19Q1002_Amendment_2_Q&A.pdf

M9549219SU00501

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83)

Prescribed by GSA

FAR (48 CFR) 53.243

"The purpose of this amendment is to reflect the follow ing:

1). Incorporate the Questions and Responses for solicitation clarif ication.

See Summary of Changes for further details.

1. CONTRACT ID CODE PAGE OF PAGES

J 1 4

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 11-Jan-2019

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X M0026319Q1002

X 9B. DATED (SEE ITEM 11)

13-Dec-2018

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer X is extended, is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

11-Jan-2019

CODE

REGIONAL CONTRACTING OFFICE

ATTN: GYSGT ANITRA KINSEY P.O. BOX 5069 MC

PARRIS ISLAND SC 29905

M00263 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

M0026319Q1002

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION A - SOLICITATION/CONTRACT FORM

The required response date/time has changed from 18-Jan-2019 12:00 PM to 22-Jan-2019 12:00 PM.

SECTION L - INSTRUCTIONS, CONDITIONS AND NOTICES TO BIDDERS

The following have been added by full text:

QUESTIONS AND RESPONSES

Question 1: Why is Marine Corps Recruiting Command issuing multiple "stovepiped" solicitations for digital marketing channels (i.e. Advertising Services RFP, Prospect Messaging) and NOT looking at modern digital marketing hubs that leverage, in one console, and on ONE contact record, all the recruiting candidate's Social, Digital Advertising, SMS/MMS, Websites, and Email interactions for a 360 degree view of candidate "touch points" with the Marine Corps Recruiting Command?

<<Response- The TCPA is the limiter in terms of having a single marketing agency do all that is described.

Secondly, we are prevented (by DoD policy) from using cookies to track such personal characteristics described across web behavior.>>

Question 2: You have stipulated IL4, but our understanding of SMS is that it is inherently insecure. That encryption is built into the GSM or CDMA standard. SMS encryption for mobile communication ONLY encrypts to the cell phone tower. After your text message is received at your local cell phone tower, it is decrypted, then sent to the mobile carrier’s database and stored unencrypted and vulnerable.. Would the government consider a FedRAMP

Tailored LI-SaaS authorization?

<<Response- Yes, this a technically acceptable solution. The response will require an addendum from vendor showing Low Impact SAAS compliance. Please see the attached documentation. FedRAMP Tailored Baseline must be consistent with the National Institute of Standards & Technology (NIST) Special Publication (SP) 800-37.

Depending on the response, it is pertinent that the Authorizing Official (AO) (C4CY, Dr. Letteer) still has the responsibility of determining if additional security controls are required for compliance with agency -specific policies, procedures, and risk tolerance in order to issue an informed, risk-based, formal ATO.

To be considered a FedRAMP Tailored LI-SaaS cloud service, the answer to all the following questions must be

“yes:”

1.Does the service operate in a cloud environment?

2.Is the cloud service fully operational?

3.Is the cloud service a Software as a Service (SaaS), as defined by NIST SP 800-145, The NIST Definition of

Cloud Computing?

4.Does the cloud service contain no personally identifiable information (PII), except as needed to provide a login capability (username, password and email address)?

5.Is the cloud service low-security-impact, as defined by FIPS PUB 199, Standards for Security Categorization of

Federal Information and Information Systems?

6.Is the cloud service hosted within a FedRAMP-authorized Platform as a Service (PaaS) or Infrastructure as a

Service (IaaS), or is the CSP providing the underlying cloud infrastructure??

The only PII allowed in the system is the minimum necessary to provide login capabilities. This is limited to user name, email address, and password. The existence of any other PII disqualifies the system as a LI-SaaS.

Appendix E contains the FedRAMP controls recommended for self-attestation by the CSP. If the CSP is leveraging an underlying cloud stack (IaaS or PaaS) with an existing FedRAMP ATO, the CSP may also attest to those controls or control enhancements that are fully implemented by the underlying cloud infrastructure provider and considered

FedRAMP “inherited” controls as part of the CSP self-attestation.>>

Question 3: Could you please clarify what the government is looking for in 6.10 and 6.11? SMS Short Codes do not support call-backs. Phone numbers can be added to text messages and would appear to satisfy the requirements of 6.10, but we would like to learn more about what you are trying to accomplish.

<<Response- Salient characteristic required is met as long as a phone number is associated with the sender and collected for manual or automated call back once filtered as a potential prospect. This event would occur via vendor’s solution from the user interface for the customer is the expectation.>>

Question 4: Is the prospect_messaging for generate leads or already generated/pooled in applications with their mobile phone numbers with information?

<<Response- PMS will only be used to communicate with prospects, applicants, and Poolees, which we already have numbers for or will receive numbers for from sources outside of the application itself, so it will not be used to generate any "new" leads by this definition.>>

Question 5: What info goes and comes with each leads or application? Such as: name, gender, age, education, location, browser and mobile app, IP address, race, etc.

<<Response- There is no lead or application to enter an individual's information into the system. The user should be able to upload a list or manually enter the applicant's information. Preferred fields would be First Name, Last

Name, Phone Number at a minimum. Additional useful fields would be email, social handles, and a no tes section.>>

Question 6: What's the exact process for the prospect messaging system to work for the messaging?

(The use of the word "exact" is interesting -- there are no absolutes. However, here are some idea of what we are looking for in addition to what was in the original requirements doc that outlined it relatively well: )

<<Response- User uploads a list or manually enters the information for the individuals they wish to communicate to.

- User assigns that pool of prospects, Poolees, etc. to a specific "event" in order to keep it deconflicted with others

(examples could be specific events associated with musician lists for MEOP, community college lists for Reserves, athletic lists of varsity and junior varsity athletes, etc.).

- User crafts a single generic message using wildcard statements that pull fields from that pool of applicants ex

"Hello $FirstName, my name is MSgt _____ with the Marines and I see you currently study music at UCSD, have you ever thought about a career in military music?"

- The $FirstName wildcard in this case is replaced in each outgoing message with whatever is in the First Name field, i.e. "Sally", "John", etc.

- Responses from applicants come back to a single web-based dashboard (much like Skype chat) and the user is able to continue two-way conversations with their applicant pool in that dashboard.

- On the receiving end (prospect's end), it appears to the prospect as if they are having an SMS text conversation with the recruiter.

- The dashboard provides native analytics such as response rate, average time for response, total messages sent, etc.

- The application provides deconfliction so that if one applicant decides to "unsubscribe" or responds in a hostile manner, their information will not be messaged again in the future, even if entered into the system by a new user or account in a different area.>>

Question 7: Is there a use case and preference or requirement for applications such as height, weight, etc.?

<<Response- None of this needs to be captured natively to PMS. It is simply a two-way communication tool between a recruiter and prospect, any information like this would be translated to MCRISS upon screening.>>

(End of Summary of Changes)