ERMOS_Questions_and_Answers_4.docx

Questions and Answers: 4 Solicitation HT0015-15-R-0017 Electronic Research Management and Oversight System (ERMOS) 26 June 2014 Hosting:

1. On FBO.gov the Government states that the solution will be hosted at DHHQ, however section 1.0.2.37 of the RFP states that the solution will be hosted in a Government controlled secure hosting site (e.g., DHA Enterprise Infrastructure, DISA,etc.) or Federal Risk and Authorization Management Program (FedRAMP) Compliant Cloud System. System may be migrated during a future option period to a different Government controlled secure hosting site or FedRAMP Compliant Cloud system. Would the Government please clarify the following:

a. Has the preferred hosting location been selected?

A: No

b. Does the Government intend for the Offerors to include hosting recommendations (and costs) as part of the proposal response?

A: Yes

2. If the offeror is to provide hosting location and provider recommendations and costs, would the Government please provide sizing and performance statistics used for the current application?

A: The size of the current systems database is approximately 200 GB. From PWS section 1, Scope,” The current system serves nearly 14,000 users across more than 300 DoD research sites and compliance boards, and hosts over 280,000 electronic documents in support of more than 14,000 research projects. The solution the Government selects shall be scalable to extend beyond the current user, research site and compliance board, electronic documentation, and project baselines.”

3. Also, if hosting services are to be provided, would the Government please provide a CLIN for hosting services and support and the Government’s estimated level of effort?

A: Need to discuss this with Jason. If the Government makes an award for a technical solution that includes a hosting recommendation with cost, the contract awarded will include a CLIN for hosting services and support.

Pricing

1. Page 4 (and subsequent pricing pages) references CLIN 002 – Application License Usage/Maintenance for the Base Year. The user count referenced for the base year is 140 Users. Section 2.1.6 (a) of the RFP outlines Incoming Transition requirements which includes transition of historic data and documents as well as training and certification. Would the Government please provide the following:

a. Required completion date for transitioning all 14,000 users from the legacy system to ERMOS?

b. The type of user base included in CLIN 0002, i.e. does the 140 users represent project team users?

A: CLINS will be corrected to show COTS Application License Usage/Maintenance for 14,000 Users in the base year, increasing to 20,000 in the final option year.

2. CLINs 0002, 1002, 2002, 3002, and 4002 provides planned license/usage maintenance user counts.

a. Are the user counts specified incremental or cumulative (for example, there are 140 users priced in CLIN 0002, 1400 in CLIN 1002 and ultimately 1900 in CLIN 4002. Is the ultimate user license count for this procurement 1900 users?

b. We understand that ERMOS will have a minimum of 14,000 users, however the license counts outlined in CLINS 0002, 1002, 2002, 3002, and 4002 do not represent 14,000 users (in total). Does the Government anticipate license pricing by concurrent user? Are alternative pricing methods (for example, number of boards, and number of documents) acceptable?

A: CLINS will be corrected to show COTS Application License Usage/Maintenance for 14,000 Users in the base year, increasing to 20,000 in the final option year. The Government will consider alternative pricing methods.

3. Should the Offeror assume that Hosting Costs are not included in our Price Proposal?

A: For a solution that includes hosting in a government controlled secure hosting site (e.g., DHA Enterprise Infrastructure or DISA), hosting costs should not be included. For a solution that includes Cloud hosting, hosting costs should be included.

4. CLINs 0003, 1003, 2003, 3003 and 4003 – Training. Please provide metrics that can be used to base pricing on. Metrics requested include:

a. Number of training hours to be provided per year

b. Number of training classes to be created and estimated hours per class

c. Training requirement by media type A: Training objectives are stated in PWS section 1.0.2, Training Objectives. The Government expects recommendations for training that meets these objectives and complies with requirements in PWS sections 2.2.8.3 and 2.2.8.3.1 that are appropriate to the technical solution proposed.

PWS

1. Page 30, Functional Objectives, Objective 1.0.2.21 requires the ability to support IACUC, IBC, Grants/CRADA, radiology, scientific review, and publication clearance functions. Please describe the support level required for Grants/CRADA along with any specific integration/reporting requirements that must be delivered.

A: All Government approved ERMOS requirements are included in the PWS.

2. Page 31, Technical Security Objectives, Objective 1.0.2.28

a. Does the Government have a database and/or OS preference?

A: Government preferences are stated in PWS section 1.0.2, Objectives, Technical Objectives.

3. Page 32, Objective 1.0.2.49 calls for the attainment of a DHA RMF System Authorization within 60 DACA. We understand that RMF replaces the current DIACAP process, however the process steps, roles and responsibilities are largely the same. We also understand that the COTS can attain RMF independent of hardware/hosting platform, however based on our understanding of the RMF process, we anticipate that it will take more than 60 days to attain RMF. What steps can the Offeror assume DHSS and DHA Cybersecurity will take to expedite the RMF?

A: The PWS will be revised to state “Attain a DHA RMF System Authorization within 180 days of RMF Security Authorization kick-off; the Government may elect to extend this timeframe if necessary due to events beyond the Contractor’s control.”

4. Page 31, Objective 1.0.2.35

a. Please provide more description regarding integration with Sharepoint. What is the role of Sharepoint in the IRB/IACUC lifecycle?

b. What types of documentation will be stored in Sharepoint?

A: The Government uses SharePoint as a repository for a wide variety of DHA documentation.

5. Page 32, Transition Support Objectives. Is there archived data (in addition to the approximate 280,000 documents that needs to be migrated to ERMOS?

A: The Government will ensure that data from the current system is available for migration into ERMOS.

6. Deliverables:

a. Deliverable 24 – Application Security Vulnerability Baseline – Section 2.2.8.1.3.1 is due NLT 90 DACA. Development of the Application Security Vulnerability Baseline requires a STIG’d environment for the self-assessment scans. Will the Government provide this environment upon award, or does the Government require the contractor to implement the solution on a temporary STIG’d environment for self-assessment?

A: The Government will provide a STIG’d environment.

b. Deliverable 58 – Training Presentation – Section 2.2.8.3.1 calls for delivery of draft training materials Draft 10 DACA. Training materials are to be made available to the initial ERMOS user base of 12,000 users within 60 DACA.

i. Would the Government clarify whether 140 users are being licensed or 12,000 users being licensed per CLIN 0002 (base period) A:14,000 users. PWS section 2.2.8.3.1 and CLIN 0002 will be revised to state 14,000 users.

c. Deliverable 72 – Application Security Vulnerability Mitigation Report is initially required 30 DACA. Deliverable 72 is dependent on Deliverable 66 – Applicable STIG and Scan Findings which is dependent on a STIGd environment for self-assessment.

i. Will the Government provide the STIGd environment for this self-assessment?

ii. If the Government requires the contractor provide the STIGd environment, then would the Government please provide the preferred OS and Database software versions?

A: The Government will provide a STIG’d environment.

7. ODCs

a. Travel: Page 182 calls for 3 people, 8 trips each, 3 days per trip for the base period. Section 5.2.2 calls for 2 people, 4 trips at 3 days each for the base period. Would the Government please clarify guidance? Should the Offerors provide ODC travel estimates based on page 182 or Section 5.2.2 guidance?

A: Offerors should provide ODC travel estimates based on PWS Section 5.2.2 guidance. Page 182 will be corrected to reflect this.

b. Section 4.3.6 references the need to provide two 800 Phone Numbers where one Phone Number is for CONUS calls and the other for OCONUS support calls.

i. Section 1.0.2.46 of the PWS states that the Offeror is to provide Tier II and III help desk support integration with the DHA Global Service Center. If this is the case, is it reasonable to assume that the DHA Global Service Center will be the first point of response for the end-user and super user communities and that Tier II and Tier III support will follow the standard processes?

A: Requirement for 800 numbers, including ODCs, will be removed from the solicitation.

ii. Does the Government envision 3rd party users (like external Academia) will call the Offeror directly for support or will their calls also route through the help desk?

A: The Government expects all ERMOS users including non-DoD users to call the DHA Global Service Center for support.

iii. Page 182 represents the only reference to OCONUS support requirements in the RFP. Would the Government please clarify OCONUS support requirements?

A: References to CONUS and OCUNUS have been removed from the PWS and the solicitation.

8. Section 5.3 – Instructions to the Offeror – Key Personnel – Page 182 and 183

a. Section 5.3 references the Project/Task Manager as key personnel, however the estimated level of effort provided in section 4.3.5 does not incorporate a Project/Task Manager.

i. Would the Government please clarify the LOE to include a full time Task Manager and modify the Program Manager role if needed

b. Section 5.3 also references an Information Assurance Compliance Manager role. This role is not referenced in section 4.3.5.

i. Would the Government please clarify this role and incorporate it in the LOE?

A: Both section L.4.3 and L.4.3.5 should list Key Personnel as Program Manager and Information Assurance/Security Specialist (Journeyman)

9. Section L: Addendum to 52.212-1 Instructions to the Offerors

a. Page 175 - Section 4.1.1 Page Limits:

i. Do Title Pages, Cover Pages, Table of Contents (TOC) count toward the individual page limitations that are assigned to the Draft document deliverables (i.e. TMP (10 pages), QCP (5 pages), RM&A (10 pages))?

A: Title pages, cover pages, TOCs do not count toward the individual page limitations assigned to the Draft delivereables.

ii. If cover pages are counted toward the deliverable page counts, is it acceptable to not include these pages; Title, Cover, TOC?

A: See answer immediately above.

b. Page 175 - Section 4.1.1 Page Limits: Non-cost proposals are limited to fifty (50) single-sided pages using Times New Roman font, 12 point and 1 inch margins – Please confirm that graphics, tables and artwork are not subject to the Times New Roman 12 point requirement.

A: Graphics, tables and artwork are not subject to the Times New Roman 12 point requirement.

3 | Page 6/24/2015