ID15170001_Amendment_A00003_2018-10-05.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

1. CONTRACT ID CODE

2. AMENDMENT/MODIFICATION NO. A00003

3. EFFECTIVE DATE

10/5/2018

4. REQUISITION/PURCHASE REQ. NO.

5. PROJECT NO. (If applicable) n/a

6. ISSUED BY CODE

7. ADMINISTERED BY (If other than Item 6) CODE

General Services Administration, Federal Acquisition Services 230 S. Dearborn Street, 33rd Floor Chicago, IL 60604

See Block 6

8. NAME AND ADDRESS OF CONTRACTOR (No., street, country, State, and ZIP Code)

X

9A. AMENDMENT OF SOLICITATION NO.

ITSS ID#15170001

9B. Dated 8/31/2018

10A. MODIFICATION OF CONTRACT/ORDER NO.

10B. DATED (SEE ITEM 13)

CODE

FACILITY CODE

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

___ The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers _ _ is extended __X_ is not extended.

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGEMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER.

If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required) n/a

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS, IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO THE AUTHORITY OF

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor _____ is not, ____ is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

Please see continuation pages.

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print) Julie Green Contracting Officer

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

15C. DATE SIGNED

16B. UNITED STATES OF AMERICA

BY ______________________________________________

(Signature of Contracting Officer)

16C. DATE SIGNED

STANDARD FORM 30

Entity Validation Services ITSS Solicitation#: ID15170001

Contract: TBD

Amendment A00003 - 2 of 4

Solicitation ID# 15170001 is amended as follows:

1) Under Section B.5 Schedule of Items/Services and Prices, the CLIN description for CLIN 2001, 3001, 4001 and 5001 is corrected to remove "Organizational Relationships (hierarchy).” The description for CLIN 2001, 3001 4001 and 5001 is corrected to read "Determining Uniqueness, Initial Validation of Entities and Ongoing Monitoring."

2) Under B.5 (pg B.4) the following sentence is removed:

"For key personnel under CLINs 1004 and 1005, at the outset of the contract or at any time during the contract, the government reserves the right to direct contractor to bill based on its firm fixed price hourly unit price in lieu of its monthly price under Section B.5 if less than a full month of work is performed.”

3) Section B.5 Schedule of Items/Services and Prices is revised to clarify that CLIN 5006 Transition Out, is anticipated to be the final six months of the final contract term, Option Year 4.

4) Section C.1 under Procurement Objective, the following definition is added:

Unique Entity Identifier (UEI) – refers to SAM Managed Identifier (SAMMI) unless otherwise indicated.

5) Section C.2 under General Definitions, the definition of “First Produced” is revised as follows:

First Produced - for purposes of clause 52.227-14, all data first produced in the performance of this contract, including without limitation data validated by the contractor and delivered back to SAM.gov as standardized data.

6) The Contractor Employee Non-Disclosure Agreement referenced in Section F.6 is added as Attachment 7.

7) Section H.7 Data Rights is revised to add the following subsection:

H.7.1 Distinctions Between the Different Types of Data Involved in Entity Validation

For purposes of this procurement:

Amendment A00003 - 3 of 4

(a) Entity data provided directly by registrants and stored in SAM.gov is considered to be held by the Government with unlimited rights, as defined in FAR 52.227-14(a).

(b) Reference data held in the EVS contractor’s database and used by the contractor to verify entity existence, uniqueness and legitimacy remains subject to the restrictions with which it is offered to and accepted by the Government; the offeror shall clearly identify such restrictions in the proposal.

(c) The result of the verification referred to in paragraph (b) above, i.e., standardized data that is delivered back to SAM.gov, is considered data first produced under this contract within the meaning of FAR 52.227-14(c)(1) and is subject to the Government’s unlimited rights. The same is true of data generated through the help desk.

(d) Other data provided by the EVS contractor that is not covered by subparagraphs a-c above (to include hierarchy data) and is not first produced under this contract within the meaning of FAR 52.227-14(c)(2) remains subject to the restrictions with which it is offered to and accepted by the Government; the offeror shall clearly identify such restrictions in their proposal.

The data identified in paragraphs (a) and (c) above shall not be used, published, or distributed by the Contractor without specific permission from the Government.

8) Section H.9 Proprietary Data is deleted and revised in its entirety:

The Contractor shall not employ the use of any proprietary data or software in the performance of this contract without the advanced written consent of the Contracting Officer.

The Government shall have the right to use all commercially developed and privately funded data delivered under this contract or order in accordance with, and subject to, the published agreements and restrictions that accompany that data, to the extent not inconsistent with the GSAR clauses at 552.232-39 and 552.232-78.

9) Section J List of Attachments is revised to read as follows:

Attachment 1 - Section B – Schedule of Items/Services and Prices – “Price Evaluation Worksheet” Rev 2018-10-03 Attachment 2 - Service Level Agreement Rev 2018-10-03 Attachment 3 - IAE Entity Statistics Attachment 4 - Quality Assurance Surveillance Plan (QASP) Attachment 5 - Past Performance Questionnaire

Amendment A00003 - 4 of 4

Attachment 6 - Model Subcontracting Plan Template Attachment 7 - Contractor Non-disclosure Agreement Attachment 8 - Operational Capability Demonstration Sample Data Template

10) Section J – Attachment 1 “EVS Schedule of Items/Services and Prices” is revised to change the Unit of Measure for the Project Manager and Technical Lead CLINs from “hours” to “month.” Attachment 1 “EVS Schedule of Items/Services and Prices” is revised as attached.

11) Under Section J Attachment 2, Service Level Agreement, Metric #10 "Proper Function of all Help Desk Systems" is removed. Section J Attachment 2 Service Level Agreement is revised as attached.

12) Section J – Attachment 8 “Sample Data Template” is added as attached.

13) Under Section L.8 Pass/Fail Elements c. the header entitled “Project Management Professional or Equivalent Certification” is revised to read “Project Management Professional.” Offerors shall provide either a Project Management Institute (PMI) Project Management Professional (PMP) or Program Management Professional (PgMP) certification.

14) Under L.8, “Part 3” Open Market Pricing, the following sentence is removed as follows:

"The pricing proposal shall list proposed labor categories, labor hour, labor rates with their respective total amounts, and if applicable any incidental material and travel prices."

End of Amendment

ITSS Solicitation #: ID15170001

Contract Number: TBD

Amendment A00003 Attachment 1

Attachment 1 to Amendment A00003 of Solicitation #: ID15170001 - Questions and Answers

# RFP Section/Section Page reference

Question Response

1 J attachment 2 - 1 of 1 Section J - Service Level Agreement

Gov't Reference Text: EVS Portal is available and satisfies all user demands. IVR is available and satisfies all user demands. Question: This section refers to an "EVS Portal". This term is not used elsewhere in the RFP documents. Please explain the "EVS Portal".

Under Section J - Attachment 2, Service Level Agreement Metric #10 "Proper Function of all Help Desk Systems" is removed.

2 Section C, Entity Validation S Business Legitimacy - Do we need to specify the number of independent data sources. Are we required to identify the sources by name?

The section of the PWS referenced in the current state on page C-8, outlines the process that is in place today. Contractors should clearly identify their processes for meeting the objectives outlined in the PWS to meet the government's requirements.

3 Section C, Entity Validation Services – Current State, page C-8

Is confirmation of the existence of and/or assignment of a unique identifier formatted as a 9-digit numeric value a hard requirement?

The section of the PWS referenced in the current state on page C-8, outlines the process that is in place today. Contractors should clearly identify their processes for meeting the objectives outlined in the PWS to meet the government's requirements.

4 Section C, General Definitions page C-11

Is SAM able to accommodate a change in UEI? For example, if a business goes through the process of a merge, an acquisition or a split, the Entity ID can be affected and a new ID will be assigned.

Yes, however the EVS contractor will need to define any UEI mapping changes that occur due to the change.

5 Section C, General Definitions, page C-12

Please define / provide an example of an “unusual circumstance.”

In accordance with Section C.2, the definition for Unusual Circumstance is a rare circumstance that requires validation outside the normal process. This should occur in less than 1% of cases.

6 Section C, Unique Entity Identifier (UEI) Assignment Services, page C-15

Please confirm the need to map the SAMMI to GSA’s UEI … as part of the solution. Will the SAMMI be provided to the Offeror?

In accordance with Section C, under this contract the contractor shall map their UEI to the SAMMI for purposes of managing and updating information about entity's registered in SAM. The contractor UEI will only be used within the SAM database on the backend and will not be made available to the public or displayed on the frontend.

7 Section C, Unique Entity Identifier (UEI) Assignment Services, page C-15

Can the Offeror use a 3rd Party source for purpose validating business / entity legitimacy?

Offerors should propose how they would provide validation services, including via the use of subcontractors.

8 Section C, Additional Entities, page C-16

Please provide an example to walk us through a use case so we can better understand your requirement.

Section C states: In addition to those registering in SAM, contractor unique entity identifiers will need to be created and/or assigned at the discretion of the government for purposes such as (1) testing, (2) training, (3) identification of excluded entities, or (4) to be used in the ordinary course of government business in a production environment, including creating records for non-existent entities that will not have real world data, e.g. for testing purposes. The contractor must have a mechanism to know that these entities do not exist in the real world.

Testing Use Case: This supports the SAM.gov team to test interfaces without using real data.

Training Use Case: This supports training of the SAM.gov system without using real data Excluded Entities Use Case: This occurs where the government creates an exclusion for an entity that is not registered within SAM.gov Other Use Case: The government has a few other use cases where it needs unique identifiers created for specific purposes9 Section C, International

Countries, page C-16 Please provide comprehensive list of countries we need to support. Is support required in all channels (email, chat, phone etc.)?

The table on C-15 provides a snapshot as of December 2017 of the 10 countries with the highest volume of international entities registered in SAM. This table is not all inclusive of every international registrant in SAM. As of December 2017, there are 31k active entities from 203 unique international countries registered in SAM. Offerors should describe their ability to support entities located in the U.S.

and its outlying areas, as well as international entities. In accordance with objective 4- Customer support capabilities (including entity updates), for U.S. and non-U.S. located entities: customer support capability shall accommodate entities through multiple communication channels (e.g. phone, internet chat, local offices, email, etc.) with primary support in English and non-English language support if reasonably available

10 Section C, Initial Entity Registration, page C-17

Is a validation flag required for each of the data elements?

Yes, Data elements that can not be validated at initial registration shall be flagged as such and returned to SAM with appropriate message codes detailing the issue so the request can be managed automatically within SAM.

11 Section C, State of Incorporation, page C-18

Please confirm that the GSA is looking for the domestic state of incorporation? “Immediate Owner/Highest Level Owner”

Yes, the domestic state of incorporation. Immediate owner and highest level owner are separate data elements.

12 Section C, State of Incorporation, page C-18

Are you referring to immediate parent company or a contact person for the business?

The immediate parent company, not a contact person for the entity.

13 Section C, On-Going Monitoring, page C-19

When EVS contractor pushes an update to SAM, who tells the entity to validate the information? Is this the responsibility of SAM?”

This is the responsibility of the registrant to do in SAM during their periodic registration update.

14 Section C, Objective 4 - Customer support capabilities (including entity updates), for U.S. and non- U.S. located entities, page C-21

Please provide a list of the non-English language(s) we are expected to support.

Offerors shall provide information on how it will meet this requirement. The Government will view more favorably those Offeror's that have greater international coverage.

15 Section C, Objective 4 - Customer support capabilities (including entity updates), for U.S. and non- U.S. located entities, page C-21

At what point (if any) does the Entity directly interface with the EVS contractor in the case of any issues deemed as NOT related to SAM but related to EVS?

In accordance with Section C Objective 4 - Customer support capabilities (including entity updates), for U.S. and non-U.S. located entities: If there are issues with the registration in SAM, entities will initially contact the supporting Federal Service Desk (FSD) helpdesk, and relevant issues will be forwarded to the contractor electronically via API or third party service. Estimated annual help desk volume for EVS related inquiries is 67,000. The most common types of help desk requests anticipated are:

● Entity information updates or mismatches

● Entity uniqueness issues

● New entity or entity information not available

16 Section C, Objective 4 - Customer support capabilities (including entity updates), for U.S. and non- U.S. located entities page C-

There are multiple indications of required integration with outside systems (FSD). Please confirm the window allowed for integration?

This activity should be incorporated in the offeror's transition plan.

17 Section C, Objective 4 - Customer support capabilities (including entity updates), for U.S. and non- U.S. located entities page C-

Please define ‘time to initiate’ for help desk statistics. Please also provide ‘issue types’ currently supported today.

Time to initiate means the time it takes a helpdesk ticket to be opened for the issue. In accordance with Section C Objective 4, the most common types of help desk requests anticipated are:

● Entity information updates or mismatches

● Entity uniqueness issues

● New entity or entity information not available

Contract Number: TBD

Amendment A00003 Attachment 1

18 RFP / L.8 / Page L - 18 of

Part 3 – Price Proposal states: The price proposal shall list proposed labor categories, labor hour, labor rates with their respective total amounts, and if applicable any incidental materials and travel prices.

Please confirm that this requirement is specific to the T&M CLINs only. Additionally, please clarify if contractors may include this information in a separate table in the Price Proposal, or if it should be included under the T&M CLINs in Attachment 1?

Under L.8 "Part 3" Open Market Pricing the following sentence in this paragraph is removed "The pricing proposal shall list proposed labor categories, labor hour, labor rates with their respective total amounts, and if applicable any incidental material and travel prices."

19 RFP / M.5 / Page M – 10 of

Step 4 – Price/Rate: If the Government determines that an offeror’s prices (rates) are out of balance with industry standards, will the Government seek the offeror’s acceptance of the normalized prices (rates) or request a revised proposal from the offeror prior to award?

The government will not request revised proposals or the offeror's concurrence (acceptance of changes) if price proposals only need normalization, which is a process used by the government to ensure that competing price proposals are being evaluated on an equitable basis. Normalization does not challenge an offeror's rates, which would only be done through the negotiation process, should the government determine, at its sole discretion, to enter into discussions with offerors in the competitive range.

20 RFP / L.2 / Page L-4 of 28 FAR clause 52.219-4 Notice of Price Evaluation Preference for HUBZone Small Business Concerns (OCT 2014) is incorporated by reference. Will the Government confirm that this clause is not applicable to this procurement?

This clause is applicable.

21 RFP / Factor 3 – Management Approach / Page M-6 of 11

Can the Government please clarify the Management Approach content that is expected to be covered in the 30-page Technical Approach? For example, within the Factor 3 Management Approach, do the bullets under the Key Personnel and Project Staffing equate to the Staffing Plan which is outside of the 30 pages? Additionally, please confirm the Quality Control Plan and Internal Control Measures bullets are to be covered under the Quality Control Plan which is also outside of the 30 pages.

Please see Amendment A00001. Under Amendment A00001, the bullets under Key Personnel and Staffing were revised to clarify requirements under each. The [Draft] Project Staffing Plan is the same as the Drat Staffing Plan which has a document specific page limit (10 pages) but is exempt from the page limit associated with Part 1 - Technical proposal (L.9). Internal control measures may be included within the Offeror's Quality Control Plan or as part of the technical proposal. Please see references in Section L.8 which references Quality Control Plan in Section G.4 and Section M.2

22 RFP / B.3.2, B.4 Quantities, and B.5 Schedule of Items, Services and Prices / Page B – 2 of 7, and L.8 / Page L -

B.3.2, B.4, and B.5 all reference all a “rate per contact” for work under Time and Materials CLINs 2003, 3003, 4003 and 5003 for Customer Support (helpdesk) services. Section L.8, Part 3 – Price Proposal, Reimbursement of Costs for Customer Support (helpdesk) Services states: For Time and Material Task CLINs only, the Contractor shall be reimbursed based on the agreed upon rate per contact set forth in Section B. However, this is inconsistent with FAR Clause 52.232-7 Payments under Time-and-Materials and Labor-Hour Contracts, which states that the Government will pay the Contractor by multiplying the hourly rate by the direct hours performed. Will the Government please confirm that for the T&M CLINs (2003, 3003, 4003, and 5003), contractors should propose hourly rates by labor categories and will be reimbursed at those hourly rates for the actual hours performed?

52.232-7 Payments under Time and Materials and Labor-Hour Contracts is applicable, the cost per contact will be treated as a "material" in terms of payments under this clause.

23 RFP / B.5 / Page B 4 of 7 “For key personnel under CLINs 1004 and 1005, at the outset of the contract or at any time during the contract, the government reserves the right to direct contractor to bill based on its firm fixed price hourly unit price in lieu of its monthly price under Section B.5 if less than a full month of work is performed.”

This is inconsistent with a Firm Fixed Price CLIN.

Will the Government clarify if the key personnel CLINs will be awarded and billed as Time and Materials, and contractors should propose fixed hourly rates in accordance with Section J – Attachment 1?

Section J - Attachment 1 "EVS Schedule of Items/Services and Prices" is revised to change the Unit of Measure for the Project Manager and Technical Lead CLINs from "hours" to "month." Section J - Attachment 1 "EVS Schedule of Items/Services and Prices" is revised as Attached. The following sentence under B.5 is removed: "For key personnel under CLINs 1004 and 1005, at the outset of the contract or at any time during the contract, the government reserves the right to direct contractor to bill based on its firm fixed price hourly unit price in lieu of its monthly price under Section B.5 if less than a full month of work is performed.”

24 General Given the extensive proposal response, the demonstration requirement and the timing of Q&A receipt, will the Government please extend the submission due date by two weeks?

Please monitor FBO.gov for any changes to the RFP closing date.

25 RFP / F.6 / Page F 6 of 8 In Section F.6, a link is provided to the Contractor Employee Non-Disclosure Agreement, but the link does not function. Will the Government please provide a copy of the Agreement, or a working link.

The Contractor Employee Non-Disclosure Agreement referenced in Section F is added as Attachment

7. The Contractor Employee Non-Disclosure Agreement is not required to be completed at this time.

26 Section J Attachment 2 – EVS Service Level Agreements

Metric 2 – Entity Hierarchy Information – “Hierarchy information is structured and defined.” Government Target Minimum: 99% – Is the target a percentage of all active entities? What is the metric comparing against? How does the Government define meeting 99%?

The metric reviews that the hierarchy information data is structured and defined, so it can be used within SAM.gov. The target is based on all hierarchy information provided to the Government under this contract. The 99% metric is based on the volume of hierarchy data provided.

27 Section J Attachment 2 – EVS Service Level Agreements

Metric 4 – Entity Data Accuracy – “The accuracy of the data in the EVS provider's system versus what is the actual state for an entity registering in SAM.”

Government Target Minimum: 90% - The actual state of an entity registering in SAM, including the user provided data elements, could be inaccurate.

For entity data accuracy, could the Government please consider modifying this SLA to “The accuracy of the data in the EVS provider's system versus what is the actual state for an entity registering in SAM, except in cases where the user provided incorrect data?” How is the Government defining “actual state for an entity”?

The actual state of an entity would be considered the accurate and true information regarding an entity. Cases of incorrect data entry from a registrant would not be counted against the EVS provider regarding data accuracy.

Contract Number: TBD

Amendment A00003 Attachment 1

28 Section J Attachment 2 – EVS Service Level Agreements

Metric 6 – Entity Data Update Responsiveness – “The amount of time it takes to update an entity's data where there is a mismatch of data in the EVS provider’s system.” Government Target Minimum:

“Average resolution under 24 hours.” – Could the Government please consider modifying this SLA to “The amount of time it takes to update an entity's data where there is a mismatch of data in the EVS provider’s system and the mismatch is not related to a SAM user providing incorrect data?” Additionally, will the Government please confirm that the 24 hours metric applies to business days only.

Cases of incorrect data entry from a registrant would not be counted against the EVS provider regarding turnaround time.

29 Section J Attachment 2 – EVS Service Level Agreements

Metric 9 – Entity Hierarchy Information – Will the Government please confirm whether this is a duplicate of metric 2?

Yes, this is a duplicate metric

30 RFP / Objective 4 / Page C

Will the Government please provide the expected customer support desk hours and confirm that support is only required Monday – Friday except for Federal holidays?

The contractor is expected to determine their help desk support hours to meet the requirements in the

RFP.

31 RFP / Objective 4 / Page C

To reduce the overall cost to the Government and to promote a more integrated solution, will the Government consider providing access to the existing IAE ticketing system for use by the EVS contractor team during the performance of the contract?

The government will provide access to the IAE ticketing system for the EVS contractor to utilize during the performance of the contract.

32 RFP / Objective 4 / Page C

If the Government would like the Contractor to provide a ticketing system, can the Government please confirm that the FSD tool and Contractor tool need to be integrated to pass ticket information back and forth? Will the Government require a FED Ramp compliant tool?

The government will provide access to the IAE ticketing system for the EVS contractor to utilize during the performance of the contract.

The contractor's tool will need to be FED Ramp compliant.

33 RFP PWS - Objective 5 – Transition / Page C 23 of 40

Bullet #4 under Transition Plans “Analysis and management of SAM data as necessary to support validation of existing entities in SAM” – Will the Government please confirm that addressing identified data anomalies that are discovered during the transition in period will be the responsibility of GSA and the existing SAM contractor and are outside of the scope of this contract?

This is not outside the scope of this contract. Anomalies due to issues with the EVS provider's data during transition need to be addressed by the EVS contractor.

34 RFP / F.6 / Page F 4

RFP / Objective 5 / Page C

Page F – 7, under GSA IT Security Requirements the RFP states that “The contractor shall submit written proof of IT security authorization six months after award”. On page C 23 of 40 in Objective 5, the RFP states that the contractor will “Support government ATO as necessary”. Will the Government please clarify the role the contractor is expected to fulfill in each of these cases? What type of written proof is required for the IT security authorization? Will the Government please clarify if the security ATO process is to be completed prior to production go live?

In accordance with 552.239-71 Security Requirements for Unclassified IT Resources (b) requires that contractor develop an IT Security Plan and submit within 30 calendar days after award. The plan shall meet IT security requirements in accordance with Federal and GSA policies and procedures.

GSA's Office of the Chief Information Officer issued “CIO IT Security Procedural Guide 09-48, Security Language for Information Technology Acquisitions Efforts,” to provide IT security standards, policies and reporting requirements. This document is incorporated by reference in all solicitations and contracts or task orders where an information system is contractor owned and operated on behalf of the Federal Government. The guide can be accessed at http://www.gsa.gov/portal/category/25690.

Specific security requirements not specified in “CIO IT Security Procedural Guide 09-48, Security Language for Information Technology Acquisitions Efforts” shall be provided by the requiring activity.

Once the contractor's third party vendor has completed their assessment of the system, the contractor will review the package and submit it for review to the GSA ISSO.

The contractor will coordinate with the third party assessor and system management team to schedule required ATO activities, i.e.security scans, penetration testing etc.

The contractor will review the ATO package documents for accuracy and completeness. They will coordinate the system management team to mitigate any vulnerabilities discovered during the security scans.

The ATO package consists of several documents required to achieve a security authorization.

Documents include but are not limited too:

Security Assessment Report (SAR) System Security Plan (SSP) Privacy Impact Assessment (PIA) B i I t A t (BIA)35 RFP / L.8 / Page L 15 Part 1 – Written Proposal Contents: Will the

Government please confirm that Disclosures can be submitted as an appendix to the Technical Volume page limitation to allow the bidders more page count to address PWS requirements?

Under L.8, The Disclosure of whether contractor intends to utilize any proprietary data or software in accordance with Section H and Disclosure of whether contractor is licensed to utilized any data or software it does not itself own should be made within the contents of the Part 1 Technical Proposal which would be subject to the specified page limits. An Appendix containing stand alone supporting documents may be added if necessary.

36 RFP / Section B – Supplies or services and Prices/Costs / Page B 2

B.5 Schedule of items/services and prices CLIN 2001, 3001, 4001, and 5001, “Determining Uniqueness, Initial Validation of Entities and Ongoing Monitoring Entities Initial Validation and Identification of Organizational Relationships (hierarchy)” – The CLIN description does not match with the CLIN description in the table on page B – 5 of 7. The discrepancy is the portion on “Identification of Organizational Relationships (hierarchy),” which seems to be in CLIN X002. Will the government please clarify?

Under Section B.5 Schedule of Items/Services and Prices - the CLIN description for CLIN 2001, 3001, 4001 and 5001 is corrected to remove "Organizational Relationships (hierarchy)." The description for CLIN 2001, 3001 4001 and 5001 is corrected to read "Determining Uniqueness, Initial Validation of Entities and Ongoing Monitoring."

37 Section J Attachment 2 – EVS Service Level Agreements

Metric 10 – “Proper Function of all Help Desk Systems, providing all users access to the Integrated Voice Response (IVR).” Additional information “EVS Portal is available and satisfies all user demands. IVR is available and satisfies all user demands.” Will the Government please clarify on the scope of the EVS Portal and the contractor’s role in the portal?

Under Section J Attachment 2, Service Level Agreement, Metric #10 "Proper Function of all Help Desk Systems" is removed.

Contract Number: TBD

Amendment A00003 Attachment 1

38 RFP / PWS – Section 4 Primary Performance Objectives (Technical) / Page C 13

Page C – 13 of 40, “The technical objectives of this contract involve no development activity on SAM or other IAE systems. Some testing assistance may be requested with interface setup, but the contractor will not work on SAM or other IAE systems.” Is the expectation that the EVS will be hosted on the GSA IAE infrastructure allowing GSA to easily access the GSA owned data? Or does GSA require the EVS to be hosted in a Government Cloud or a FedRAMP certified cloud separate from IAE?

The EVS should be hosted on the contractor's infrastructure. IAE systems will interface with the EVS contractor via API. The contractor will need to be FedRAMP certified based on the security requirements in the RFP.

39 RFP PWS - Section C / Page C 20

Page C – 20, Objective 3 – Identify Entity Organizational Relationships – “Any data collected by the government directly from entities regarding their own hierarchy can be used by government.”

Will the Government please clarify that the data collected by the government directly from entities regarding their own hierarchy will come from SAM during the registration and renewal process?

Data collected by the government directly from entities regarding their own hierarchy will be collected in SAM during the registration and renewal process.

40 RFP PWS – Section C / Page C 14

Page C -14, Objective 1 - “The contractor shall interface electronically with SAM.gov and/or Beta.SAM.gov to accomplish this task. The determination of uniqueness will be based on data elements sent from SAM to the contractor.” Will the Government validate that any front-end development for the new solution will be provided by the current IAE contractor team and is not part of the scope of this contract?

Front-end development work for SAM.gov and beta.SAM.gov is not within the scope of this RFP.

41 RFP / L.9 / Page L-20 of 28 The RFP instructions provide a list of documents that are exceptions to the page limitations. Will the Government please clarify how these documents are to be submitted (i.e., Appendix to the Technical Volume or as separate documents if needed to meet file size limitations in the submission system)?

Documents listed under Page Limit Exceptions should be included the Technical, Past Performance or Price Proposal Part as appropriate. It is preferred that these documents be submitted as an Appendix as opposed to separate document attachments.

42 RFP / Business Objectives, page C – 13 of 40

“A method to determine relevant information about an entity that is being excluded from doing business with the government.”

Will GSA please provide a list of criteria for determining which entities should be excluded from doing business with the government to the vendor?

Will enforcing business rules associated with these criteria be part of the monitoring requirement?

The government will provide who is the excluded entity. The vendor does not need to manage the criteria for determining entity exclusion.

43 RFP / Sample Data Elements Passed to Determine Entity Uniqueness, page C – 14 of

In the Sample Data Elements Passed to Determine Entity Uniqueness table, can the Government please confirm that SAM will provide additional data elements to determine entity uniqueness, such as business principal information and Tax ID?

The offeror should include in their proposal how they are able to determine entity uniqueness per the

PWS

44 RFP / Volume of Registrants, page C – 15 of

“Between 6,000 - 9,000 new entity registrations are activated each month (average 7,000) in SAM.

Between 43,000 - 65,000 registrations are renewed per month (average 53,000) in SAM. Currently, there are approximately 620,000 active entities registered in SAM.

The following table is a snapshot as of December 2017 of the 10 countries with the highest volume of international entities registered in SAM. This table is not all inclusive of every international registrant in SAM. As of December 2017, there are 31k active entities from 203 unique international countries registered in SAM.”

The Volume of Registrants section of the Draft PWS dated 2017-10-19, also referred to “1,445,000 expired entity registrations overall in SAM.” Will the Government please confirm that these are not needed for the initial match. Are the 31K international registrations in addition to the 620,000 active entities? Or part of the 620,000 active

The 31k international registrations are part of the 620k active entities.

45 RFP / On-Going Monitoring, page C – 19 of 40

“The following data elements shall be validated via on-going monitoring: ….”

Can the Government confirm whether all the items on the list are expected to be monitored or only a select few – like name, address?

In accordance with Section C PWS Objective 2 - Validate information about the entity and provide additional information on entity, the following data elements shall be validated via on-going monitoring:

■ Fiscal Year End Close Date

■ Corporate URL

■ Company Division Name

Contract Number: TBD

Amendment A00003 Attachment 1

46 RFP / Entity Hierarchy Information Interface Process, page C – 21 of 40

“For updates, as soon as new information is known, the contractor may push new hierarchy information from its system to SAM or send a notice to SAM to make a pull request from the contractor's system.” Is there any breakdown of the current process to reflect how often this information is pushed from the vendor vs a notice to SAM? What is the preferred method of notification to SAM?

API is the preferred method of transmission and notification, however other methods will be considered if they meet the PWS requirements.

47 RFP / L.8 / Page L 14 Are contractors permitted to bring briefing materials to the technical demonstration to aid the discussion?

Neither written nor oral presentations will be entertained. The purpose of the Operational Capability Demonstration (OCD) is for the Offeror to demonstrate the functional capability to systematically meet requirements under Section C.4 Objectives 1, 2 and 3. The OCD is not intended to be a discussion, it is a demonstration only.

48 General Will the Government please confirm if it is expected that the contractor will use the GSA IAE Jira and Confluence tools?

The contractor will not be using the GSA IAE Jira and Confluence tools

49 RFP / Objective 5 / Page C

Can the Government please clarify if the Transition Out CLIN 5006 beings six months prior to the end of Option Year 4, overlapping with CLINS 5001 and 5002?

The Transition Out CLIN 5006 is anticipated to be the final six months of the final contract term, Option Year 4. The contractor will continue to perform the full scope of services under Option Year 4 in addition to the transition services under CLIN 5006.

50 B2/3 CLINS 2001 and 2002, 3001 and 3002, 4001 and 4002, 5001 and 5002 reference provision of organizational relationships (hierarchy). Is this intentional?

Under Section B.5 Schedule of Items/Services and Prices - the CLIN description for CLIN 2001, 3001, 4001 and 5001 is corrected to remove "Organizational Relationships (hierarchy)." The description for CLIN 2001, 3001 4001 and 5001 is corrected to read "Determining Uniqueness, Initial Validation of Entities and Ongoing Monitoring."

51 C-15 The government describes a registrant community of 620K entities. Does this include subrecipients for Grants, Loans, and Contracts? If not, what would be the size of that entity universe? Will they be required to be validated sometime under this contract? Will they need to be monitored?

This community is solely active registrants within SAM. Subrecipients who are not registered within SAM are not included within this volume and will not need to be validated or monitored at this time.

52 C-16/17 Can the government provide more information on the exclusion process? If the contractor cannot validate the data the government provides but can “link” the subject entity to another entity, should that now-linked entity have a UEI/SAMMI and associated data, just the government data, or both? Should these entities be monitored for changes? What about the entities to which they are linked?

The government would be interested in entity relationships of excluded entities and will evaluate bidders based on the capability they can provide based on the evaluation criteria in section M.

53 C-17 The government states that it will not identify/distinguish/provide source providers of data elements in SAM, but will it maintain 2 records? The “accepted” SAM record and the EVS contractor record? Or is there some other form of temporary data store that the EVS contractor needs to take into account?

The Government will ensure that SAM has means to segregate Government-collected data (i.e., data supplied directly by SAM registrants) from the EVS contractor’s proprietary data within the system. The technical implementation of such means is outside the scope of the EVS procurement.

The data elements used to determine uniqueness and the entity information validated under this contract will be publicly searchable and displayed, and it will be included in the SAM public extracts. It will not be identified by the source provider on the display screen or in public extracts.

The Government has amended the solicitation to clarify the distinctions between the different types of data involved in entity validation. Please see Section H.7.1. It is important to note that in terms of the applicable FAR data rights clauses, unlimited rights are merely a license: the Government does not claim ownership in it but seeks to secure sufficient use rights to fulfill the core objectives of this procurement.

54 C-20 Government states (regarding monitoring of data) that “data will be stored in SAM for government use", however, government has stated that it intends to acquire unlimited data rights, so should the EVS contractor reasonably assume that this data will be placed in the public domain such as through SAM.gov public extracts or on FPDS and USASpending.gov?

EVS contractors should reasonably assume that data to which the government asserts unlimited data rights will be displayed and made publicly available, subject to any applicable legal restrictions (e.g.

FOIA or Privacy Act). Proprietary data offered to and accepted by the government (e.g. a proprietary corporate hierarchy data or other proprietary data) will not be publicly accessible with the exception of the public display of entity organizational information related specifically to an entity and that entity’s highest-level parent entity owner for applicable federal awards, including the name and unique identifier of the awardee and the name and unique identifier of the awardee’s highest-level parent entity, if the awardee is owned by another entity. This data for entity information and highest level parent entity owner will not be identified by the source provider on the display screen or in public extracts, however if such data is determined to be proprietary it will be segregated as such within SAM’s data stores55 C-20 Objective 3: Relationships between entities … and related entities not registered in SAM. Should we take this to mean the government wants data on every relationship of an entity? Does the government want information on relationships in addition to relationships characterized by greater than 50% ownership? Should all of these relationships be monitored for the government?

The government is interested in having a complete picture of the relationships of an entity and will evaluate Offeror's based on the capability they can provide based on the evaluation criteria in section M.

56 C-20 In paragraph 1 it states that entity organizational relationship data will be “shared with federal agencies”. However it then states that the government requires “full unlimited rights to data on current and historical entity relationships provided to SAM for an indefinite period.” Does “provided to SAM” mean entity-provided relationship data, or is this meant to apply to all relationship data included data provided solely by the contractor?

The government recognizes that the corporate hierarchy data provided by the EVS provider may be proprietary data. The Government will ensure that the overall SAM.gov modernization effort includes technological means to segregate Government-collected data (i.e., data supplied directly by SAM registrants) from the EVS contractor’s proprietary data (e.g., corporate hierarchy data). The technical implementation of such means is outside the scope of the EVS procurement. For purposes of this procurement, company data provided directly by registrants and stored in SAM.gov is considered to be held by the Government with unlimited rights. Company data held in the EVS contractor’s database and used by the contractor to verify entity existence, uniqueness and legitimacy remains proprietary and subject to the applicable restrictions. The result of that verification, i.e., standardized data that is delivered back to SAM.gov, is considered data first produced under this contract and is subject to the Government’s unlimited rights. The same is true of data generated through the help desk. It is important to note that in terms of the applicable FAR data rights clauses, unlimited rights are merely a license: the Government does not claim ownership in it but seeks to secure sufficient use rights to fulfill the core objectives of this procurement.

Contract Number: TBD

Amendment A00003 Attachment 1

57 C-21 Hierarchy maintenance: The government states again that hierarchy data will be maintained for government use. Is this meant to say this data, or any/all hierarchy data provided under the contract, will be maintained only within government? Or may it be provided by government to the public? Can the government provide any additional clarity?

EVS contractors should reasonably assume that data to which the government asserts unlimited data rights will be displayed and made publicly available, subject to any applicable legal restrictions (e.g.

FOIA or Privacy Act). Proprietary data offered to and accepted by the government (e.g. a proprietary corporate hierarchy data or other proprietary data) will not be publicly accessible with the exception of the public display of entity organizational information related specifically to an entity and that entity’s highest-level parent entity owner for applicable federal awards, including the name and unique identifier of the awardee and the name and unique identifier of the awardee’s highest-level parent entity, if the awardee is owned by another entity. This data for entity information and highest level parent entity owner will not be identified by the source provider on the display screen or in public extracts, however if such data is determined to be proprietary it will be segregated as such within SAM’s data stores.

58 C-22 Call Center: Will all inbound requests to the EVS contractor call center come from within the FSD system, or will some inbound requests be direct into the EVS contractor call center? Should outward-facing communication channels (phone number/web site) be established for the EVS contractor call center? What software is used for the FSD ticketing system?

All inbound calls will flow through FSD's ticketing system. We currently are using ServiceNow as our ticketing system. ServiceNow has the capability to integrate with JIRA.

Integration as outlined in Section C-4 PWS is a must. Electronic requests may come directly to the EVS contractor based on the issue type and method of input. Outward facing communication channels do not need to be provided.

59 M-3: OCD Can GSA provide clarification around the definition of Complete -- "Complete is defined as each of the data fields of the OCD are validated as applicable." -- What does it mean for a data field to be "validated as applicable?"

Since the file will contain a mix of entities including different locations such as domestic or international some data fields would not be applicable to each validation set. For example, for an international entity, U.S. State and U.S. Zip code would not apply.

60 M-3: OCD Would GSA be willing to provide some examples of how the data to be used for the OCD will be formatted?

A sample format of the data the government will provide to contractors during the OCD is provided as Section J Attachment 8. Please note: no entity organizational relationship data will be provided by the government. The offeror will have two (2) hours to perform a live demonstration of their technical approach to validate the entity information as defined in Section 4, Objectives 1 and 2 of the PWS and generate an organizational hierarchy as defined in Objective 3 of the PWS.

61 M-3: OCD Can GSA provide clarification around the OCD requirements for hierarchy -- "...method that relates all organizations within the organizational hierarchy in a manner that each of the organizational relationships can be generated programmatically." -- Can more detail be provided in what is meant by "each of the organizational relationships can be generated programma

The organizational relationships between entities should be ascertained programmatically via the record. This could include methods such as child-parent relations, full parent path, level in a hierarchy, etc. The contractor should be able to demonstrate that the Government can navigate the hierarchical relationships between entities.

62 C-33 Does an individual with a Defense Acquisition University’s program management certification, which is recognized by the Program Management Institute (PMI), but not a Project Management Professional (PMP) certification, satisfy the requirements in section 8 Personnel…