." Are these the only forms that require Wet Signatures? What about the Beneficiary forms?

No, the list provided are examples and are not all inclusive. TSA and the contractor shall follow federal guidance, such as OPM guidance, to include all updates and/or changes.

43 SOW Section 11.2 (page 20) "SINQ errors that cannot be resolved must be raised to TSA." Please clarify the time frame for TSA notification. See Section 11.2 of the SOW which has been updated in Amendment A00001.

SOW Section 11.3 (page 20) "Respond timely to inquiries that require research regarding beneficiary forms, FEHB, open season, service computation dates, FEGLI, and TSP." What is considered to be timely, e.g., 24 hours; 48 hours?

The timeframe for completing the research will vary depending on the situation. Some research could be completed within a few hours while other situations may require a few days. As long as cases are being worked on by the contractor, it is acceptable to have an unknown timeframe for completing the research. There will be an ongoing dialogue with the vendor and OHC on any outstanding inquiries and we will work together on a case by case basis to resolve any complex case.

SOW Section 11.8 (page 21)

"Process all necessary personnel actions and all payroll-related calculations, including generating manual SF-50s related to Federal Erroneous Retirement Coverage Corrections Act (FERCCA) and Retirement Error Correction cases, as provided by TSA, regardless of when the error occurred for active and/or former TSA employees." FERCCA is a retirement and payroll matter. Should this be included with the retirement portion? If not, will this be reviewed by a Retirement Specialist for correctness?

No, this is not part of the retirement requirement. The service provider is responsible for ensuring all transactions are processed accurately.

SOW Section 11.13 (page 21)

"Produce a Law Enforcement Certification Form for all employees who move out of a Law Enforcement Officer (LEO) covered position to a non-LEO covered position." LEO certification is a retirement function. Should this be included in the retirement function? If not, will this be reviewed by a Retirement Specialist for correctness?

See response to Question# 45

SOW Section 12.10 (page 23) "Process payroll documents into EmpowHR Including but not limited to: Employee Change of Address, Federal/State/County/City/Local Tax Data..." Will we be required to process FEHB during open season or will they be entered into the system by the employee, also TSP & TSP Catch-up?

Yes, the vendor will be responsible for processing FEHB open season elections and TSA and TSP Catch-up elections, which are not submitted by the employee.

SOW Sections 19, 20, 24

Can the Government clarify the roles, responsibilities, and relationships between the PP&B Contractor and the CSC Contractor as it relates to Sections 19, 20, and 24 of the SOW? Is the support of WebTA (Section 19) and WFC (Section 20) in addition to the requirements for Section 24?

Section 24 states, "the PP&B Contractor will be responsible for providing PP&B related content for Tier 0 FAQs and Tier 1 scripts, and for responding to inquiries pertaining [to] PP&B inquiries..." The requirements defined in Sections 19 and 20 appear to be more aligned with full Tier 1 support, and not the more limited scope defined in Section 24. We area seeking clarity into what help desk and system administration support the PP&B Contractor will be required to provide, and how that support will be aligned with the CSC Contractor.

The Customer Service Center service provider technology will be implemented in the PP&B contractor's environment for a single call escalation and tracking system.

49 SOW Section 22.3 (page 28) "Update SOPs and Process Flow Documents, as required and subject to TSA approval." How frequently will this be required? Any time there is a change in the process, or as directed by TSA.

# RFP Document or Attachment Reference (or "General") Offeror Question Answer

SOW Section 22.7 (page 28) "...responding to employees’ inquiries, validating eligibility and processing the lump-sum payments for…" This piece is a retirement function and should be handled by the retirement office.

No, this is not part of the retirement requirement. The service provider is responsible for ensuring all transactions are processed accurately.

SOW Section 23 (page 29) Please provide more historical data on the location and population of the training conference held.

Does the Government convey any training delivery system or shall it be provided by the contractor? See Section 23 of the SOW, which has been updated in Amendment A00001.

SOW Section 24.1 (page 29)

"...direct inquiries from TSA employees in a timely manner and provide general information/assistance." What is considered to be timely for a response, e.g., 24 hours/48 hours for emails; next day for phone calls?

See response to question# 44.

SOW Section 25 (page 31)

A number of the systems to be used by the PP&B Contractor are to be provided by the Government, can the Government confirm that all of the government-provided systems are integrated to the TSA's Integrated Data Warehouse? We are seeking confirmation that all of the data within government-provided systems will be available to the PP&B Contractor via the data warehouse and that once the Contractor's systems are integrated all data required to address Section 25 of the PWS will be available via the TSA's Integrated Data Warehouse.

Yes all government HR systems to be used by the contractor within the scope of this RFP are integrated with the IDW.

Except for eOrientation and FHR Navigator, the successful offeror(s) shall not present or incorporate the deployment of new/replacement software applications, SaaS, IaaS, PaaS, and/or CSP based solutions. TSA OHC will provide access to all applicable systems, which will be provided via Trusted Internet Connection (TIC). Offerors will utilize TSA's existing TSA owned/provided applications to execute HR Support Services requirements in the Statement of Work.

SOW Section 28 (page 33)

In Section 28, the Government lists five systems that will be provided by the Government to be used by the PP&B Contractor. Can the Government provide a complete list of systems as anticipated at this time? The purpose of this request is to aid respondents in ensuring we are clear in the Government's expectations, prepared to work within those systems to be provided, and also prepared to supplement the government-provided systems with contractor-provided systems where necessary to mee—and hopefully exceed—the requirements set forth within the SOW.

See Section 28 of the SOW.

SOW Section 28.2.1 (page 34) "Provide seamless and secure connectivity, via the Trusted Internet Connection (TIC)…" Can the Government provide additional details regarding TIC's data and integration services? See Section 28.1.5 of the SOW. Additional details will be provided post-award.

SOW Section 28.2.4 (page 34) "Utilize and obtain the appropriate licenses for the TSA approved (and directed) Federal Retirement Calculator tool/product." Please confirm that you wish for the contractor to provide and price the tool/product. Is there a current retirement calculator in use at TSA? If so, what?

See Section 28.2.4 of the SOW which has been updated in Amendment A00001.

57 SOW Section 31.5 (page 35) Please elaborate on the nature of the legacy data and databases. What form is the date in, i.e., MS Access?

Legacy data from eOrientation systems, if required, will be provided in commonly available file formats.

SOW Section 33.2 (page 39) Are we correct in assuming that all contractor-provided applications will require an ATO regardless of where hosted? Yes.

# RFP Document or Attachment Reference (or "General") Offeror Question Answer

SOW Section 34.12 (page 41) and 34.17 (page 41) In the SOW, Sections 34.12 through 34.17 references data and network recovery plans. Is it correct to assume that the Contractor will be responsible for the backup and recovery of data and network for only contractor-provided applications and not government-provided applications like NFC and IDW?

Yes.

60 RFP Attachment II, Retirement Actions What is this inclusive of, i.e., retirement estimates, retirement service computation dates, retirement applications (to include disability), and Death in Service? The volume is inclusive of all the functions listed.

61 Draft RFP Attachment II, Service Requests What does the total consist of, i.e., number of calls received, actions processed, emails, mail received? It includes all contacts for Tier 2 services: calls, emails, faxes, and mail.

RFP, Section 1- Services and Pricing For pricing purposes, will the Government confirm that Oct 31, 2016 as the expected contract start date, and April 30, 2021 is the Option Period 4 end date?

The anticipated period of performance of the resulting contract is: Base Period (10/31/2016 - 04/30/2017), 4 1-year options (05/1/2017 - 04/30/2021) and a six-month option period (5/1/2021 - 10/31/2021). The start date is contingent upon the vetting period, 60 days were assumed for the purpose of noting the anticipated start date. All pricing shall not be contingent upon the above anticipated dates but the outlined period of performance of the contract, i.e., Base and Option Period durations.

RFP , Section 1.1, CLIN 0006 for Field Performance Processing (Optional CLIN) lists the Unit as "Month", however the Option Year CLINs for this same task lists the Unit as "Job". Please clarify if this is a monthly task, or a per job task. Please see updated unit, now identified consistent with option periods as a "job".

RFP , Section 1.1, CLIN 0006 for Field Performance Processing (Optional CLIN) lists a Quantity of "1" and the Unit as

"Month". Please confirm this task is only performed for one month of the 6-month period or performance. See response to question# 63.

RFP, Section 1.1, Except for the Transition-In CLIN, all other Base Year CLINs are marked as Optional. Please clarify whether these tasks are all Optional, or only the Surge tasks should be marked as Optional.

All CLINs, except for CLIN 0001 Transition-In, are optional during the base period because of the Transition Period. The CLINs will be exercised, as needed, if the Offeror's proposed transition is less than six (6) months.

RFP, Section 1.1, For the Base Period, several Quantities are marked as To Be Proposed (TBP). Please confirm the proposed quantities To Be Proposed for these tasks are at the offerors discretion.

In accordance with Section 8.5, letter C., Factor 2 "Management Approach" of the RFP, the offeror shall submit an Ingress Transition Plan with a phase to assume full contract responsibility no more than six (6) months after contract start date. Based on the offeror's proposed transition phase, the offeror shall propose a quantity for the CLINs marked as "To be Proposed (TBP), for the period after the end of transition through the end of the base period.

RFP, Section 1.2, The Field Performance Processing CLIN Type is Fixed Unit Rate. 1. Please clarify what constitues a Unit for this task.

2. Which task in the SOW is associated with this CLIN?

See Section 1.2 of the RFP which has been updated for Amendment A00001.

See Section 8.4 of the SOW, which has been updated for Amendment A00001.

Attachment 1, SOW 23, Training Conference There is no CLIN for SOW section 23, training conference - should we assume that this work would be charged to the Operational Management CLIN in the pricing section?

See Section 23 of the SOW, which has been updated for Amendment A00001. Additionally, see section 1.2 of the RFP, which has been updated for Amendment A00001.

RFP, Section 1.3 Period of Performance states the contract will be for one(1) six-month base period, with four (4) 12 month option periods and one (1) six-month option period.

The Price Schedule in RFP Section 1.1 does not include CLINs for the six-month option period.

Please confirm the six-month option period referenced here should not be priced.

In accordance with Section 1.4 Transition, the Government’s intention is to exercise the “Option to Extend Services” and “Continuation of Services” clauses for transition out execution. If all option periods outlined above are exercised, transition out will occur during the final six-month option period, upon execution of the clauses outlined above. In accordance with FAR 52.217-8, the offeror’s Option Year 4 rates will be used for transition out services.

# RFP Document or Attachment Reference (or "General") Offeror Question Answer

RFP Section 1.1, The Firm-Fixed-Prices (FFP) for the base and each option period shall be inclusive of all costs necessary to implement and fulfill the item numbers and accompanying item descriptions shown in the Price Schedule below.

The Industry Day brief indicates a contract start date of October 31, 2016 with the end date of the Transition Period being April 30, 2017. Also per the information conveyed during industry day, it is understood that offeror's may propose a shorter transition in period than the six (6) month duration specified by the Base Period CLIN Structure. In the event that an offeror proposes a shorter transition period, should the offeror assume that the contract start date of October 31, 2016 is fixed and that Option Period 1 will be exercised at whatever point the proposed shorter transition period ends (i.e. if the proposed Transition Period is 3 months, the start date for Option 1 would be January 31, 2017)? Or, is the date of April 30, 2017 the date that is fixed such that a proposed shorter transition would create a contract start after October 31, 2016 (i.e. if the Transition Period is 3 months, the contract start date would be January 31, 2017)?

The Base Period has a period of performance of six months. Transition will be proposed by the offeror. If the transition period is shorter than six months, all the FFP optional CLINs for the base period will be exercised for the remaining months in the 6-month period. The Base Period will end after the six months. The duration of the Base Period will not vary according to the Transition.

RFP Section 1.1, The Firm-Fixed-Prices (FFP) for the base and each option period shall be inclusive of all costs necessary to implement and fulfill the item numbers and accompanying item descriptions shown in the Price Schedule below.

Reference is made to RFP Section 1.1 Contract Line Item (CLIN) Structure for the 6 Month Base Period. This section allows offerors to identify the quantity of months associated with the base period as well as a Transition-In CLIN to support transition activities at time of contract start and termination;

to include knowledge and data transfer per the SOW 22.11. This Base Year CLIN and SOW construct greatly favors the incumbent since Base Year Transition pricing is part of the total price of the proposal being evaluated pursuant to RFP Factor 6: Price. To promote fair competition and eliminate inherent advantages of the incumbent contractor having a naturally lower price for the Transition In and Base Period CLIN duration, will the Government consider removing these values from the offeror's total Evaluated Price or introducing normalizing attributes to the Base Period CLIN Structure?

As outlined in RFP Section 9.4 "The proposals shall be evaluated to determine if the prices are fair and reasonable.