RH_QandA_-_A00001.pdf

Question

No.

RFP Document or Attachment Reference (or state "General") Offeror Question TSA Response

General What is the current contract award amount? There is no current contract for only Recruitment and Hiring services which is what this RFP is for.

There is only a contract in place that "includes" recruitment and hiring services. Therefore, there is no current contract award amount for recruitment and hiring.

General What is the name of the current contractor? Lockheed Martin is the current Prime Contractor providing the rercruitment and hiring services under the OHCAccess contract.

General Are there any incumbent employees currently performing? If yes, could the government share anniversary dates to calculate vacation time?

Yes, there are incumbent employees currently performing.

TSA will not share anniversary dates as it is not necessary for pricing purposes.

General Would incumbent employees have 1st right of refusal under this opportunity?

Yes, per the applicability of paragraph 4.8 of the RFP.

General Will TSA consider an extension to the RFP due date from the current due date of April 11th?

Proposal due date is changed from 04/11/2016 to 04/18/2016.

SOW, Page 12, TSO Applicant Tracking System;

TSA has a need for an Applicant Tracking System after the current contract expires. TSA currently utilizes an Applicant Tracking System known as the

Airport Assessor Dashboard to monitor TSO candidate progress throughout the hiring process.

This system enables airports to review the current status of their TSO candidate hiring pipelines (i.e., the quantities of candidates within each step of the hiring process), communicate and update their

TSO hiring needs, schedule candidates for assessments, run various reports, upload candidate forms, and store reference documents for field use.

Is the TSO Applicant Tracking System known as the Airport

Assessor Dashboard comprised of multiple contractor systems?

No, the current dashboard is a singular system. The candidate status shown on the dashboard is updated from information from other systems. See Section 3.1.1 and 3.1.2 of the SOW.

SOW, Page 13, 3.1.3; Integrate with TSA’s

Assessment Platform (TAP) system to automatically notify the TAP vendor as candidates become eligible for Computer Based Tests (CBTs).

The Applicant Tracking System shall be configurable and able to implement business rules that allow the system to select candidates for CBTs

(e.g., if a TSO candidate fails their computer based test, they are ineligible for invite to re-test again for six months should they re-apply). TSA will provide the business rules to the Contractor upon base contract award for the transition period.

Is the applicant tracking system referred to in this statement a different system than the Airport Assessor? It is our assumption a TSA owned system and/or I.H.S feeds the TAP system candidates eligible for CBT and that same system then feeds eligible candidates to the airport assessor, is this correct?

No, It is one in the same system. See Section 3.1.1 and 3.1.2 of the SOW.

No, the assumption is not correct. The contractor will need to use their own process to track applicants eligible for CBT and communicate to the TAP vendor the appropriate quantities of candidate invitations needing to be extended. See Section 3.1.3 of the SOW.

SOW, Page 26, 3.1.15.7.9; Use the TSA Customer

Service Center tracking system to document the handling and closing of inquiries and requests from employees and candidates.

When is it expected that the CSC will be awarded and what is the expected date that the CSC will be operational?

At this time, the expected award date for the Customeer Service Center is in April. However, there is not an expected date that the Customer Service Center will be operational at this time.

SOW, Page 32, 3.1.18.1; Initiate access to OPM’s

Electronic Questionnaires for Investigations

Processing (e-QIP) system for TSO candidates (at the TSA designated point in the hiring process), via batch uploads containing candidate information, so that they can electronically complete their SF-86

(e-86).

It is understood that the contractor will have access to e-QIP to upload candidate information for background. Can the

TSA elaborate on the process and if manual intervention is involved or other databases outside the Airport Assessor is used in determining the candidate’s to be “batch” uploaded?

TSA Personnel Security will assign the appropriate contractor staff members access to e-QIP to initiate access to candidates. The dashboard could be utilized to identify candidates that have reached the stage in which e-QIP access is initiated OR the contractor could maintain their own tracking system to determine when to initiate access. The e-QIP system allows for candidate access to be initiated either on a single candidate basis or as a batch upload (via upload of an Excel spreadsheet containing all the pertinent data fields). See Section 3.1.18.1 of the SOW.

SOW, Page 47, 4.1.7.1; Develop an Applicant

Tracking System (to be known as the FAM Assessor dashboard), customized to integrate with the TSO

Airport Assessor system, that has its own user interface and separate FAM information from the

TSO user population. The system shall include, but not be limited to, the following features

If the FAMS Assessor and the TSO Airport Assessor information and interface has a defined separation, can the

TSA elaborate on the need for integration between the two systems and what is shared?

They technically do not need to be integrated, but rather offer similar functionality and allow field users, based on their access rights, to toggle between the TSO Applicant tracking system and the FAM

Applicant tracking system. See update to Section 4.1.7 and 4.1.7.1.15 of the SOW.

SOW, Page 79, 9.1 Reporting; It is stated the reports are generated using the TSA’s Integrated

Data Warehouse (IDW).

Are all the reports listed generated directly from the IDW? If not can the TSA specify the system owner of the reports?

Will the reports listed and the code to the generate the reports be GFE, meaning will these reports still function as part of transition or will awardee need to replicate the report from any existing requirements?

No, some reports are updated/produced with data in the IDW; while others will come from the vendor provided systems per the SOW. Functional Requirement Documents (FRD) will be provided for those reports in which an existing FRD exists. All Contractor systems and data shall be integrated with the TSA’s Integrated Data Warehouse (IDW), which houses the data to generate reports and feed other systems. The Contractor will not be required to duplicate reports. New reports shall be generated, as required, on an ad hoc basis. Awardee will be required to run reports to meet SOW requirements. See Section 9.1.1.1 and 9.1.1.2 of the SOW.

SOW, Page 131, 20.1.3 Acquisition of Software

Licenses; Any configurations made by the contractor of Commercial Off-the-Shelf (COTS) or

Government Off-the-Shelf (GOTS) software or any interfaces developed by the contractor for data capture, ingestion, storage, reporting or manipulation shall be considered as belonging to

DHS/TSA without qualification.

Does this mean any existing technology, owned by the contractor, but configured for this project will become the property of the government? What compensation is the government proposing in lieu of taking ownership of the contractor’s COTS software?

Please see updated Section 4.23 of the RFP and FAR clause 52.227-14 incorporated by reference in

Section 5.0 of the RFP.

Attachment_V Pricing Structure Can TSA clarify CLIN 0003AS in terms of what the intent the hours are to cover? TSA references the Airport Assessor tool but we are not clear where pricing for such tool should be included. Please provide guidance.

CLIN 0003AS is not a CLIN for this requirement; however, under the assumption the question is referring to CLIN 0003AB, the hours are to cover all non-tool Airport Assessment work under Section

3.1 of the SOW. The TSO Applicant Tracking System (i.e., the Airport Assessor Dashboard) refers to the system which is priced under CLIN 0007.

Recruitment and Hiring Questions and Answers - HSTS01-16-R-HRM037 - A00001

SOW, 15.16.5, Authority to Operate page 119 &

15.9.1, page 107 Data Stored/Processed; In the

RFP under continuous monitoring it states: The data shall be encrypted in accordance with FIPS

140-2 Security Requirements for Cryptographic

Modules and shall not be stored on systems that are shared with other commercial or Government entities. Somewhat conversely, the SOW states:

“Unless otherwise directed by TSA, any storage of data must be contained within the resources allocated by the Contractor to support TSA and may not be on systems that are shared with other commercial or government clients.”

Can the TSA clarify whether data can be stored and processed on resources across different contracts hosting only TSA?

All data must be stored in the IDW and data must to be physically separated from all other Federal agencies' data.

If vendor has another contract at TSA, vendor’s proposed approach must meet SOW requirements.

See Section 15.9.1 and 15.16.5 of the SOW.

Section VIII: Instructions to Offerors – 8.3 Proposal

Submission Instructions – C. General Information

Would the Government consider changing the font size to 8 to 10 pt. and font family to Arial for graphics and tables?

See paragraph 8.3C. of the RFP for the following language change: TSA will allow no smaller than 10-point font in graphs, charts, and other informative visuals.

Section VIII: Instructions to Offerors – 8.3 Proposal

Submission Instructions – C. General Information

Would the Government like a Glossary of Acronyms and

Abbreviations to be included for each volume? If so, can it be excluded from page count?

No, the Government would not like a Glossary of Acronyms and Abbreviations included with each volume. Acronyms and abbreviations should occur when first spelled out and used within the proposal. Nothing beyond the Instructions to Offerors in Section VIII of the RFP should be included with your proposal.

Section VIII: Instructions to Offerors – 8.3 Proposal

Submission Instructions – C. General Information

Would the Government like a Cross Reference Matrix (CRM) to be included for each volume? If so, can it be excluded from page count?

Vendor must follow instructions presented in Section 8.4 B of the RFP. Nothing beyond the

Instructions to Offerors in Section VIII of the RFP should be included with your proposal.

Section VIII: Instructions to Offerors – 8.4 Proposal

Preparation Instructions – C. Volume I: Technical

Proposal - Factor 2 Management Approach

8.4 A. General Information states: “Only provide resumes

for individuals identified in Section V, under clause HSAR

3052.215-70 Key Personnel” 8.4 C. Volume I Factor 2 states the Offeror shall provide resume for the Program

Manager, which is not one of the 6 key personnel listed in

HSAR 3052.215-70.

Is the Program Manager and Project Manager the same key personnel position?

Section 8.4C., Volume I, Factor 2 - Management Approach, Amendment A00001: Language has been changed to read "The Offeror shall also provide resumes for all key personnel as identified in Section

V, under clause HSAR 3052.215-70 Key Personnel Or Facilities and the proposed roles and responsibilites of each."

Section VIII: Instructions to Offerors – 8.3 Proposal

Submission Instructions – B. Proposal Due Date and Time

“Offerors shall limit transmission of any response to less than 8MB.” Is the 8MB maximum per file/volume or for the entire submission of all volumes?

Language changed in Section 8.3B. Paragraph 2 allowing offerors to submit multiple emails for their proposal where each email shall be under the 8MB limit.

Section VIII: Instructions to Offerors – 8.4 Proposal

Preparation Instructions – C. General Information

Would the Government like each volume to include a cover page and table of contents (and exclude these pages from page limits)?

No, the Government would not like each volume to include a cover page and table of contents.

Nothing beyond the Instructions to Offerors in Section VIII of the RFP should be included with your proposal.

SOW 5.1.13.5 Please clarify if the Government would like all offer letters issued via USPS in addition to email.

Offer letters should be issued electronically; however, on rare occasions and at the request of TSA, the

Offeror may be asked to issue a hard copy offer letter via postal mail.

Section VIII: Instructions to Offerors – 8.4 Proposal

Preparation Instructions – C. General Information

Are Offerors permitted to use 11x17 pages for tables, graphics, charts, etc.?

No, the paper size permitted can be found in Section 8.3C of the RFP.

Attachment V Price Schedule The description in row 23 for all option periods is titled

“Price Base Period.” Will the Government update the text to reflect appropriate option periods and provide a revised template prior to submission?

The text has been updated for each Option Period to show the total price for each Option Period. See

Attachemnt V - Price Schedule - A00001.

Section VIII, Volume IV: Price Proposal – Narratives for pricing data, i.e. basis of estimate

Can basis of estimates narratives for proposed labor hours be provided in an MS Excel format?

Section 8.3C. Of the RFP says "Volume IV “Price Proposal” shall be submitted in MS Excel Format and

MS Word (or PDF) Format. MS Excel shall be used for pricing information (i.e., calculations)." Emphasis is on the use of Excel only when calculations are being used.

Section 3.1.6.1 (page 14) Please confirm if the Government would like the resumes to be available on the ATS/assessor dashboard or if they can be provided through an alternative means.

Language changed to "Resumes can be accessible through the ATS/assessor dashboard or alternative means, provided field users have timely access to the “alternative” means to access the resumes."

Section 3.1.13.8 (page 23) When will TSA provide the business rule for CBT Involuntary

Withdrawals?

All business rules will be provided post award as part of knowledge transfer after contract award.

Section 3.1.6.1.12 (page 16) We are concerned of the PII risk involved in storing and displaying the e-86 on the forms dashboard. Please confirm that this is the intention. If this form is required, who will be authorized to have this elevated access? Instead of providing examples, please verify and specify the required forms the Government would like to store on the forms dashboard.

The form referenced in Section 3.1.6.1.12 of the SOW is not the actual electronic SF-86 (or e-86); it is a candidate acknowledgement form.

Forms include: NDA, the e-86/OF-306 Acknowledgement Form cited above, and any DD-214, VA Letter or other documentation provided by the candidate for Veterans preference. See Section 3.1.6.1.12 of the SOW.

CLIN 3AD Are medical mobile costs inclusive of hotels, testing rooms, travel, and per diem or will this be covered under CLIN 5?

All travel costs shall be invoiced in accordance with 3.2 and 4.14 of the RFP and are covered under the

ODC CLIN (0005 through 5005). The hotel rooms for the staff traveling to the mobile medical should be invoiced to the travel CLIN. The costs associated with procuring space to conduct the medical exams should be invoiced as part of the mobile medical.

CLIN 3AC, Attachment V Price Schedule In the base period and option period 5, the medical transaction quantity is listed at 28,000 for a six-month period. Please confirm.

CLIN 0003AC in the Base Period of Performance and CLIN 5003AC in Option Period 5 Period of

Performance have been changed from Quantity 28,000 to 14,000. See Attachment V - Price Schedule -

A00001.

CLIN 5 Will TSA provide their cost estimate for CLIN 5 prior to proposal submission?

The NTE amount for the ODC CLIN has been added. See Attachemnt V - Price Schedule - A00001.

Section 3.3 Contractor Accountability and

Violations

Offerors request TSA to reconsider the approach in penalizing contractors. We are requesting TSA apply a percentage reduction to the applicable CLIN(s) where performance standards and quality levels were not achieved for the given month. Additionally, we are requesting the PII violation percentage applied be reduced to 3% up to 5% for a contractor breach.

TSA's approach remains unchanged.

Section 3.1.11.6 Receipt of Job Applications

Can the Government please identify the determinations that must be manually reviewed?

Provided the automated eligibility requirements are properly established within the automated system, there should only be limited instances in which a manual review is required of applications that are declined through automation. See Section 3.1.11.6 of the SOW.

Section 4.1.7.1.1 (page 47) FAM

Applicant Tracking System

Within the FAM Applicant Tracking System SOW section, there is a requirement to “provide a snapshot pipeline view of FAM applicants (entry-level and promotions).” The remaining SOW requirements for FAM as well as Attachment

II.B FAM Hiring only describes entry-level processes. Is the

Government’s intent for FAM promotion data to be viewed in the FAM Applicant Tracking System?

In addition to the G-band, entry level FAM position, the FAM Applicant tracking system may display a pipeline summary for internal FAM applicants going through the multiple hurdle J-Band promotion process. See Section 4.1.7.1.1 and 4.1.5 of the SOW.

General Given the importance of subcontracting to achieve the TSA goals, will the government consider extending the proposal due date to provide sufficient time for Offerors to coordinate with small business team members, to address the government’s responses to questions prior to proposal submission?

Proposal due date is changed from 04/11/2016 to 04/18/2016.

General Which currently existing systems (e.g., Siebel, Data

Warehouse, Pan) are owned by LMCO vs TSA?

Examples are included in the following Sections of the SOW: 3.1.11.1, 3.1.12, 4.1.4, 3.1.15.7.9, 4.1.5.

See APPENDIX 1 of the SOW for a description of the OHCAccess System Architecture.

Page 99 of 101. Section 9.4 EVALUATION

FACTORS.

States, "[…] Factors 1-4, individually and when combined, are significantly more important than Factor 5.” Given the stated relative importance of Factors 1 through 4, with each being more important than Factor 5, and when combined, Factors 1 through 4 are significantly more important the

Factor 5, please confirm Factors 1 through 4 individually are all significantly more important than Factor 5; is Factor 4 truly significantly more important than Factor 5?

As stated in the RFP, Section 9.4, Evaluation Factors: "Factors 1-4, individually and when combined, are significantly more important than Factor 5."

RFP Section 5.2 Federal Acquisition Regulations

(FAR) Clauses Incorporated in Full Text, 52.212-5

Contract Terms and Conditions Required to

Implement Statutes or Executive Orders-

Commercial Items (JAN 2016), (12) (i), 52.219-4

Notice of Price Evaluation Preference for HUBZone

Small Business Concerns (OCT 2014), RFP Page 56

Please advise as to the rationale for including FAR 52.219-4 as a term of this solicitation.

FAR clause 52.219-4 is included under Section 5.2 of the RFP because it is prescribed in FAR

19.1309(b), which states that "The contracting officer shall insert the clause at 52.219-4, Notice of

Price Evaluation Preference for HUBZone Small Business Concerns, in solicitations and contracts for acquisitions conducted using full and open competition." This is a full and open competition for commercial services.

Attachment II.B FAM Hiring This attachment implies that HQ FAMS positions will be pulled into TSA and the G Band (Flying FAMS) and the J Band

(Field Office supervisors) along with MAP positions in the

Field Offices will be contracted. Which group would Atlantic

City (training and medical staff) be considered?

FAMS training and medical staff in Atlantic City are treated as an extension of the FAMS Reston HQ staff.

RFP:

HSAR 3052.204-71 CONTRACTOR EMPLOYEE

ACCESS (SEP 2012) Alternate I (SEP 2012)

(c) Contractor employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability.

Completed forms shall be submitted as directed by the Contracting Officer. Upon the Contracting

Officer's request, the Contractor's employees shall be fingerprinted, or subject to other investigations as required. All Contractor employees requiring recurring access to Government facilities or access to sensitive information or IT resources are required to have a favorably adjudicated background investigation prior to commencing work on this contract unless this requirement is waived under Departmental procedures.

We believe that this only applies to contractor personnel that are performing the solution implementation services and not the Cloud Services Provider (CSP) personnel that are hosting the solution. For example, Cloud Service Provider engages the services of a background screening vendor to conduct background checks, as on employees at the time of hire in the U.S. Can TSA please modify these requirements accordingly?

No. All contractor and subcontractor employees who access TSA systems or data are subject to badging and security requirements. The requirements remain as written.

RFP:

4.3. 5200.204.004 REQUIREMENTS AND DUTIES

FOR HANDLING SENSITIVE SECURITY

INFORMATION (SSI) (JUL 2015)

e) Breach. In accordance with 49 C.F.R. Part

1520.9(c), the Contractor agrees that in the event of any actual or suspected breach of SSI (i.e., loss of control, compromise, unauthorized disclosure, access for an unauthorized purpose, or other unauthorized access, whether physical or electronic), the Contractor shall immediately, and in no event later than one hour of discovery, report the breach to the Contracting Officer and the COR. The Contractor is responsible for positively verifying that notification is received and acknowledged by at least one of the foregoing

Government officials.

In the event that an SSI breach occurs as a result of the violation of a term of this contract by the

Contractor or its employees, or the Contractor’s covered persons, the Contractor shall, as directed by the Contracting Officer and at no cost to the

Government, without delay correct or mitigate the violation.

For unauthorized disclosure of SSI, the Contractor and Contractor's employees and Contractor’s covered persons may also be subject to civil penalties and other consequences as set forth in

The Cloud Service Provider is a service provider and TSA would be one of hundreds of thousands of customers using the service. Cloud Service Provider can contractually commit to incident response reporting timeframes in a customer contract. One component driving the timeframes are the

Cloud Service Provider’s ability to communicate to a wide customer base in the event of an incident. In a multi-tenant cloud environment, the Cloud Service Provider could be reporting to thousands of customers if there is a security incident impacting multiple customers. Cloud Service

Providers utilize one incident response process for all customers. Utilizing one approach allows for scalability and ease of operations. As such, we would like to request the requirements for breach notifications should align with the existing CSP reporting requirements that also align with

FedRAMP.

Additionally, due to the nature of the Cloud Service

Provider’s service, the Cloud Service Provider can only report actual breaches, not attempted breaches not suspected, threatened, or foreseeable breaches. As a multitenant environment, an attempted breach against another tenant would not be reported to TSA.

In the event of a security breach and if negotiated in the agreement, the Cloud Service Provider can notify TSA identified points of contact. The CSP cannot notify affected parties because the CSP does not view customer data. The see question 39

Attachment 1 - SOW:

15.1.3 The Contractor shall be privy to sensitive

organizational information. A Privacy Management

Plan and signed DHS Non-Disclosure Agreements

(NDAs) for Contractor personnel are required within (30) calendar days of the contract start date.

We believe that this only applies to contractor personnel that are performing the solution implementation services and not the Cloud Services Provider personnel that are hosting the solution?

Cloud service provider personnel are required to sign an

NDA, that covers all customer data, not specifically the data belonging to a single tenant of the system. Additionally, we assume that the NDA language that is incorporated as part of the overall cloud/SaaS subscription agreement will meet this requirement.

We request that this requirement to be modified to reflect that this is not required for Cloud Service Provider employees hosting the solution.

see question 39

Attachment 1 - SOW:

15.2.2 All Contractor employees shall receive initial

TSA IT Security Awareness Training within 60 days of assignment to the contract.

We believe that this only applies to contractor personnel that are performing the solution implementation services and not the Cloud Services Provider personnel that are hosting the solution?

For example, the CSP adheres to FedRAMP requirements without tenant specific training. The CSP’s process requires employees to sign and acknowledge receipt of the Employee

Handbook, the Code of Conduct, and the Employee

Proprietary Information and Rights Agreement. Employees also take code of conduct and legal compliance training.

Initial and annual Security Awareness Training includes security best practices, threat recognition, compliance and policy requirements, and reporting obligations. Follow-up security awareness training is presented to all personnel.

We request that this requirement to be modified to reflect that this is not required for Cloud Service Provider employees hosting the solution.

see question 39

Attachment 1 - SOW:

15.3.1 Hardware or software configuration

changes shall be in accordance with the DHS

Information Security Performance Plan (current year and any updates thereafter), the DHS

Continuous Diagnostics and Mitigation (CDM)

Program to include dashboard reporting requirements and TSA’s Configuration

Management policy. The TSA Chief Information

Security Officer (CISO)/Information Assurance and

Cyber Security Division (IAD) must be informed of and involved in all configuration changes to the

TSA IT environment including systems, software, infrastructure architecture, infrastructure assets, and end user assets. The TSA IAD will approve any request for change prior to any development activity occurring for that change and will define the security requirements for the requested change.

We are proposing a SaaS/PaaS solution to achieve TSA's requirements. The infrastructure is fully hosted and managed by the Cloud Service Provider and not by TSA. The

SaaS/PaaS solution will be configured to TSA's specific requirements. Therefore, can TSA adjust the requirement to reflect this and remove that configuration changes to the infrastructure architecture and assets are not applicable to

SaaS/PaaS solutions being proposed?

see question 39

Attachment 1 - SOW:

15.3.2 The Contractor shall ensure all application

or configuration patches and/or Requests for

Change (RFC) have approval of the Technical

Discussion Forum (TDF), Systems Configuration

Control Board (SCCB), and lab regression testing prior to controlled change release under the security policy document, TSA Management

Directive (MD) 1400.3, and TSA Information

Assurance Handbook, unless immediate risk requires immediate intervention. Approval for immediate intervention (emergency change) requires approval of the TSA CISO, SCCB co-chairs, and the appropriate Operations Manager, at a minimum.

15.3.3 The Contractor shall ensure all sites

impacted by patching are compliant within 14 days of change approval and release.

Cloud Service Provider offers SaaS/PaaS in a multi-tenant cloud environment and provides multiple major release upgrades annually that do not affect customers' configured solutions on the CSP's platform and which customers can typically opt-in to upgraded functionality. CSP has one maintenance and upgrade schedule that supports thousands of customers. Can TSA please adjust this requirement accordingly?

see question 39

Attachment 1 - SOW:

15.3.6 The Contractor shall establish processes

and procedures for continuous monitoring of

Contractor systems that contain TSA data by ensuring all such devices are monitored by, and report to, the TSA Security Operations Center

(SOC). The Contractor shall perform monthly

Nessus scans on servers that contain TSA data, and shall send monthly scan results to the TSA IAD.

Cloud Service Provider conducts scanning as a part of continuous monitoring in accordance with FedRAMP requirements. Any vulnerabilities found will be published in our monthly POA&M. Can TSA please adjust this requirement accordingly?

15.7.2 Private Sector System Requirements: TSA

shall conduct audits at any time on the private sector systems, and the system shall be entered into the TSA FISMA Inventory as a system of record using the Control Implementation Summary (CIS) provided by the Cloud Service Provider. Security artifacts shall be created and maintained in the

DHS Information Assurance Compliance Tool

(IACS). The private sector systems are required to go through the Security Authorization Process and the Risk Management Framework in accordance the Federal Information Systems Management Act and NIST SP 800-37 Rev. 1. The cloud internet connection shall be behind a commercial Trusted

Internet Connection that has EINSTEIN 3

Accelerated (E3A) deployed. Security event logs and application logs shall be sent to the TSA SOC.

Incidents as defined in the TSA Information

Assurance 1400.3 Management Directive and

Handbook shall be reported to the TSA SPOC 1-800-

253-8571. DHS Information Security Vulnerability

Management Alerts and Bulletins shall be patched within the required time frames as dictated by

DHS.

The Cloud Service Provider solution is a multi-tenant service.

Annual site visits can be negotiated, but in consideration of our other customers, random access cannot be permitted.

As a multi-tenant service, compartmentalization is virtual, not physical. The Cloud Service Provider contracts with third party auditors to inspect and review our security. The results of these audits can be provided as desired. Can this requirement be removed or adjusted for a multi-tenant service?

see question 39

Attachment 1 - SOW:

15.7.1 FedRAMP Requirements: Private sector

solutions will be hosted by a Joint Authorization

Board (JAB) approved Infrastructure as a Service

(IaaS) Cloud Service Provider (CSP)

(http://cloud.cio.gov/fedramp/cloud-systems) and shall follow the Federal Risk and Authorization

Management Program (FedRAMP) requirements.

Will TSA also accept Platform-as-a-Service (PaaS) and

Software-as-a-Service (SaaS) solutions that have received an

Agency FedRAMP ATO?

see question 39

Attachment 1 - SOW:

15.8.1 All services, hardware and/or software

provided under this task order must be compliant with DHS 4300A DHS Sensitive System Policy

Directive, DHS 4300A Sensitive Systems

Handbook., TSA MD 1400.3 Information

Technology Security Policy, TSA Information

Assurance Handbook and Technical Standards.

There is significant overlap, but some contradiction between the requirements listed in 15.18.1. Since many of these are based on the NIST standards is FedRAMP compliance sufficient to meet TSA's standards? If not, please specify which requirements from each document would be applicable for this service see question 39

Attachment 1 - SOW:

15.9.1 Unless otherwise directed by TSA, any

storage of data must be contained within the resources allocated by the Contractor to support

TSA and may not be on systems that are shared with other commercial or government clients.

Can TSA please remove this sentence, "Unless otherwise directed by TSA, any storage of data must be contained within the resources allocated by the Contractor to support

TSA and may not be on systems that are shared with other commercial or government clients."

The CSP’s PaaS/SaaS multi-tenant architecture and secure logical controls address separation of customer data. CSP has configurable security features that allow customers to customize security based on the sensitivity of data customers store in the application consistent with the requirements in NIST SP 800-53 Rev. 3 for moderate impact systems. Our rationale is also in alignment with FedRAMP requirements using virtual isolation between related entities.

see question 39

Attachment 1 - SOW:

15.12.1 The contractor must satisfy requirements

to work with and safeguard Sensitive Security

Information (SSI), and Personally Identifiable

Information (PII). All support personnel must understand and rigorously follow DHS and TSA requirements, policies, and procedures for safeguarding SSI and PII. Contractor personnel shall be required to complete Annual online training for SSI, Informational Security, and TSA

Privacy training, which take approximately one hour each.

We believe that this only applies to contractor personnel that are performing the solution implementation services and not the Cloud Services Provider personnel that are hosting the solution?

For example, the CSP adheres to FedRAMP requirements without tenant specific training. The CSP’s process requires employees to sign and acknowledge receipt of the Employee

Handbook, the Code of Conduct, and the Employee

Proprietary Information and Rights Agreement. Employees also take code of conduct and legal compliance training.

Initial and annual Security Awareness Training includes security best practices, threat recognition, compliance and policy requirements, and reporting obligations. Follow-up security awareness training is presented to all personnel.

We request that this requirement to be modified to reflect that this is not required for Cloud Service Provider employees hosting the solution.

15.13.1 At the expiration of the contract, the

contractor shall return all TSA information and IT resources provided to the contractor during the contract, and provide a certification that all assets containing or used to process TSA information have been sanitized in accordance with the TSA

MD 1400.3, TSA Information Assurance Handbook and Technical Standards. The contractor shall certify in writing that sanitization or destruction has been performed. Sanitization and destruction methods are outlined in the NIST Special

Publication 800-88 Guidelines for Media

Sanitization, and TSA Technical Standard 046 IT

Media Sanitization and Disposition. The contractor shall email signed proof of sanitization to the COR.

In addition, the contractor shall provide a master asset inventory list that reflects all assets, government furnished equipment (GFE) or non-

GFE that were used to process TSA information.

To provide the best quality of service to our customers, the

CSP retains backups for 90 days. The certification of assets that have been sanitized may be impractical, but the CSP follows NIST 800-88.

Can TSA further specify this requirement to be more flexible based on the Cloud Service Provider's processes and adjust this requirement accordingly?

see question 39

Attachment 1 - SOW:

15.15.4 Applicability of Internet Protocol Version 6

(IPv6) to DHS-related components (networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the DHS Enterprise Architecture (per OMB

Memorandum M-05-22, August 2, 2005) regardless of whether the acquisition is for modification, upgrade, or replacement. All EA related component acquisitions shall be IPv6 compliant as defined in the U.S. Government

Version 6 (USGv6) Profile (National Institute of

Standards and Technology (NIST) Special

Publication 500-267) and the corresponding declarations of conformance defined in the USGv6

Test Program.

Does this refer to all systems in the stack or just the interface between the browser and the SaaS service? Is it your desire to allow users to connect to a cloud service via IPv6? Is it mandatory that a Cloud Services Provider be IPv6 compliant today or is it acceptable to respond with a path to become compliant?

see question 39

Attachment 1 - SOW:

15.17 Section 508 of the Rehabilitation Act, as

amended by the Workforce Investment Act of

1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use electronic and information technology (EIT), they must ensure that it is accessible to people with disabilities. Federal employees and members of the public who have disabilities must have equal access to and use of information and data that is comparable to that enjoyed by non-disabled

Federal employees and members of the public.

Can TSA define the level of accessibility required? Is accessibility acceptable via customized user interfaces? Is

TSA willing to work with a vendor to create a more accessible solution?

Accessibility is sufficiently defined in Section 15.17 of the SOW. There are no exceptions to 508 web services, all access must be compliant and meet the requirements of the SOW.

General In today's recruitment and hiring market, potential employees expect to be able to see job announcements and apply for positions all from a mobile device. Is TSA looking for a Recruitment and Hiring mobile application to assist in its recruitment activities?

The Offeror should include in its proposal solutions and approaches that are responsive to TSA requirements.

General Does TSA need a community of practice to encourage collaboration and sharing amongst its recruiting staff and partners?

The Offeror should include in its proposal solutions and approaches that are responsive to TSA requirements.

General Does TSA need a way to track all interactions with potential hires? Is a CRM system needed that can capture information once for tracking purposes?

The contractor is responsible for tracking all interactions with TSA applicants. See Section 11.1.2 of the SOW.

General Does TSA need a dashboard and analytics that managers can view on a mobile device?

The Offeror should include in its proposal solutions and approaches that are responsive to TSA requirements.

General Do TSA managers and HR need analytics on their mobile device to explore trends and explore their recruiting data?

The Offeror should include in its proposal solutions and approaches that are responsive to TSA requirements.

General Do TSA managers and HR need analytics on their mobile device to have customized reports and views?

The Offeror should include in its proposal solutions and approaches that are responsive to TSA requirements.

General Does TSA need a robust development platform to build custom applications to assist with hiring and recruiting activities?

The Offeror should include in its proposal solutions and approaches that are responsive to TSA requirements.

General Does TSA need a solution with an extensive set of APIs to integrate with other Hiring and Recruiting applications?

The Offeror should include in its proposal solutions and approaches that are responsive to TSA requirements.

General Does TSA need a case management solution to track and route activities amongst the contractor, TSA and other contractors?

See Section 11.1.2 of the SOW.

Attachment 1, 3.1.16 Is there a current vendor handling the medical evaluation function, and does TSA already have established relationships with affiliates at specific geographic locations?

Yes, the current prime contractor handling recruitment services has a sub contractor that maintains a network of medical affiliates that cover the required geographic locations. See Section 3.1.16 of the

SOW.

General How many employees of the current contractor and their subcontractors are presently employed and covered by the

Service Contract Act? What positions do they fulfill?

The number of employees and subcontractors covered under the Service Contract Act and their current positions are not relevant to respond to the requirements in the Solicitation.

Attachment III - Past Performance Questionnaire Row 79 of the Past Performance Questionnaire provides 5 options for the customer to select from. 4 of the 5 are negative statements and two are identical. Suggest that the second “Probably Would Not” be changed to “Definitely

Would”.

The language in Attachment III - Past Performance Questionnaire, row 79, included in Amendment

A00001, has changed the final option from "Probably Would Not" to "Definitely Would". See

Attachment III - Past Performance Questionnaire - A00001.

General Will TSA honor EODs of current incumbent staff or will they be required to go through the suitability determination for contractor employees when the new contract is awarded?

Current TSA personnel security policy has provisions that permit Contracting Officer Representatives to complete timely and valid transfer requests for individuals currently working on another TSA contract. Should such a request be made, the active employees should not be required to complete a new suitability determination.

RFP Section 8.4 Proposal Preparation Instructions, D. Volume II: Past Performance page 95 states

“Offerors shall provide at least three (3) different but not more than five (5) different past performance references” and “Offeror shall include past performance references for proposed subcontractors but shall exceed no more than five

(5) for the team”.

To ensure clarity, is the government expecting a mix of past performance references for the Prime and subcontractors not to exceed five (5) references in total?

Yes. The minimum number of past performance references for the Prime is three (3). The maximum number of past performance references for the team (Prime and subcontractors included) is five (5).

RFP Section 9.4 Evaluation Factors, Factor 3 Past

Performance page 100.

Will the government be evaluating Prime and subcontractor past performance in aggregate or must the Prime past performance references stand alone for evaluation purposes?

The Prime past performance references must stand alone.

RFP Section 9.4 Evaluation Factors, Factor 2

Management Approach page 100.

Will the government’s evaluation of Offeror’s corporate experience, resources and staffing take into account the corporate experience, resources and staffing of proposed subcontractors?

As specified in the RFP, Section 9.4 Evaluation Factors, Factor 2: Management Approach, in paragraph two (2), "The Offeror’s corporate experience, resources, and staffing will be evaluated to determine the manner and extent to which the Offeror is able to accomplish all work under the SOW, accomplish a timely start-up, and acquire and retain sufficient resources to fulfill the Government’s requirements."

RFP Attachment 1 Statement of Work, 11.1

Customer Service Center Support

Will the government provide historical contract information to include number of inquiries received via calls and emails per month so that Offeror’s may determine the level of effort required to support when pricing CLINs 0006-5006?

See added Attachment II.M. - Call Data- A00001.

General Question Given the turn-around time for Q&A and to receive a corrected Past Performance Questionnaire allowing time for references to complete the forms and submit to TSA we kindly request a two (2) week extension to the proposal due date.

Proposal due date is changed from 04/11/2016 to 04/18/2016.

RFP, Page 8, Section 1.4 Item a The procurement is listed an IDIQ, yet no initiation Task

Order or Call Order is identified. Are Offerors to assume that identified Base Period would be the first call order and will be awarded at the time of the IDIQ?

The following language was added to paragraph 1.4(c ): It is expected that a Task Order will be issued upon award of the IDIQ contract.

RFP Attachment 1 Statement of Work, Page 12, Section 3.1.2

The Offeror must provide an Applicant Tracking System (e.g., Airport Assessor). This requirement infers TSA does not own and will not be continuing with the present Airport Assessor

– is that correct?

Yes, see Section 3.1.1 and 3.1.2 of the SOW.

RFP Attachment 1 Statement of Work, Page 21, Section 3.1.12

The Candidate Dashboard is owned and operated by TSA.

Given that, is it simply the Offerors responsibility to maintain the existing systems and ensure integration with any new systems implemented as part of their solution?

Yes, see Section 3.1.12 of the SOW.

RFP Attachment 1 Statement of Work, Page 85, Section 11.1.2

The vendor must track all applicant/candidate inbound contacts using the TSA customer service tracking systems.

This implies the Offeror does not need to provide a new call center solution or tracking system as part of their quote. Is that correct?

Yes, see Section 11.1.2 of the SOW.

RFP Attachment 1 Statement of Work, Page 98, Section 15.1.5

The Offeror shall transform and load legacy Hiring/Recruiting data provided by TSA into Contractor systems databases dating back to 2012. What does the word “transform” mean in this context? Additionally, how will the Offeror respond to applicant/candidate questions pre-dating 2012 should they arise if only data from 2012 forward is being migrated?

Data that pre-dates available data will be archived via NARA standards. If candidate questions arise where associated data has already been archived, the Offeror and TSA will work with NARA to retrieve the archived data as necessary. Transformation includes ensuring that data are in the proper format or structure/schema.

RFP Attachment I Statement of Work, Section 11.1, Are all of the services outlined in Section 11.1 currently being delivered by the incumbent contractor location in

Albuquerque, NM? If not, what other locations are these services being delivered from? How many incumbent and subcontractor staff are currently processing recruitment and hiring inquiries?

The incumbent contractor's locations, services, and subcontractor staffing is not relevant to this solicitation. All of the Government's requirements are contained in the Solicitation and proposals will be evalutated according to the stated requirements.

RFP Attachment I, Statement of Work, Section

3.1.10, page 18

How many new TSO RJPs are required to be developed each year? How many existing TSO RJPs require updates annually?

How many TSO RJPs are there in existence today?

Today there is one TSO RJP video utilized at job fairs and is accessible from every TSO job opportunity announcement. The estimated quantity for distribution is presented in Section 3.1.10.4 of the SOW.

RFP Attachment I, Statement of Work, Section

4.1.2, page 41

How many new FAM RJPs are required to be developed each year? How many existing FAM RJPs require updates annually? How many FAM RJPs are there in existence today?

Today there is one FAM RJP video utilized at job fairs and is accessible from every FAM job opportunity announcement. The estimated quantity for distribution is presented in Section 4.1.2.3 of the SOW.

General Question Will the Government clarify what is included in the CLIN 4

Advertising and Marketing ODCs? For example, will this include graphic design support, media plan development and other similar services? Additionally, is the storage and shipping of hiring event booths and collateral included in this

CLIN?

CLIN 4 - Recruitment Management Team Support Services, encompasses all approved marketing and advertising activities and materials required for recruitment and hiring.

Yes, this does include graphic design support, media plan development, and other activities.

Storage and shipping is an ODC, which falls under CLIN 5 -Advertisement, Marketing, Travel and other

Direct Costs. For all questions above, see Section 2 of the SOW.

General Question Can the Government detail the components of the

Integrated Hiring System? Is this system owned and operated by TSA?

The HIS consists of: Certification tools, Job offer tools, Hiring Dashboards, Candidate Dashboards.

Yes, IHS is owned by TSA and is addressed in various Sections of the SOW.

RFP Attachment I, Statement of Work, page 47, Section 4.1.7.1

States the Offeror must develop a FAM Applicant Tracking

System (to be known as the FAM Assessor dashboard). Who presently provides this system and what platform is it built on? Please provide documentation of the system's technical requirements.

Since the offeror must develop a FAM Application Tracking System, documentation and technical requirements on any current system is not relevant for vendors to propose for this requirement.

RFP Attachment I, Statement of Work, Section

3.1.8.1

Regarding advising TSA of when JOA template changes are needed, can the government provide historical data such as the frequency, quantity, etc. of JOA template changes? Can the government clarify if TSA will require new JOA templates to be developed from scratch and, if so, how many per year?

JOA template changes are driven by OPM requirements. The contractor is responsible for monitoring when OPM changes their requirements and to assist TSA in complying with the latest requirements.

There is no set schedule in which OPM makes changes. Historically, we have changed the templates once every two years. These changes entail modifying the existing templates to comply with the latest

OPM guidance. See Section 3.1.8.1 of the SOW.

RFP Attachment I, Statement of Work, Section

3.1.9

Regarding the Airport Fact Sheets – how often are they updated? Are Offeror’s to assume that our marketing and communications personnel will have to perform that task?

And how are they distributed to candidates in other words, are these ODCs if printed and mailed?

Airport facts sheet are updated in accordace with Section 3.1.9.4 of the SOW.

The Offeror can propose appropriate staff to perform this task.

The fact sheets are accessible via hyperlink embedded in each TSO JOA; they are not printed or mailed. See Section 3.1.9.2 of the SOW.

RFP Attachment I, Statement of Work, Section

3.1.9.2

States that TSA “may” require us to host the Airport Fact

Sheet library. When will they know for sure? Hat does this entail? This impacts our Firm Fixed Pricing.

In Section 3.1.9.2 of the SOW the word 'may' has been…