OPE_Survey_Hosting_RFI_2013.doc

Merit Systems Protection Board (MSPB)

Request for Information June 2013

Merit Systems Protection Board

Office of Policy and Evaluation (OPE)

Request for Information

For Survey Hosting, Development, Administration, and Technical Support Tools, Capabilities, or Services June 2013 Table of Contents

31. MSPB Mission

32. Purpose of this RFI

33. MSPB Survey Processes and Examples

44. Scope of Work

44.1 General Scope

44.1.1 Primarily Web-based Customer Service Surveys

44.1.2 Primarily Web-based Research Surveys

44.1.3 Paper-based surveys

44.2 Survey Hosting Capacity

54.3 Privacy, Security, and Confidentiality

54.3.1 Privacy and Security of Survey Administration and Survey Response Data

64.3.2 Confidentiality

64.4 Survey Development

64.4.1 Survey Development Tools

64.4.2 Survey Field Testing

74.4.3 Section 508 Compliance

74.4.4 Survey Accessibility

74.5 Survey Administration

74.5.1 Survey Sampling and Distribution

74.5.2 Survey Data Collection

84.5.3 Survey Data Compilation

84.6 Paper Surveys

84.7 Technical Support

95. RFI Responses

11Appendix A: MSPB Customer Service Survey Flowchart

12Appendix B: MSPB Customer Service Survey (Sample 1)

21Appendix C: MSPB Customer Service Survey (Sample 2)

22Appendix D: MSPB Research Survey Flowchart

23Appendix E: MSPB Research Survey (Sample 1)

43Appendix F: MSPB Research Survey (Sample 2)

54Appendix G: Federal Information Security References

1. MSPB Mission The mission of the Merit Systems Protection Board (MSPB) is to protect the Merit System Principles and promote an effective Federal workforce free of Prohibited Personnel Practices.

MSPB has statutory responsibility to conduct special studies of the civil service and other Federal merit systems. Studies focus on the extent to which the Federal workforce is managed in an efficient and effective manner, in accordance with the Merit System Principles (MSPs), and in a manner free from Prohibited Personnel Practices (PPPs). The ability to develop and administer surveys is a critical component of MSPB’s merit systems study responsibilities. Reports based on previous MSPB surveys and additional information about MSPB research are available at http://www.mspb.gov/sites/mspb/pages/MSPB%20Studies.aspx. In addition, MSPB collects customer service and customer satisfaction information as part of its agency performance measurement and reporting required under Government Performance and Results Act Modernization Act of 2010 (GPRAMA) and to support special projects and program evaluations.

2. Purpose of this RFI MSPB is submitting this Request for Information (RFI) to solicit statements of interest and capabilities from industry Providers of survey development, administration, data hosting, and associated technical support tools or services for both Research and Customer Service surveys (see Section 3). At the Government’s discretion it may decide to hold industry exchange meetings with interested Providers to gather more information after RFI responses have been submitted. Providers may also be asked to provide a demonstration of their survey development, administration, data hosting, and technical support services. All responses to this RFI (and any related correspondence, meetings, or presentations pertaining to the Provider’s capabilities) are entirely at the Provider’s expense.

This is not a solicitation for proposals, proposal abstracts, or quotations. MSPB will not accept any unsolicited proposals, proposal abstracts, or quotations. MSPB does not intend to award a contract based on this RFI.

MSPB will assess the information received and make a determination on the ability of the market to meet our survey hosting, survey development, administration, and technical support needs, as stated below. The information will be used to determine feasibility for a potential procurement. However, at the time of this RFI, MSPB is unable to guarantee that a Request for Quote (RFQ) will be issued. A RFQ and future contract is subject to the ability of the market to meet our needs and the availability of funds. Nonetheless, it is our plan to issue a RFQ and select a Provider for a renewable contract with multiple option years for survey hosting, development, administration, and/or technical support services.

3. MSPB Survey Processes and Examples MSPB has two survey processes: The Customer Service survey process is described in Appendix A and sample customer service surveys are contained in Appendices B and C. The Research survey process is described in Appendix D, and sample research surveys are contained in Appendices E and F.

MSPB is seeking information from industry Providers on systems, tools, capabilities, and services for survey hosting, development, administration, and technical support for one platform to support both survey processes. MSPB professional staff will develop survey question content; design and execute survey layout, items, and response options; generate the survey sample; and analyze the resulting survey data. Accordingly, MSPB is not seeking professional assistance with survey design, sampling, data-weighting, or data analysis.

4. Scope of Work

4.1 General Scope

4.1.1 Primarily Web-based Customer Service Surveys: MSPB will require a survey platform and associated survey hosting, development, administration, and technical support tools, capabilities, or services, for three to eight primarily web-based Customer Service surveys per year with approximately 200-400 respondents each; Customer Service surveys can be administered in response to real-time customer actions (such as being currently logged onto the MSPB website), and on a rolling basis throughout each year (such as every few days based on appeals cases closed during a specific period).

4.1.2 Primarily Web-based Research Surveys: MSPB will require a survey platform and associated survey hosting, development, administration, and technical support tools, capabilities, or services, for approximately three primarily web-based Research surveys per year for between 10,000-100,000 respondents each. Research surveys will typically require a four week “live” period and an optional extension period of two weeks. Additionally, each Research survey will need to be available on the web for a two-week field testing period. Field tests typically begin four to six weeks before the scheduled open date of the survey.

4.1.3 Paper-based surveys: MSPB may seek out support for the generation, distribution, receipt, tracking, and data input of paper-based surveys. These paper surveys could be alternative versions of web-based Research or Customer Service surveys, or stand-alone surveys. Although the capacity for paper survey functionality is desirable, a lack of such functionality should not preclude Providers from responding to this RFI.

4.2 Survey Hosting Capacity

The MSPB requires a web-enabled, provider-hosted solution to store all MSPB survey information in a secure environment. Providers can host at their facilities or within a cloud service environment.

Providers are asked to describe their capabilities for hosting a survey system of the sizes, duration, and functionality specified in Sections 3 and 4. This should include, but is not limited to, specification of:

· Details about the hosting environment, including whether it is cloud-hosted or non-cloud hosted;

· Capacity for simultaneous “hits” on survey (and any scalability in pricing therein);

· Data storage for survey templates and response data (and any scalability in pricing therein); and

· Data backup strategy for survey templates and survey response data.

4.3 Privacy, Security, and Confidentiality

Providers must be compliant with all applicable Federal Government and MSPB rules, regulations, directives, instructions, orders, guidance, and policies pertaining to Information Assurance (IA), Information Technology (IT), IT Security, and protection of Federal and MSPB data and information systems including, but not limited to, adherence to National Institute of Standards and Technology (NIST) policies, NIST/MSPB security standards, the Federal Information Security Management Act (FISMA) and the specifications in Appendix G.

Providers are also required to safeguard PII in accordance with the Privacy Act of 1974, 5 U.S.C. § 552a, and MSPB Privacy Act Regulation Part 1205.

4.3.1 Privacy and Security of Survey Administration and Survey Response Data

The Provider’s hosting environment must ensure that MSPB-owned data is not at risk and that its physical assets are not exposed to harm or theft.

For cloud-hosted solutions, Providers must indicate whether they are:

· FedRAMP certified;

· In the process of receiving FedRAMP certification; or

· Authorized from the U.S. General Services Administration (GSA) under National Institute of Standards and Technology (NIST) Risk Management Framework to operate at the Medium level.

For non-cloud hosted solutions, Providers must:

· Substantiate adherence to all applicable Federal Government laws, rules, regulations, directives, instructions, orders, guidance, and policies pertaining to Information Assurance (IA), Information Technology (IT), IT Security, and protection of Federal and MSPB data and information systems including, but not limited to, adherence to National Institute of Standards and Technology (NIST) policies, NIST/MSPB security standards, the Federal Information Security Management Act (FISMA), and the specifications in Appendix G.

All Providers are also asked to describe their capability and methods to:

· Ensure the security and privacy of response information and prevent the disclosure of personally identifiable information (PII) and other sensitive government information to unauthorized personnel, and substantiate adherence to the Privacy Act of 1974, 5 U.S.C. § 552a, and MSPB Privacy Act Regulation Part 1205. Capabilities and methods should include the Provider’s evaluation of the privacy impact of MSPB’s survey system (see Appendices A through G);

· Provide a secure connection for participants to take the survey; and

· Enable controlled access to surveys (e.g., unique username and password), open-access, and possibly hybrid access (e.g., unique username, but no password). For controlled access, providers are asked to describe methods for ensuring authenticity.

4.3.2 Confidentiality and Nondisclosure

MSPB requires that Providers be able to hold information concerning survey participants in the strictest of confidence. The data processed within MSPB offices is considered proprietary and/or sensitive and therefore cannot be used to solicit or benefit other work by the Provider without permission or consent from MSPB. The Provider agrees to comply with the following Federal Acquisition Regulation (FAR) clauses 52.224-1 and 52.224-2. Additionally, MSPB requires that:

· All survey information will be kept confidential and secure;

· Data will only be used for purposes of conducting the Customer Service or Research surveys, and any additional MSPB surveys; and

· The Provider will not sell or otherwise provide the data to any agency or other third party, or to anyone in the Provider’s organization not working directly on a specific survey, or to anyone who has not been pre-approved by MSPB.

4.4 Survey Development

MSPB will design and field test surveys using the Provider’s tools and surveys will be hosted by the Provider.

4.4.1 Survey Development Tools

MSPB requests that providers describe the functionality of their survey development tools including, but not limited to, the availability of:

· Simultaneous access to survey design tools and capabilities by up to 4-6 MSPB analysts;

· Multiple user-permissions/restrictions for surveys including Survey Author, Reviewer, Read Only;

· Customizability of survey templates and content presentation (e.g., colors, fonts, inclusion of the MSPB’s logo, page breaks, types of questions per page, and other general formatting);

· Customizability of survey question and response option design (e.g., style, font, size, colors, bold/italic/underline, spacing, row shading, etc.);

· Customizability of survey structure and question and response type such as various scaled or categorical responses, question skip patterns and branching, and, required and respondent driven responses;

· Transferability of survey content (e.g., items and response options) between surveys or into survey system from other applications (e.g., Word and Excel);

· Open ended questions and options for how response data is gathered, saved, (e.g., format) and linked to other survey data for a particular record; and

· Any additional survey item/response option presentation capabilities (e.g., ability to embed images and video in survey, use of sliding scales, etc.).

4.4.2 Survey Field Testing

Providers are asked to describe their capability to perform survey field testing to include, but not limited to:

· Deployment and testing of a demo survey, hosted by the Provider;

· Mock distribution of survey to a sample of field test participants and collection of participants’ survey response data; and

· Opportunities for MSPB to examine sample response records and databases, and to make changes to survey as appropriate.

4.4.3 Section 508 Compliance

Providers giving services or products (e.g., software applications and operating systems, including web-based internet information and applications) to Federal agencies must provide Section 508 compliant deliverables. For more information, visit www.section508.gov.

In accordance with Federal regulations, Providers must have the capability to generate:

· Internet survey files in PDF and HTML format that are 508 compliant; and

· PDF, HTML, or similar versions of the survey that are 508 compliant, for inclusion in written and electronic reports.

4.4.4 Survey Accessibility

Providers are asked to describe their system’s capabilities for enabling individuals to easily access and complete surveys without installation of additional software or plug-ins, including, but not limited to, specifying the Provider’s system compatibility with:

· Operating systems;

· Smart devices (e.g., Android and iPhone);

· Web browsers; and

· Monitor resolutions.

4.5 Survey Administration

4.5.1 Survey Sampling and Distribution

Providers are asked to describe their system’s capability or methods to:

· Link with (i.e., draw from and distribute surveys to) various sources of survey recipients (e.g., list or database of email addresses, LISTSERV, C-support ticketing system, list of MSPB employees, identified web users, etc. See Appendices A and D);

· Distribute survey invitations and related notices (e.g., reminders, “Thank you”) to participants;

· Conduct Pre-survey testing and validation of survey distribution methods (e.g., email addresses);

· Identify survey distribution issues (e.g., invalid email addresses) and resolve such issues;

· Distribute an email message as to appear from an “mspb.gov” address; and

· Perform or support any other survey sampling and distribution functions.

4.5.2 Survey Data Collection

Providers are asked to describe their system’s capability to:

· Provide 24-hour/seven-day-per-week web site access for participants to complete surveys;

· Allow participants to print “definition sheets/instruction sheets” for completing surveys;

· Save survey response data in real-time;

· Perform data integrity checks as participants enter responses, to include the prevention of entry of invalid values (e.g., text in a numeric field, multiple responses for a forced-choice item, or an out-of-range numeric value);

· Allow participants to utilize multiple session completion of survey (e.g., exit an in-progress survey and return to it later for completion);

· Allow participants to change previously entered responses, including re-accessing a previously completed- and submitted- survey during the “live” period;

· Prevent unintentionally skipped questions;

· Prevent participants from submitting a survey more than once, and detect and remove any duplicate surveys submitted by the same participant;

· Overcome unforeseen difficulties that may prevent respondents from completing the survey (e.g., server issues, power outages); and

· Perform or support any other survey data collection functions.

4.5.3 Survey Data Compilation

Providers are asked to describe their capability, through system functions or direct provision, to:

· Determine survey-completion statistics in real-time (e.g., total surveys completed, the surveys completed by each participating agency, and possibly number of surveys completed by demographic factors, grade level, supervisory status, or other characteristics of respondents);

· Provide a database of survey raw data and meta-data (e.g., variable labels, value labels, version of survey, percentage of survey completed/number of items answered) along with any corresponding open-ended data for each response record, that can be directly imported into both SPSS and SAS;

· Download/delivery of interim or final databases and data files to MSPB at MSPB discretion;

· Generate a data dictionary (e.g., all variable names with corresponding item stems and response options);

· Execute reporting and analysis functions (e.g., data weighting, cross-tabulations, multi-year comparisons) (optional);

· Certify that all data has been removed from the Provider’s databases upon MSPB’s request; and

· Perform or support any other survey data compilation functions.

4.6 Paper Surveys

Providers are asked to describe their capability, through system functions or direct provision, to generate, distribute, receive, track, and input data for paper based surveys, as well as any other functions for paper surveys. Although the capacity for paper survey functionality is desirable, a lack of such functionality should not preclude Providers from responding to this RFI.

4.7 Technical Support

Providers are asked to describe their technical support services, including but not limited to, support for:

· MSPB employees using the Provider’s survey development tools;

· Assisting survey participants in recovering a lost survey invitation, username, or password;

· Assisting survey participants with resolving technical difficulties in accessing or completing the survey;

· Working with agencies to overcome difficulties with survey distribution which may be due to technical issues, such as agency server settings that restrict incoming email;

· Assisting MSPB in overcoming any survey response data issues (e.g., unintended multiple responses or mistakes in skip patterns); and

· Any other available technical support services that Providers recommend.

5. RFI Responses

This is not a solicitation for proposals, proposal abstracts, or quotations. MSPB will not accept any unsolicited proposals, proposal abstracts, or quotations. MSPB does not intend to award a contract based on this RFI. All responses to this RFI (and any related correspondence, meetings, or presentations pertaining to the Provider’s capabilities) are entirely at the Provider’s expense.

Questions from Interested Providers The MSPB welcomes questions that help interested Providers clarify any information contained in this RFI. All questions should be emailed to Stephen Smith at Stephen.Smith@mspb.gov by COB, 5:00pm EST on July 17, 2013.

RFI Response Length and Format All interested Providers should construct responses as detailed below in the “RFI Response Criteria” section in 15 pages or less and in Microsoft Word or PDF format. Appended materials, such as Provider brochures or information, are permitted and will be excluded from the 15 page limitation.

RFI Response Criteria Providers’ responses should include, but are not limited to, the following criteria:

1. Corporate Profile – Provide a brief company description, business size, and a point of contact for any questions or clarification on the Provider’s RFI response.

2. Service Offerings – Provide a description of the survey system features and how the Provider intends to meet the survey system specifications listed in Sections 3 and 4 above. This should include identifying whether the hosted solution is FedRAMP certified, currently in the process of becoming FedRAMP certified, or otherwise authorized by GSA. Describe where in the Continental United States (CONUS) data centers are located and back-up procedures.

3. Teaming Arrangement – Identify all teaming arrangements and what capabilities each member provides. For instance, if a survey application Provider does not offer hosting or cloud services, describe the approach for teaming with a FedRAMP certified cloud service Provider or other hosting service.

4. Past Performance – Providers are encouraged to describe prior successful experience with web-enabled, provider-hosted solutions or cloud-based solutions for web-based survey design and delivery. Specifically, Providers are encouraged to highlight experience conducting surveys of the Federal workforce, particularly surveys that included participants from multiple Federal agencies or bureaus.

5. References – MSPB requests three references from Federal client organizations for whom the Provider or its teaming partners has provided survey and hosting service capabilities. These clients may be contacted to determine their satisfaction with the Provider’s performance.

6. Pricing – Although not required, to the extent feasible, Providers are asked to provide a rough order of magnitude price estimate and structure for all of the work described in Sections 3 and 4, including but not limited to:

· The survey development tool (e.g., initial license, maintenance fee and support);

· Scalable hosting for survey administration with various numbers of simultaneously logged on survey participants, and scalable storage of survey templates and response data;

· Any impact on price estimate from variability in the number of Customer Service and Research surveys administered per year, or the number of individuals sampled per survey or per year;

· A separate price estimate for any paper survey functionality;

· A separate price estimate for any additional or recommended capabilities or services not outlined in Sections 3 or 4; and

· Any pricing discounts.

7. Warranty – If applicable.

Delivery of Submittals All RFI responses must be received by the MSPB by COB, 5:00pm EST on July 26, 2013. Interested Providers must submit the 15-page-maximum response as separate Word or PDF files to the following POC:

POC:

Stephen Smith Email Address:

Stephen.Smith@mspb.gov Address:

U.S. Merit Systems Protection Board Office of Policy and Evaluation

1615 M Street NW, Suite 500

Washington, D.C. 20419

Telephone:

202-254-4415 Appendix A: MSPB Customer Service Survey Flowchart ***Note: Green Outline-Provider’s responsibility; Blue Outline-MSPB’s responsibility; Red Outline-Provider’s and MSPB’s responsibility; Purple Outline-MSPB’s and OMB’s responsibility.

Appendix B: MSPB Customer Service Survey (Sample 1)

Appendix B (Continued)

Appendix C: MSPB Customer Service Survey (Sample 2)

Appendix D: MSPB Research Survey Flowchart ***Note: Green Outline-Provider’s responsibility; Blue Outline-MSPB’s responsibility; Red Outline-Provider’s and MSPB’s responsibility; Purple Outline-MSPB’s and OPM’s responsibility; Orange Outline-Other party’s responsibility.

Appendix E: MSPB Research Survey (Sample 1)

Appendix E (Continued)

Appendix F: MSPB Research Survey (Sample 2)

Appendix F (Continued)

Appendix G: Federal Information Security References Laws and Regulations

· Computer Fraud and Abuse Act [PL 99-474, 18 USC 1030]

· E-Authentication Guidance for Federal Agencies [OMB M-04-04]

· Federal Information Security Management Act (FISMA) of 2002 [Title III, PL 107-347]

· Federal Information Resources Management Regulation [41 CFR C 201]

· Freedom of Information Act As Amended in 2002 [PL 104-232, 5 USC 552]

· Guidance on Inter-Agency Sharing of Personal Data – Protecting Personal Privacy [OMB M-01-05]

· Homeland Security Presidential Directive-7, Critical Infrastructure Identification, Prioritization, and Protection [HSPD-7]

· Internal Control Systems [OMB Circular A-123]

· Management of Federal Information Resources [OMB Circular A-130]

· Management’s Responsibility for Internal Control [OMB Circular A-123, Revised 12/21/2004]

· Privacy Act of 1974 as amended [5 USC 552a]

· Protection of Sensitive Agency Information [OMB M-06-16]

· Records Management by Federal Agencies [44 USC 31]

· Responsibilities for the Maintenance of Records About Individuals by Federal Agencies [OMB Circular A-108, as amended]

· Security of Federal Automated Information Systems [OMB Circular A-130, Appendix III]

Standards and Guidance

· A NIST Definition of Cloud Computing [NIST SP 800-145]

· Computer Security Incident Handling Guide [NIST SP 800—61, Revision 1]

· Contingency Planning Guide for Federal Information Systems [NIST SP 800-34, Revision 1]

· Engineering Principles for Information Technology Security (A Baseline for Achieving Security) [NIST SP 800-27, Revision A]

· General Criteria for the Operation of Various Types of Bodies Performing Inspection [International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 17020:1998]

· Guide for Assessing the Security Controls in Federal Information Systems [NIST SP 800-53A]

· Guide for Developing Security Plans for Federal Information Systems [NIST SP 800-18, Revision 1]

· Guide for Developing the Risk Management Framework to Federal Information Systems:

· A Security Life Cycle Approach [NIST SP 800-37, Revision 1]

· Guide for Mapping Types of Information and Information Systems to Security Categories [NISP SP 800-60, Revision 1]

· Guide for Security-Focused Configuration Management of Information Systems [NIST

· SP 800-128]

· Information Security Continuous Monitoring for Federal Information Systems and Organizations [NIST SP 800-137]

· Minimum Security Requirements for Federal Information and Information Systems [FIPS Publication 200]

· Personal Identity Verification (PIV) of Federal Employees and Providers [FIPS Publication 201-1]

· Recommended Security Controls for Federal Information Systems [NIST SP 800-53, Revision 4]

· Risk Management Guide for Information Technology Systems [NIST SP 800-30]

· Security Considerations in the System Development Life Cycle [NIST SP 800-64, Revision 2]

· Security Requirements for Cryptographic Modules [FIPS Publication 140-2]

· Standards for Security Categorization of Federal Information and Information Systems [FIPS Publication 199]

· Technical Guide to Information Security Testing and Assessment [NIST SP 800-115]

· Guidelines for Media Sanitization [NIST SP 800-88] Request for Information: Survey Hosting, Development, Administration, & Technical Support Tools, Capabilities, or Services