Amendment_3_-_OAM16047S.pdf

Question Number

Page, Document, Section Reference, if applicable Question USHR Response

Attachment J-3, SOW - Section 23.0.j.i (Amendment 2 Question 41)

The Cloud Service Provider (CSP) utilizes one incident response process for all customers.

Utilizing one approach allows for scalability and ease of operations. As such, we would like to request that the requirements for security incident notifications align with the existing CSP reporting requirements which align with FedRAMP and allow for notification to be up to 48 hours.

The House would be one of hundreds of thousands of customers using the service. As the service provider, the CSP has the responsibility to report security incidents that result in an actual or potential breach of Customer Data to the House.

The CSP contractually commits to incident response reporting timeframes in the customer contract. One component driving the timeframes are the CSP’s ability to communicate to a wide customer base in the event of an incident. In a multi-tenant cloud environment, the CSP could be reporting to thousands of customers if there is a security incident impacting multiple customers.

Additionally, due to the nature of the CSP's service, the CSP can only report actual breaches, not attempted breaches not suspected, threatened, or foreseeable breaches. As a multitenant environment, an attempted breach against another tenant would not be reported to the House.

In the event of a security breach and if negotiated in the agreement, the CSP can notify the House’s identified points of contact. The CSP cannot notify affected parties because the CSP does not view customer data. The CSP is responsible for maintaining access in terms of performance and availability to the data. The data is owned by the customer.

Therefore, can the House please adjust this requirement accordingly?

No. In accordance with NIST Special Publication 800-53A IR-06 and best practices, the organization (USHR) determines the time window for reporting. We would expect reporting, not final mitigation, within 60 minutes.

Number

Page, Document, Section Reference, if applicable Question USHR Response

Attachment J-3, SOW - Section 6.9.a (Amendment 2 Question 43)

Is it a requirement that the House have complete ownership of the system source code for this solution? For SaaS solutions, a Cloud Services Provider would be responsible for maintaining access in terms of performance and availability to the House’s data. The House’s data would be owned by the House. The House would have access to its data and metadata, but not all of the SaaS solution underlying source code. The House would have full rights to extract their data at any time during the subscription service. However, the Cloud Services Provider does not typically offer system source code because it is inapplicable to software delivered as a service subscription through a multitenant architecture. While it is possible to provide the source code in an escrow account for a configured solution, the source code would only be able to operate in the Cloud Service Provider's SaaS environment. Therefore, can the House please adjust this requirement accordingly?

No, the House has no requirement for complete ownership of the system source code.

RFP Section H.7.c and H.7.d (Amendment 2 Question 44)

As a Cloud Services Provider, the solution is delivered via the web and no physical goods or equipment are being offered to the House. The Cloud Service Provider will maintain all of the hardware needed. We believe the goods, equipment, and services warranty does not apply to Cloud Service Providers. In terms of software, part d, the Cloud Service Provider uses commercially reasonable efforts to make its on-demand services available to its customers 24/7. Additionally, all aspects of the solution are configured in an N+1 redundant configuration, where N is the number of components of a given type needed for the service to operate, and +1 is the redundancy, allowing for a seamless transition if any component was to fail. The Cloud Service Provider runs anti-virus checks, conducts hardening processes, uses firewalls, implements port restrictions, and more to protect customers from harmful code and attacks. Therefore, can the House please adjust this requirement accordingly?

No. The warranty on services applies regardless of where the hardware or software reside. Whether an offeror provides hardware and/or software directly or through a third party, offeror is still responsible to the House for ensuring that all of the security standards are met, including (but not limited to) the security requirements set out in RFP § H.14 and Attachment J.3 (Statement of Work) § 23.0.

Number

Page, Document, Section Reference, if applicable Question USHR Response

4 RFP Section H.17 and Attachment J.3, SOW - Section 7.3 (Amendment 2 Question 45)

As a multi-tenant cloud service provider, we do not typically offer a Right to Audit clause as part of the base service offering. As a multi-tenant service, compartmentalization is virtual, not physical. Annual site visits can be arranged at the Houses expense, but in consideration of our other customers, random access cannot be permitted. The Cloud Service Provider has third party auditors inspect and review our security. We undergo annual audits for compliance with additional frameworks such as SSAE 16 SOC 1, SOC 2, SOC 3, ISO 27001, and PCI-DSS Level 1. The results of these audits can be provided to the House as desired under NDA.

Therefore, can the House please adjust this requirement accordingly?

No. The reports listed plus any FedRamp ATO documentation needs to be reviewable. If not in line with House policies and Procedures, then the offeror will need to provide a POAM to be compliant with House standards.

RFP Section H.22.b (Amendment 2 Question 46)

We assume this only applies to contractor personnel that are performing the solution implementation services and not the Cloud Service Provider (CSP) personnel that are hosting the solution.

For example, CSP engages the services of a background screening vendor to conduct background checks on employees at the time of hire in the U.S.

CSP also performs background investigations in certain foreign countries. The scope of these checks is subject to local laws in the jurisdictions in which the employee is hired.

Therefore, can the House please adjust this requirement accordingly?

No. Foreign nationals are not allowed access to House data. Data should not be stored in non-U.S. facilities.

Attachment J.10-A, Page 7 (Scheduling - Advanced Capabilities/Features, Line 2) (Amendment 2 Question 53) Please list the other PDA databases.

Following the publishing of Amendment 3, this will be addressed via an updated Attachment J.10-A will be sent to vendors that have submitted a signed Attachment J.2 Non-Disclosure Agreement.

Attachment J.3, Section 6.3.g and 7.1 (Amendment 2 Question 77)

These sections refer in part to managing overlapping responsibilities between Maintenance and CMS contractors supporting server hardware that hosts CMS software. Since some CMS server options have been retired, are the requirements as noted in these sections still applicable as written? No. See changes in Amendment 3.

8 Attachment J.8, Section 18 (Amendment 2 Question 84)

Will the House please define “Contractor Customizations” in the context of this clause. It does not appear to be defined in the RFP?

Section 18 of Attachment J.8 has been deleted. See updated Attachment J.8 and note that Attachment J.8 is a living document and may be updated by the House as needed during contract performance.

Number

Page, Document, Section Reference, if applicable Question USHR Response

Attachment J.10-A, Bulk E-mail Maintenance, pages 8-9 (Amendment 2 Question 85)

The House references three (3) requirements as “Future requirement in 2015”. Will the House please confirm if Attachment J.10A is an updated document?

Following the publishing of Amendment 3, this will be addressed via an updated Attachment J.10-A will be sent to vendors that have submitted a signed Attachment J.2 Non-Disclosure Agreement.

General

Do we need to send in the acknowledgement to the amendment forms prior to submission of the solicitation or can we include them in the solicitation? Acknowledgements of the amendments can be made in your proposal submission. There is no need to make separate submissions.

11 J.10.A – Basic and Advanced Features Is there a defined format for Importing lists provided by Advocacy groups?

The information might not be in a standard format. CMS provider may have to accommodate different formats.

J.3_SOW_NEW_ONE_

IN_Amd1 / Section 6.1 Capabilities

What is the average annual volume of outbound and inbound communications records for each office? This information is not tracked centrally and is not available.

13 J.10.A – Basic and Advanced Features What is the maximum batch size for mass emailing expected to be supported by CMS?

There is no maximum batch size, but the CMS is expected to be able to handle thousands of outbound emails at a time.

J.3_SOW_NEW_ONE_

IN_Amd1 / Section

6.8.1 Congressional

Transition Services

At what point can a “Freshman office” be given marketing materials, etc. for the CMS solution?

A CMS vendor may provide marketing materials after it has been awarded a contract (which requires passing the software and procurement evaluation processes), subject to Transition policies.

J.3_SOW_NEW_ONE_

IN_Amd1 / Section 8 Systems Administration Services

For a SaaS/Cloud solution would general end user support on the CMS be part of Systems Administration or 6.0 CMS Services?

Product and user support as it relates to CMS is considered a part of the CMS services, section 6.0, and is not part of System Administration Services.

16 Tab 1 – Administrative Since these are contract documents, we request this tab not be included in the 35 page limit. Only tabs 2,3,4 and 6 are included in the 35 page limit.

Tab 6 – Corporate Capabilities and Past Performance Is the org chart requested in the RFP considered part of the 35 page limit? See answer to question 16.

Number

Page, Document, Section Reference, if applicable Question USHR Response

Tab 6 – Corporate Capabilities and Past Performance Can the org chart and the past performances be excluded from the 35 page limit? See answer to question 16.

Due date

Considering that bidder's questions are still being answered by USHR, can USHR extend the due date of the response accordingly? Yes, see Amendment 3.

20 Due date Will the government consider extending the due date of response? See answer to question 19.

21 Attachment J.3 - SOW Please clarify response time expectations. See section 11 of the SOW.

Attachment J.2 - Pricing Matrix

In the pricing matrix there are Bronze, Silver, Gold and Platinum levels with regard to pricing.

Does the government intend to keep this preference post award? What percentage of discounts has the government seen in past awards?

The Bronze, Silver, Gold and Platinum levels are listed in the pricing matrix as examples only and their names may be replaced in the offeror's proposal. Offerors are not required to have 4 levels of service plans.

The percentage of discounts is not relevant to this procurement, as it is up to the offeror to propose overall pricing in a manner most advantageous to the House.

23 RFP Section L.1 Content of Proposals

Please clarify whether offerors submitting proposals for all 3 Tasks will have the submission for each Task evaluated separately, i.e. if the proposal for one Task is deemed unsatisfactory it does not affect the evaluation of the submissions for the other Tasks. Each task will not be evaluated separately.

24 RFP Section L.1 Tab 3 - Technical Approach

Will offerors be required to submit CMS software package for testing/evaluation with their proposals?

No. The CMS software will be submitted for the software evaluation after the offerors written proposal has been approved.

Attachment J.3 - SOW Section 6.0 Are CMS packages evaluated/tested post-award, or during source selection process?

CMS packages are evaluated after the offerors written proposal has been approved. A contract will not be awarded until after the CMS package passes an evaluation.

General What is the estimated time after submission to call vendors to test their solution?

The House anticipates CMS evaluations to begin immediately following proposal approvals targeted for October 2016.

General

In Amendment 2, the House answered several questions with the response ‘This question is under review and the House intends to answer in a future Amendment.’ When does the House plan to release this Amendment that answers these proposed questions? These questions are answered in this Amendment 3.

Number

Page, Document, Section Reference, if applicable Question USHR Response

Attachment J.3 - SOW Section 6.1.2

We interpret this requirement as not applicable to SaaS solutions. Based on the House’s response in Amendment 2 to question number 42, the CMS is expected to continue to interface with House systems after changes to the environment. As a Cloud Service Provider (CSP), the CSP hosts and maintains the hardware. Additionally, the CSP also provides upgrades, patches, and other system maintenance as part of the subscription service with no additional cost to the House. Any hardware or software change made by the CSP will not affect the House’s solution to interface with other House systems. As a CSP, the House’s solution would be accessed via a web browser and internet connection. Therefore, any hardware or software change made by the House to the House’s equipment would be independent of the CSP and would not affect the House’s solution to interface with other House systems. The CSP would manage and update the CSP’s hardware and software. The House would not be able to update the CSP’s hardware and software however the House’s solution to interface with other House systems will not be affected. As a CSP customer, the House will be able to configure or customize the service at any time based on the House’s requirements. Therefore, can the House please adjust this requirement for SaaS solutions?

This requirement will not be modified.

This section requires the CMS to be updated, as needed, to maintain compatibility with House systems. Possible examples include but are not limited to:

* changes in our Exchange email system

* introduction of new services such as Digital Mail

* changes required to adapt to policy changes such as bulk mail handling requirements

General Is email the only communication channel that the House desires (i.e., no need for SMS/text)?

Channels of communication are office-dependent. The House does not have a blanket requirement of one type of communication over another.

Number

Page, Document, Section Reference, if applicable Question USHR Response

RFP Document (Section L.1), Attachment J.3 - Section 6.0, and Attachment J.10B

Please clarify the proposal process associated with this solicitation. Our understanding is the following: 1) Bidders provide a proposal inclusive of technical approach, management approach, and pricing to the Government by the RFP deadline. This proposal response does NOT include the CMS package or its corresponding deliverables as defined in Section 6.0 (Attch. J.3 or J.10B). 2) The government and bidders may go through clarifications on the bidders proposal package at the governments discretion. 3) Government awards BPA to selected bidders. 4) Selected bidders that have received a BPA award may now submit a CMS package for pre-approval. Such CMS packages may not be sold or marketed to HoR prior to such approval. 5) Government approves or rejects CMS packages. 6)Contractor may re-submit CMS package for approval once rejected for an additional fee.

The Proposal evaluation does not include submission of the CMS Software for evaluation. This step follows the proposal evaluation process. The process further clarified: (1) Bidders provide a proposal with Management and Technical approach, pricing, support plans, financial information, and if applicable, any information required in accordance with HISPOL 17 under section 6.5.2 d.; (2) Government evaluates proposal; (3) Contingent upon proposal approval, Contractor is contacted to submit CMS software for evaluation; (4) Contingent upon approval of both the proposal and CMS evaluations, Government awards contract to selected bidders. Vendors using External Cloud should expect that the evaluation process may take longer, as additional assessments are requirements under HISPOL 17.

Amendment 2 Per Q&A #15, can the government please provide a sample CAO customer service survey?

Typical questions may include:

(1) Please rate your TSC Provider on the following attributes(Rating Scale): (Professionalism, Proactive, Timeliness, Communication, Responsiveness, Follow-up, Feedback Mechanisms, and Job Knowledge) (2) Please rate your TSC Provider services (Rating Scale): (Call Center Support, On-Site Technical Support, Training, After-Hours Support, Data Conversions)

(3) How satisfied are you overall with your CMS Provider's customer support? (Rating Scale)

Amendment 2

Can the government please confirm that assumptions are excluded from the page limit (for both price and technical volumes)?

Assumptions should be in the administrative tab and excluded from the page limit.

33 RFP Document - Section L.1

Can the government please confirm what volume should contain offeror's assumptions and clarifications? Administrative Tab.

Number

Page, Document, Section Reference, if applicable Question USHR Response

RFP Document - Section L.1

For offerors submitting/responding to two or more services, can the corresponding support plans be submitted as an appendix not bound by the page requirements since the SOW requirements state that "each support plan offered by the CMS contractor must define and describe in detail its support offerings..."

Proposals (Management and Technical Approach, Taks 1, 2, and/or 3 Support Plans, Cloud Assessment support requirements (where applicable), resumes, and all other required information) should be limited to the page requirements.

Amendment 2 Given that the ability to launch an offeror's proposed solution is dependent on the ability to extract legacy data, will legacy vendors be required to provide data for system/solution launch?

Section 6.8 (Close Out Services) requires that all outgoing (or as described in this case, "legacy vendors") shall provide a complete copy of the Client's database in the House's data exchange format for conversion to another CMS package provided by a different CMS Contractor.

Attachment J.3 - Section

6.0 - 8.0

Per section 6.0 in Attachment J.3 " a contractor authorized to provide CMS Services to a Client under a Contract must provide support plans to a client that meet or exceed..." this implies that Offerors are required to provide a support plan to the client for each issued client work order.

Can the government please confirm?

Contractors offering services under section 6.0 (Task 1) are required to offer a support plan to the client. Support plans offered can be in either one (or both) of the following categories: (1) House Hosted - on servers owned by the House, and/or (2) Externally or Cloud Hosted - on servers owned or leased by the offeror.

RFP Section M

Can the government please clarify or provide a timeline/estimated date for when awarded offerors are expected to submit their CMS package for evaluation?

The proposal evaluation process is to be completed first. Contingent upon successful completion of that process, the offeror will be contacted to submit their CMS software package for evaluation.

N/A

For the pre-proposal conference, if any slide decks were shown or questions answered, will the government post/provide those? There was only an agenda provided, which is attached to Amendment 3.

Amendment 2

It is our understanding that assumptions are considered financial information. Can the government please confirm? Confirmed.

40 RFP Document - Section L.1

Can the government please confirm that the Duns and Bradstreet number is acceptable to meet the financial capability requirement described in Section L.1 - Tab 6 bullet i.

No. The DUNS number is to be provided in addition to a written demonstration of financial capability sufficient for performance.

41 N/A Will the government provide an attendees list from the pre-proposal conference? Yes, see Amendment 3.

N/A

Given that several questions from the initial Q&As have not been answered yet and with the addition of a second Q&A period, will the government consider extending the proposal deadline? Yes, see Amendment 3.

Number

Page, Document, Section Reference, if applicable Question USHR Response

General

My company provides web services as well as services covered under the RFP. May I give a discount to offices to I provide both services to?

No. Web services to House offices are governed by a separate master contract (the Master Web Services Agreement). Technology Services Contract services and web services may not be bundled together for pricing purposes. You many not give a discount on TSC services for also providing web services. Likewise, you may not give a discount on Master Web Services Agreement services for also providing CMS, maintenance, or system administration services. The price that you charge a House office for a service should be reasonably commensurate with the value of the service provided. Providing House offices with services at no cost is contrary to House Rule XXV (the House Gift Rule).

Summary of Amendment 3 Changes to Attachment J.3 – Statement of Work

• Removal of Section 5.1.1(a)(ii) and subsequent renumbering of Section 5.1.1(a) as follows:

a. CMS Services. An Offeror of CMS Services must include, at a minimum, the following in its pricing list: (i) monthly hosting fees; (ii) monthly support fees; (iii) data conversion charges; (iiiv) exit conversion charges; (iv) costs associated with a Congressional Transition; and (vi) migration fees.

• Removal of Section 6.3(g) and subsequent formatting and renumbering of Section 6.3 as follows:

If applicable, at a minimum, the CMS Contractor shall be responsible for the following:

(a) integrating all hardware, software and communications components of CMS Packages (including cloud components); (b) maintaining equipment owned by the CMS Contractor and CMS-related software so that they are in proper operating condition; (c) implementing a reliable backup process; (d) providing copies and updates of the CMS data dictionary to the COR; (e) coordinating warranties and/or servicing of equipment owned by the Client and/or the CMS Contractor; (f) cooperating with the COR in security audits of equipment owned by the CMS Contractor and/or the Client and correcting identified deficiencies; (g) promptly repairing or replacing non-functioning components for systems owned by the CMS Contractor and/or the Client; (hg) training in the use and administration of a CMS Package; (ih) applying upgrades (including bug fixes) to software as required; (ji) monitoring systems owned and/or supported by the CMS Contractor for the success of data backups and taking appropriate actions to ensure that any failure in backing up the database of a CMS Package and CMS-related files does not continue for more than two (2) business days; (kj) providing a help desk and on-site support; (lk) restoring operating systems, applications, data and the most recent readable backup (utilizing the appropriate images when applicable) following a failure of the hardware, system or software; and (ml) ensuring all servers, cloud components, and all other network connected devices owned by the CMS Contractor, and covered under Section 6.0 of this Statement of Work, are secured in accordance with IT policies of the House (see Attachment J.102).

• Removal of the parenthetical sentence in Section 7.1 as follows:

The Maintenance Contractor shall ensure that a computer system and its components for a Client function according to specifications and standards in this Statement of Work.

The Maintenance Contractor shall be responsible for hardware services, including, but not limited to, the following: (a) repairing or replacing damaged or non-functioning hardware with compatible components of equal or greater value and capabilities (replacement systems must meet the same then-current requirements as new installations); (b) ensuring all workstations are configured to automatically update operating systems and applications; (c) ensuring all servers, workstations, printers and all other network connected devices owned by the Client or the CMS Contractor, if applicable, and covered under Section 6.5 of this Statement of Work, are secured in accordance with IT policies of the House; and (d) ensuring all servers and workstations are protected with the House-approved anti-virus software. (NOTE: If the CMS Contractor is not providing hardware support, the Maintenance Contractor may restore the CMS server, including the operating system, non-CMS applications and data (utilizing the appropriate images when applicable) following a failure of the hardware, system or software.)

Summary of Amendment 3 Changes to Attachment J.8 - Client Work Order

• General formatting changes and numbering corrections

• Note that the Client Work Order is a living document to be updated during contract performance as necessary.

• Adjustment of Section 13 to conform to the standard notice of cancellation in Section 10 as follows:

The Client may terminate this Client Work Order, and all associated Client Work Orders, immediately upon written notice to the Contractor (a) in the event that the Contractor is in breach of the Integrated Agreement or any associated Client Work Orders, or (b) at any time in the discretion of the Client with 30 days’ written notice to the Contractor and the House as stated in Section 10 above.

In the event of a termination under this Section 13, the Contractor: (i) must promptly notify the CAO of the termination of this Client Work Order and/or Integrated Agreement; (ii) may claim only properly supported out-of-pocket costs plus a reasonable amount of demonstrable related charges for the work already performed, all to be determined in accordance with generally accepted accounting procedures; and (iii) shall promptly deliver to the Client all relevant Work Product that exists on the effective termination date.

• Removal of Section 18 - Work Product

Pre-Proposal Conference U.S. House of Representatives

Request for Proposals OAM16047S – Technology Services 2016

June 8, 2016 Location: Room 108 Ford House Office Building

Time: 1:30 PM

AGENDA

Welcome and Introductions

Administrative Matters

• Sign-in sheet

• Emergency procedures

• Silence all electronic devices

• Restroom locations

Background/Purpose

• House environment o Relationship between the CAO, HIR, and Technology Services vendors o Committee on House Administration Technology Services policy

• Technology Services Contracts o Overall structure of services o Client Work Order process o Recurring payment process

Questions and Answers

• Amendment 2

• Open discussion

Anticipated Next Steps

• Questions by Vendors – Submission period extended to Tuesday, June 14 at 5:00 PM EST

• Solicitation Closure - Friday, July 1 at 2:00 PM EST

• Evaluation of Proposals

• Award