QA-_Part_2.pdf

RFP: OPIC-18-R-0007 Questions and Answers – Part 2

Answers in RED Below

1) Can the Government elaborate on why the implementation period was set at 18 Months? Has there already been and analysis or was this deadline set for another reason such as discontinuing support/services on the old platform? The 18 month timeline is not based on a set date for retirement of a legacy system. The implementation period was based on market analysis for other similar implementations.

2) Will the Government provide a one week extension? Once the Contract has been awarded, there are provisions for extending the Period of Performance and/or the Contract Period. However, the date by which proposals are required cannot be extended.

3) Is the Government open to alternate cloud environments such as Azure, AWS, and IBM? Yes, if they meet Federal Government regulations, such as FedRamp.

4) Can the Government please provide Section 21.1 or is that the SDLC provided as “19 Appendix” on after page 22 of the SOW? OPIC could not find the reference to Section 21.1, but it does sound like it is referring to the SDLC in the appendix.

5) OPIC identifies a deployment scenario where are all scorecards are developed and deployed at once. Would OPIC be open to allowing the developer to treat each Scorecard as a solution module with its own development, test, and deployment schedule? After the initial scorecard is completed, OPIC envisions a sequential development/testing of the remaining scorecards

6) Does OPIC have a governance program for tracking and prioritizing bug-fixes or is the Contractor responsible for implementing said solution? OPIC uses ServiceNow as their ticketing tool and a governing body for change control. Prioritization would be driven by the stakeholder group.

7) Is training intended for users of the system or for both users and system administrators? Is the training audience OPIC employees/contractors or the OPIC customers as well? Both - with the audience being Employees and Contractors, not customers.

8) Is this requirement to imply the user has the ability to create a new record of the 10 previously created Scorecards developed during this project? Or is this requirement to allow the user to create a new Scorecard with a different field layout, workflow and reporting capability? A user would be able to create a new record using one of the 10 previously developed scorecards.

9) Is the request to allow formulas to be imported into the Scorecard from another OPIC capabilities, but to allow for the formula to be modified with the Scorecard? OPIC envisions the user to be able to import a formula from Excel, or directly input a formula into the relevant field.

10) Is OPIC referring to the SSO, AD integration and role based access as the robust controls? If not, what additional controls is OPIC seeking? Yes it is.

11) For purposes of costing, what is the current data size stored by the 10 Scorecards? Each scorecard is roughly between 500-630 KG and the historical data comprises another 8 MB.

12) Does OPIC have a defined process for integrating their current IaaS and PaaS offerings with OPIC AD and SSO? If so, will this solution be able to leverage their process/access? Currently, the PaaS and SaaS (Office 365, SharePoint online, ServiceNow, Salesforce) offerings that are used by OPIC are integrated with OPIC’s Active Directory/SSO and is enabled for MFA through Centrify. Any new PaaS/SaaS offering procured by OPIC should be able to leverage OPIC’s setup for AD integration and SSO, provided the offering is SAML 2.0 compliant.

13) What are OPIC’s requirements for high availability? What are OPIC’s requirements for return to operations and recovery point objectives? OPIC’s core infrastructure equipment is designed for HA. Redundant power, active/passive firewalls, switches, routers, & multiple ESXi hosts w/ vmotion, etc. Applications can be provisioned for HA via load-balancing, depending on the core requirements and critical need. The ITSS contractor is responsible for maintaining 99.999 up time.

14) Is OPIC requesting that a user be able to open a report that is stored with the Scorecard application without first authenticating to the application? Or is the request to allow users to access reports while in the Scorecard application regardless of which Scorecard or screen they are on currently viewing? Depends on the reporting capability of the Platform. Within the scorecard application itself, the user should be able to pull up various canned reports. But power users may need to access the data warehouse through a reporting application (like Tableau) to put together more robust reports or dashboards.

15) Is the data warehouse to be utilized as a data export of the scorecard information for long-term storage or can record retention be managed within the Scorecard application? The data warehouse to be utilized for integrated reporting and also long-term storage solutions.

16) Do all scorecards have the same workflow? No - there are two separate workflows depending on whether the loan is in project origination or in project monitoring.

17) Is the Security Readiness Review and Operational Readiness Review part of the Production Readiness Review or are these separate gate reviews? All 3 Readiness Reviews tend to be at the same control gate review, but this may vary depending on the type of security controls required for the system.

18) Can further clarity be given on the expectation from the vendor for reporting purposes? Specifically about the effort expected to extract data and / or standard reporting capabilities within the solution.

It is envisioned that the newly developed platform would have certain high-level canned reporting features and general sort/filter capability on the scorecard data, (for example: loan ratings and PD’s by Project Name, Project ID#, Scoring Officer Name, Scorecard Type, Assessment Date, Country, Region and Industry Sector, with as-of reporting capability, and historical trends available.) It is also envisioned that the data generated by each scorecard will be pushed to a data warehouse where other off-the shelf reporting tools could be used by power users to develop more robust reports and perform more in-depth analytics.

19) What will be the data sources for the ongoing feed for the scorecard? Are there any external data sources which have been manually collected and needs a automated extraction and ingestion into OPIC data landscape? There are several internal OPIC applications that will require an on-going feed to the scorecard (Insight, Oracle, Spreading Application) as well as data sources requiring manual extraction (Country & Regulatory Environment Ratings Application, historical rating data).

20) We are assuming that scorecard reports/dashboards in specific format will be made available to Sharepoint landscape for users collaboration. Please confirm? When the Contract has been awarded, OPIC will provide sanitized versions of the models required for development. Prior to award, OPIC can provide screenshots of a model template.

21) As per key objectives, there will be additional roles (apart from key personnel mentioned in RFP) like Business Analyst (Financial Risk Domain Expert), Technical Architect etc. Should we count these additional roles under Developers category? Please confirm if this is OK (OR) should we create additional rows for each of the roles (labor categories)? Please create additional rows such that the overall level of resources committed to the project will be clearly shown.

22) Please can you share the requirements excel from which the "Initial Requirements" table have been pasted. Yes. It will be a separate attachment.

23) Initial Requirements Table (row#11) - "Allows modification to scorecard templates -add/delete/edit field and …." Is incomplete. Please complete the requirement. Should read "Allows modification to scorecard templates -add/delete/edit field and properties"

24) Initial Requirements Table (row#26) - "General timeframe for deployment is manageable/acceptable (i.e., Fall of …." Is incomplete. Please complete the requirement. Should read "General timeframe for deployment is manageable/acceptable (i.e., Fall of 2018)."

25) In the RFP it is stated that OPIC is ok with resources working remotely. Can we assume that remote means offshore or onshore? Both Offshore and Onshore vendors are permitted, but frequent travel to OPIC offices in Washington DC is expected and should be part of the pricing.