FIS_Centralized_Records_Unit_RFP_-__OPM1516R0003_-_Q A_Responses.pdf

Reference Section Reference Page Reference Quote Question / Comment / Proposed Language Question No. OPM Response

General General Is this a new requirement or a re-compete and if a re-compete who is the incumbent and what is their contract #?

1 The Centralized Record Unit Requirement is an update and expansion of the existing Consolidated Leads Contract (OPM15-11-C-0005) with NT Concepts.

B.3 5 OPM-FIS will provide the Contractor with an estimate of work for each Contract Line Item Number (CLIN) for the upcoming fiscal year. OPM’s actual CLIN ordering will not entitle the Contractor to an equitable price adjustment.

Can OPM please confirm the intent of the statement is limited to OPM’s replacing its annual fiscal year estimate with the follow-on actual order?

2 That is not the intent of B.3. No adjustment to the CLIN pricing in B.7 will be made as a result of variation in estimated quantities provided by OPM. Contractors should price accordingly. The estimated quantities provided at the start of each FY are for information purposes only.

B.7 7-14 CLINS Will the government provide process throughput for each of the FFUP CLINS listed? If so, what are they for each. This data is needed in order to size the opportunity.

3 Section L provides the estimated quantities for the CLINs. The contractor is responsible for developing its own hourly estimates to demonstrate their understanding of the Government's requirements as described in this solicitation and the attachments thereto, and successfully complete the work. The Government will not provide its internal estimates for use by contractors in preparation of proposals.

B.7 CLINs 14 Tables Is there an Option Period 4 or just 3 Option Periods? 4 The period(s) of performance for the resultant IDIQ contract are described in B.6.

C.1.1.2 15 Workloads for each of the CLINs listed in Section B.7 are directly related to the volume of cases received and processed within FIS, as estimated in Section L.5.

Did the Government intend to reference to Section “L.5” or Section “L.6”?

Section L.5.e provides volume estimates for pricing purposes.

C.1.1.3 15 The Contractor will provide work related to this contract in Boyers, PA and other OPM approved facilities.

Please elaborate on other onsite locations. Will the government allow any offsite/remote support, or is onsite support a firm requirement?

6 OPM may issue task orders for services at any point during the IDIQ contract's period of performance. Said task orders will contain the required information of FAR 16.505 (a) (7).

The primary place of performance shall be Boyers, PA. It may be necessary, as part of performance under a given task order, for the contractor to provide services at the locations identified in B.6. Work may be performed at other locations, subject to OPM approval, which shall be defined at the task order level.

C.1.1.3 15 The Contractor will provide work related to this contract in Boyers, PA and other OPM approved facilities.

Can the Government please expand on the T&M LOE and associated SOW requirements required to be performed outside Boyers, PA? Does the Government anticipate any FFU work to be performed outside of the Boyers, PA Government-Provided facility? Is the DC/Ft. Meade work anticipated to be at Government or Contractor facility?

Will the contractor be required to have a facility in the Ft.

Meade area?

7 OPM may issue task orders for services at any point during the IDIQ contract's period of performance. Said task orders will contain the required information of FAR 16.505 (a) (7).

The primary place of performance shall be Boyers, PA. It may be necessary, as part of performance under a given task order, for the contractor to provide services at the locations identified in B.6. Work may be performed at other locations, subject to OPM approval, which shall be defined at the task order level.

C.1.1.3 15 The Contractor will not remove Personally Identifiable Information (PII) or case material from OPM approved facilities without OPM approval.

Does the Government anticipate that Contractor Provided Training Facility and Data Center Facility will be authorized to host/store/reference PII or Case Material? If yes, what will be the nature, type, and clearance level of the materials?

Requirement for contractor provided training facility and data center facility were removed from the Final RFP. Off‐site locations are not required to store PII and case material.

C.1.2 15 OPM anticipates that changes in technology will affect the manner in which work is performed at any time during the life of the Contract.

Is any IT or Technology support required as part of this contract? If yes, then please clarify which parts, how and how much.

9 Changes to technology cannot be foreseen by OPM. In the event that changes in technology affect contract performance the specifics shall be considered to determine whether an equotable adjustment to the CLIN pricing in B.6. is approriate. Reference question 21.

C.1.2 15 The Contractor will utilize only OPM’s Processing Systems, referred to as Investigative Enterprise Systems (IES), or any future OPM system that is directly associated with the investigative process. The IES application enables electronic ingestion of the personnel security questionnaire and subsequent scheduling, tracking, reporting, closing of investigations, processing accountability and timeliness information. The IES contains data provided by the requesting agency, subject-provided background information, investigative results data, agency adjudication data, and other relevant case data.

What systems/applications are included in the Investigative Enterprise Systems?

10 The Government will not release this information prior to award.

C.1.2 15 OPM is moving toward a completely electronic case file. More background investigations are received electronically, which reduces the need for hardcopy processing of investigative items.

Can the Government please expand on the amount of cases currently processed by EIS? Does OPM have a target date where all cases will be processed by EIS? Can the Government please provide EIS transition project milestone dates for pricing consideration? Is the CRU contractor expected to assist in the transition of services from paper to electronic - and/or assist in testing out system functionality?

Specific answers to these questions are not currently available. The intent of C.1.2 is to communicate to contractors that IT systems used in performance of the contract work are subject to change. The specific of each system migration, should they occur, will be considered with the IDIQ contract holder and addressed via changes and resultant equitable adjustments to the contract price, if necessary.

C.1.2 15 OPM anticipates that changes in technology will affect the manner in which work is performed at any time during the life of the Contract. These changes will not affect an increase in cost of this contract.

Does the Government anticipate a cost reduction as a result of electronic transition effort? Does the Government anticipate greater efficiency in centralized records process based upon electronic transition effort? If yes, what is the Government's target/expected efficiency rate?

12 Changes to technology cannot be foreseen by OPM. In the event that changes in technology affect contract performance the specifics shall be considered to determine whether an equitable adjustment to the CLIN pricing in B.7. is approriate.

C.1.2.1 15 If the Contractor uses their system to house any OPM related information or intends to connect to the OPM systems, they will be required to go through a formal information security Assessment and Authorization (A&A) process (Refer to Attachment 4).

Is the Contractor Time and Expense (T&E) proposed system required to go through A&A? Does the contractor today have use of any Government-owned/contractor-maintained systems in use on this contract that are expected to be transitioned to new contractor?

The contractor T&E does not require A&A.

C.1.6 16 "The Contractor will also account for any electronic OPM material that is printed for their personnel's use."

Will this require being manifested? 14 Yes.

C.1.6 16 The Contractor will account for all hardcopy piecework items and OPM material once received by the Contractor. The Contractor will also account for any electronic OPM material that is printed for their personnel’s use. The Contractor will furnish periodic status reports, in accordance with C.9.5 [Adhoc Deliverables]. The Contractor will follow the approved plan for Quality Control. All hardcopy and electronic copies of OPM material need to be safeguarded. The Contractor will follow the OPM-FIS Security Manual and OPM-FIS Policy on the Protection of PII.

Is there an electronic system in place to track hardcopy piecework? If so, what is the system?

OPM, in its current environment, is able to track cases via IES and some items via ePRP.

Certain materials, in print form, are not able to be tracked within a system. As such, the physical handoff and manifesting of material will be required. The contractor will be responsible for tracking in accordance with C.1.6 [Document Control Log].

C.1.6 16 The Contractor will immediately notify OPM of any case, portion of a case, OPM material, or OPM issued equipment, that is lost and/or compromised. The Contractor will take immediate action to retrieve the lost material and/or equipment, and will be financially responsible for the loss/compromise of the material and equipment, damages, and the cost of the investigation.

This section states the contractor will notify immediately a loss to OPM. Is this once the contractor has confirmed there is a loss of material/equipment through exhausting all efforts? What would be considered as exhausted all efforts?

What is the time limit for exhausting all efforts?

Situations may vary and, as such, it's not possible to define specifics that will be applicable across all scenarios. Contractors should report loss/compromise as soon as it becomes aware in accordance with C.1.5.

C.1.7 16 "The Contractor will be responsible for the handoff and tracking of all investigative material to OPM and other OPM Contractors."

Will the Contractor be responsible for building and maintaining their own tracking system, or will it be issued to each Contractor from OPM?

17 Refer to question number 15.

C.1.8 16 "The Contractor is required to maintain strict security measures in all its operations and provide secure storage for investigative materials. This will be in accordance with the OPM-FIS Security Manual and the OPM-FIS Policy on the Protection of PII."

Is the Contractor responsible for providing the storage unit to maintain strict security measures and secure storage of material?

No. OPM does not anticipate a requirement for contractors to have secure storage outside of the Boyers, PA Iron Mountain location or outside of OPM‐leased space within the Boyers. PA Iron Mountain location.

C.1.8 16 The Contractor is required to maintain strict security measures in all its operations and provide secure storage for investigative materials.

Please clarify the manner to which the Contractor will provide secure storage for investigative materials: Will OPM provide the Contractor with a letter of authorization to purchase such equipment via a third party GSA Schedule?

Will such purchase be treated as a separate CLIN (ie, ODCs) under the contract?

19 Refer to question number 18.

C.2.1 16 Contractor personnel will receive their daily supervision/oversight from their own Contractor-assigned staff.

Will all proposed contractor staff to include management staff be accommodated with work space/stations at the Government Facility in Boyer's PA?

OPM intends to provide Government Furnished Equipment (GFE) as described in C.7.1.4.

A summary of available GFE (J.1.1.16) will be available within the Reading Room.

C.2.3 17 The Contractor will reimburse Federal or other contractor’s staff for any rework completed.

How is the reimbursement calculated for the Federal Government/other Contractors in case of re-work?

Refer to Section C.2.3 for a definition of "rework".

C.2.4 17 OPM may, for any reason, immediately suspend or revoke the Contractor or Contractor facility access authorization, security clearance, and/or general access to perform work under this Contract.

Please confirm that the statement refers to Contractor ‘personnel’ (and not the Contractor company).

Section C.2.4 of the RFP refers to contractor personnel. Separate clauses apply to the contractor.

C.3.2 19 The Contract and Processes and Procedures Manual(s) (J.1.1.6) will constitute as the basis of Contractor developed training courses and process instructions.

The contractor will post a list of all available training materials in a manner of OPM’s discretion upon award.

Based upon the statement, our understanding is the Government intends for the Contractor to have updated all Training Course and Process Instructions per any proposed process changes and/or improvements by award? Would the Government consider extending the deadline for submission until after the transition period or within 30 days post-award? Until the Government hosts the Train the Trainer Session (Section C.3.7) finalizing training documentation will be challenging.

Yes. J.1.1.14 will be available within the Reading Room.

C.3.4 19 An incumbent contract employee in good standing currently working on OPM

Contracts may be transferred to another entity or to a new Contract into the same job function without any additional training. Additional training is left to the discretion of the Contractor when the incumbent has eighteen (18) months of consecutive OPM experience (in the respective job title with the same functions) and less than eight (8) months of inactivity working under an OPM Contract in a similar capacity. If the incumbent has a break in service of twelve

(12) months or more, the individual will be required to attend a complete training program(s) for their respective position. However, regardless of the incumbents experience level, training (refresher at a minimum) is mandatory for any break in service where a modification has occurred during the period of inactivity.

Does the 12 months or more break in service mean the incumbent is still employed by the contractor and has not worked for 12 months or more? It’s not clear the difference between the 8 months to 12 months difference.

Refer to the Final RFP.

C.3.4 19 An incumbent contract employee in good standing currently working on OPM

Contracts may be transferred to another entity or to a new Contract into the same job function without any additional training. Additional training is left to the discretion of the Contractor when the incumbent has eighteen (18) months of consecutive OPM experience (in the respective job title with the same functions) and less than eight (8) months of inactivity working under an OPM Contract in a similar capacity. If the incumbent has a break in service of twelve

(12) months or more, the individual will be required to attend a complete training program(s) for their respective position. However, regardless of the incumbents experience level, training (refresher at a minimum) is mandatory for any break in service where a modification has occurred during the period of inactivity.

What constitutes similar capacity? 25

Similar capacity is defined as a position in a similar role on an OPM investigative services contract.

C.3.5 20 The Government will provide annual mandatory information technology (IT) (Annual IT Security and Privacy Awareness training) for all Contractor employees working under this Contract.

What is the expected length of time for an individual to complete the mandatory Government IT training? Is this training in addition to the SPECIALIZED IT SECURITY AWARENESS TRAINING (APR 2015) on page 133?

26 Response timeframes for the annual training are set yearly. There are completion cut‐off dates which, if not met, may result in removal of access. The Government IT training is updated yearly. The annual IT secuirty and privacy awareness training does not count towards the "specialized IT security training" requirement for those with IT security specific responsibilities.

C.7.1.4 24 OPM will provide to the Contractor, for exclusive use for work performed under this Contract, certain property (including PIV cards), equipment, services, and fixed assets, including:

The following list does not include access to copiers. Can the Government please confirm, no copier access will be provided for CRU contractors.

27 Refer to question number 20.

C.8 25 OCI Risk Mitigation Please confirm the incumbent, if any, and its subcontractor cannot propose for this future RFP.

Refer to the Final RFP.

C.8 Conflict of Interest Risk Mitigation

25 The current OCI language reads: "Any Contractor that currently has a fieldwork or non-fieldwork Contract with OPM, where OPM’s FIS is understood to be the primary customer, is prohibited from soliciting, proposing, or being awarded a Contract resulting from this solicitation. This exclusion extends to include Contracts presently awarded which will continue through any point of the required period of performance of the Contract described herein. This would also include project management, quality assurance, software design, development, or other manner of planning, design, development, or implementation phase activity related to any aspect of the OPM background investigative process. This exclusion extends throughout the life of this Contract."

In reviewing this language with the other OPM FIS DRFPs and against FAR Subpart 9.5, several concerns have been identified and include:

-- There is inconsistency with the same clause found in the DRFPs for Fieldwork and CRU - both of those start with "Any Primary Contractor..." The guidance is not clear on a contractor's ability to prime one effort and subcontract on another.

-- The language, read literally, would prohibit an incumbent contractor from bidding on their current work. We believe that is not OPM's intent.

-- While it is clearly understood the potential for OCI exists if a contractor holds both a fieldwork and a non-fieldwork contract, the draft statement extends the contract restrictions to a degree not warranted by the General Rules of FAR Subpart 9.5.

-- The statement "include project management, quality assurance, software design, development, or other manner of planning, design, development, or implementation phase activity related to any aspect of the OPM background investigative process" is also overly restrictive in light of FAR 9.5 and would prevent OPM from leveraging the program knowledge and expertise of their vendor in improving aspects of the background investigation process.

It also could be interpreted that it would prevent contractors from performing project management, quality assurance, and other efforts in support of their performance efforts.

29 Refer to question number 28.

C.8.1 25 Please clarify the definition of fieldwork and non-fieldwork. Further, please expand upon what constitutes the OPM background investigation process. If an active contract was fully delivered and the only remaining activities were warranty related, could the contractor participate in this solicitation process?

Please clarify the definition of fieldwork and non-fieldwork.

Further, please expand upon what constitutes the OPM background investigation process. If an active was fully delivered and the only remaining activities were warranty related, could the contractor participate in this solicitation process?

30 Reference the response to question number 28.

C.8.1 25 Any primary Contractor that currently has a fieldwork or non-fieldwork Contract with OPM, where OPM- FIS is understood to be the primary customer, is prohibited from soliciting, proposing, or being awarded a Contract resulting from this solicitation.

Is it the Government's intent to exclude any contractor currently support OPM today from bidding or proposing on this effort? Can the Government please summarize what contracts are considered "non-fieldwork" that would OCI out a bidder?

Refer to question number 28.

C.8.1 25 Any primary Contractor that currently has a fieldwork or non-fieldwork

Contract with OPM, where OPM- FIS is understood to be the primary customer, is prohibited from soliciting, proposing, or being awarded a Contract resulting from this solicitation. This exclusion extends to include Contracts presently awarded which will continue through any point of the required period of performance of the Contract described herein. This would also include project management, quality assurance, software design, development, or other manner of planning, design, development, or implementation phase activity related to any aspect of the OPM background investigative process. This exclusion extends throughout the life of this Contract.

Does this COI apply to subcontractor personnel as well as prime contractor personnel?

Refer to question number 28.

C.8.1 25 Any primary Contractor that currently has a fieldwork or non-fieldwork Contract with OPM, where OPM- FIS is understood to be the primary customer, is prohibited from soliciting, proposing, or being awarded a Contract resulting from this solicitation. This exclusion extends to include Contracts presently awarded which will continue through any point of the required period of performance of the Contract described herein. This would also include project management, quality assurance, software design, development, or other manner of planning, design, development, or implementation phase activity related to any aspect of the OPM background investigative process. This exclusion extends throughout the life of this Contract.

Does this prohibit a contractor from bidding on both this contract and the almost concurrent Support Services contract?

33 Refer to question number 28.

C.8.1 25 Any primary Contractor that currently has a fieldwork or non-fieldwork Contract with OPM, where OPM- FIS is understood to be the primary customer, is prohibited from soliciting, proposing, or being awarded a Contract resulting from this solicitation. This exclusion extends to include Contracts presently awarded which will continue through any point of the required period of performance of the Contract described herein. This would also include project management, quality assurance, software design, development, or other manner of planning, design, development, or implementation phase activity related to any aspect of the OPM background investigative process. This exclusion extends throughout the life of this Contract.

Please explain how OPM will have prime contractors mitigate OCI concerns, real or perceived when it comes to providing data results with other Government data sources used within the security clearance process? Such government data sources as the FBI namecheck program.

Refer to question number 28.

C.8.1 25 Any primary Contractor that currently has a fieldwork or non-fieldwork

Contract with OPM, where OPM- FIS is understood to be the primary customer, is prohibited from soliciting, proposing, or being awarded a Contract resulting from this solicitation. This exclusion extends to include Contracts presently awarded which will continue through any point of the required period of performance of the Contract described herein. This would also include project management, quality assurance, software design, development, or other manner of planning, design, development, or implementation phase activity related to any aspect of the OPM background investigative process. This exclusion extends throughout the life of this Contract.

Would a company be able to participate in more than one non-fieldwork contract if the areas of focus and participation are completely independent of each other and have no impact on the work performed within each (i.e. specified subcontractor on one opportunity and the prime contractor on another)?

35 Refer to question number 28.

C.8.1 25 Any primary Contractor that currently has a fieldwork or non-fieldwork Contract with OPM, where OPM- FIS is understood to be the primary customer, is prohibited from soliciting, proposing, or being awarded a Contract resulting from this solicitation. This exclusion extends to include Contracts presently awarded which will continue through any point of the required period of performance of the Contract described herein. This would also include project management, quality assurance, software design, development, or other manner of planning, design, development, or implementation phase activity related to any aspect of the OPM background investigative process. This exclusion extends throughout the life of this Contract.

As multiple non-fieldwork contracts will be disseminated at approximately the same time, will a contractor only be able to participate (as a prime or subcontractor) on one opportunity? If a contractor participates in more than one opportunity, will it reflect negatively on the evaluation of such submissions?

36 Refer to question number 28.

C.8.1 25 Any primary Contractor that currently has a fieldwork or non-fieldwork Contract with OPM, where OPM- FIS is understood to be the primary customer, is prohibited from soliciting, proposing, or being awarded a Contract resulting from this solicitation. This exclusion extends to include Contracts presently awarded which will continue through any point of the required period of performance of the Contract described herein. This would also include project management, quality assurance, software design, development, or other manner of planning, design, development, or implementation phase activity related to any aspect of the OPM background investigative process. This exclusion extends throughout the life of this Contract.

If a contractor participates on both non-fieldwork submissions, will they be able to rescind their offer on a submitted proposal if awarded the other?

Refer to question number 28.

C.9.2.4 and C.9.2.5 27 The Contractor will submit a Drug Free and Violence Free Workplace Plan, as required by I.1 [FAR 52.223 6 – Drug Free Workplace], and J.1.2.15 [OPM Guidance for Agency Specific Domestic Violence, Sexual Assault and Stalking Policies], sixty (60) calendar days from Contract Award.

The Contractor will submit a Contractor Code of Business Ethics and Conduct, in accordance with FAR 52.203-13, thirty (30) days from Contract Award.

It is our understanding the most Contractors certify that they comply with the cited FAR clauses (ie, 52.236-6 Drug Free Workplace and 52.203-13 Contractor Code of Business Ethics and Conduct) via SAMS and/or as a separate statement under the Contractor’s proposal.

In the interests of keeping costs down, will OPM change the requirement and accept the Contractor’s certification that the Contractor has implemented a company-wide program in accordance with the applicable FAR clause instead of requiring actual plans?

Please also note, the referenced FAR clause 52.236-6 should be 52.223-6.

No. Contractors that have provided these plans previously should not encounter additional cost to present more than certification of prior compliance for OPM's consideration. Refer to Section C.9.2 for Required Contractor Plans.

C.9.3.2.1, bullet 10 28 • % Available Resources FTE - This number represents the percentage of the individual’s time they are available to conduct OPM background investigations.

Please clarify the number represents an individual's time available to provide service on this contract --not OPM background investigations.

Yes. Certain fields, where not applicable to CRU, will be marked as such.

C.9.3.3.3 30 • Date of last evaluation

• Method(s) of evaluation (e.g., written assessment, examination, etc.)

• Result of Evaluation

• Action Taken

How often is the requirement to evaluate each staff? 40

Evaluation frequency is determined by the contractor as part of their QCP.

C.9.3.3.3 30 • Date of last evaluation

• Method(s) of evaluation (e.g., written assessment, examination, etc.)

• Result of Evaluation

• Action Taken

Does the evaluation require all functions a staff member processes?

Evaluation content is determined by the contractor as part of their QCP.

C.9.8 34 The Contractor will provide a redacted version of all modifications within seven (7) days of the modification’s signature date in block 16.c.

Can the Government clarify this statement specifically as it relates to what is meant by the "modifications" and the reference to "block 16.c"?

42 RFP revised at this section.

C.10.1.13 36 Protected source information will be properly reported by not identifying the protected source within the ROI and in case messages.

This statement talks about protected sources in the ROI.

Will this contract conduct interviews with sources outside employment/military records?

43 No, not at this time.

C.10.1.14 36 "During any processing of work, if it is determined that the case did not schedule complete components according to the case scheduling requirements (found in the INV-15, the TIG, and OPM issued Policy and Guidance memos), the contractor will ensure that the appropriate items are scheduled."

How will this be handled since this falls under the SS2 standard on the Support Services Contract? Will the CRU contract schedule this missing coverage and then notify

OPM?

44 The missing coverage will be referred to the COR.

C.10.1.5 35 Provide personal protective equipment for employees such as ear plugs, biohazard suites, rubber gloves, masks, etc.

Please clarify situations or work that may require the use of protective equipment.

The requirement for protective gear has been removed.

C.10.2.1 11th Bullet 38 "Complete closed case corrections on previous OPM files being reviewed" Which side will be completing the corrections process? Will this be a function in each contract or will the CRU contract refer corrections to the Support Services Contractor?

Corrections are performed on previous OPM investigations. That is the File Release process and the review of A0s. Each contractor will process corrections within their own contract. There is no one group that is assigned the corrections.

C.10.3 2nd Bullet

47 "Inquiries will be sorted prior to mail out to search for schools requiring the use of the National Student Clearinghouse (NSC)."

Will the entire sort process come to CRU prior to the inquires being mailed out?

47 As stated, the inquiries will be sorted by CRU to pull the ones requiring the use of the

NSC.

C.10.4 47 Conduct follow up telephone calls for Tiered Investigations What item types will be conducted on the Tiered investigations?

48 Refer to J.1.1.10 [2012 Federal Investigative Standards with OPM Clarification] and J.1.1.11 [Tiered Investigation Guide v.7.0] within the Reading Room.

C.10.8 49 Corrections for All Cases Request clarification needed as this function is also listed in the Support Services DRFP.

49 Refer to question number 46.

C.10.10 50 New Items New Items are going to be created during the life of this contract. Would this be a contract modification for pricing when the item types are released for use?

50 Refer to RFP Section B.4 [New Requirements].

F.1 153 single award or multi-award please confirm if the government intends to issue a single award or mutiple awards. This statement conflicts with the award statement on page 166 (M.1.b)

51 RFP revised throughout. As stated in the associated Synopsis OPM intends to make a single award on solicitation number OPM1516R0003.

F.3 59-64 Current achieved quality results please provide the currently achieved quality results for each of the stated work requirements.

52 RFP revised at F.3.

F.3.2 CRU 3 62 "SII searches (IMT) will be processed and previous OPM investigation updated (if review not needed), uploaded into ePRP and reviewed, or requested to be printed from microfilm if not available in OPIS. The contractor will date the IMT (day received and processed) with the correct date and SID. The contractor will screen the IMT sheet, review the previous OPM investigation to include completing any needed corrections to the file, complete modified scheduling and the “Items not Scheduled” modified scheduling report, and update all items appropriately. This will be measured from the time the item is pending to completion of the item. This process will be completed within three (3) business days."

Which contractor is responsible for I2I in this process? 53 RFP revised at F.3. The I2I portion is a requirement under of the CRU contractor. The microfilm portion is a requirement of the Support contractor.

F.3.2 CRU 7 64 "All Inquiries able to be run first path will be run through the scanner within one (1) day of receipt. Any scanner kickouts or manual Inquiries will be updated electronically as received in IES within one (1) day of receipt. The inquiries will be reviewed, processed, all required follow up scheduled, within one (1) day of the item being electronically received in IES. The Inquiry will be manually updated or run through the second path scanner the same day as processing."

Wording is confusing; request clarification. Will it be a 2-day standard from arrival in department, thereby allowing 1 day for the clerks to process first path and 1 day for MA's to process work? Based on the volume of Inquires that are received and processed, we recommend this be a 2-day standard to mirror the CRU 4 standard. A 1-day requirement makes sense for inquires processed by the scanner and the updating of IES for any scanner kickouts.

54 RFP revised at F.3. The inquiries must be run 1st path through the scanner in 1 day. There is then, as stated in the second half, 1 day to pre-review the inquiry and update it.

G.5.8 72 Table Can the Government please provide acronym definition for the referenced table?

55 This chart has been converted to plain language.

H.2.3 74 OPM does not guarantee all management data preferred by the Contractor to be provided. Additional management data will be created by the Contractor, The Contractor maintains primary responsibility to have independent accounting systems.

Please clarify which data is provided and what data is limited from being stored in Contractor Systems.

OPM shall endeavor to provide the contractor with available management data maintained as part of its systems. If the contractor stores or transmits OPM data then its systems must go through the A&A process.

H.3.1.2 74 All security clearance holders are responsible for any and all required security clearance training.

Is this for NISPOM or contract required training? 57 The final RFP was revised.

H.3.1.3 74 If the security classification or security requirements are changed by the Government subsequent to the date of this Contract, and if the changes cause an increase or decrease in security costs or otherwise affects any other term or condition of this Contract, any resulting financial burden will be the sole responsibility of the Contractor.

The processing of clearance are currently budgeted and paid by DSS as part of the Personnel Security Investigation (PSI) Projection Survey Annual NISP PSI Requirements Projection Survey. Has the requirement changed for OPM to charge the contractor?

58 Refer to question number 57.

H.3.2.3 75 Access to Classified Information Please confirm that while work may require access to Personnel systems at or up to TOP Secret and "Q" or "L", the systems will not hold Restricted Data.

59 Refer to question number 57.

H.3.3.1 77 dd-254 what level clearance will be needed for the prime and at what point in the procurement process? Will OPM sponsor bidders.

60 Refer to question number 57.

H.3.3.1.2 77 OPM determined that performance of this contract requires Contractor, subcontractor(s), vendor(s), etc., (herein known as Contractor) to access sensitive information and may require access to classified National Security Information (herein known as classified information) up to and including XXXXXXX classification level

Please clarify the classification level required (it now says

"XXXXXXX").

61 Refer to question number 57.

H.3.3.1.3 77 Contractor and/or contract employees, in addition to meeting the OPM background suitability requirements, may require security clearance eligibility for this contract and subsequent task order(s).

Is the cleared contractor clearance directly relevant to the clearance package to be processed? For example, only a SSBI cleared person by process an SSBI package? If not, what is the base level clearance required to process any package level?

62 Refer to question number 57.

H.3.3.2.4 78 Contractor must possess a facility clearance that is equal to level for work on this contract prior to submission of proposal or quotation

What is the minimum facility clearance required to work on this contract? Will the Government be providing a completed DD254 in the final solicitation?

63 Refer to question number 57.

H.4, H.4.1 82 IT Security Manager/IT Manager Required certifications are stated for ISSOs are there specific certification requirements for the IT Security Manager & IT Manager?

64 The contractor will provide roles and current resumes of those proposed to perform key tasks. Minimum qualifications and certifications are not stated in the RFP. Minimum requirements for resumees are listed in Section M.

H.4, H.4.1 82 IT Security Manager/IT Manager Required certifications are stated for ISSOs. Are there specific certification requirements for the IT Security Manager & IT Manager?

65 Refer to question number 64.

H.4.1 82 Key personnel include all personnel directly involved in the operational project management of this Contract (Facility Security Officer, Program Manager, IT Security manager, IT Manager, and Quality Assurance manager, directly responsible for the success of the awarded contract).

Can the Government please expand on the support required from the IT Security manager and IT manager? Is it the Government's intent that they support the Contractor process (Contractor Owned IT) or the OPM Boyer's facility in general?

66 The two positions previously listed as Key Personnel have been combined in the Final RFP. This position would support Contractor Owned IT resources. The OPM Helpdesk would support any government furnished equipment and OPM IT systems.

H.12.2.1 89 OPM's workspace is leased; therefore, the Contractor will comply with all facility rules and regulations imposed by the lessor of any leased space where government work is being performed. Examples of these rules include, but are not limited to, the following: Lessor rules and regulations will be provided upon award and as updated throughout the life of the contract.

How much office/work space will be provided by the Government? Will there be any space for training, or is all training to occur in space provided by the Contractor?

67 Refer to questions number 19 and 20. A tour will be given at the Pre-Proposal Conference

Attachment 3 / II.

Req. Authority and Ref. / 2nd Para.

113 The foundational reference for all Federal information system security control requirements is the United States National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Revision 3.

Should the NIST reference be SP 800-53 Rev 3 or Rev 4?

Please clarify.

Yes.

Attachment 4 - 1752.239-78

132 (a) Prior to using any commercial Cloud Service Provider (CSP), the Contractor will obtain approval from the Chief Information Officer (CIO), through the Contracting Officer (CO) or Contracting Officer's Representative (COR).

Could the Government provide a list of approved commercial Cloud Providers? Is AWS GovCloud approved by CIO, CO and COR?

69 The list of FedRaamp approved Cloud providers is publicly available. AWS Cloud is approved for non-High systems.

Attachment 4 - 1752.239-81

133 Table Does the Government intend for the Contractor to bid all IT Roles/Functions located in the table in support of the Support Services Contract?

All roles which pertain to supporting the information system utilized to fulfill the requirements of this RFP should be factored into CLIN pricing.

Attachment 4 - 1752.239-86

136 a. The Contractor must support OPM in its efforts to assess and monitor the IT systems and infrastructure used in support of the performance of this contract.

The Contractor must provide logical and physical access to the Contractor's facilities, installations, technical capabilities, operations, documentation, records, devices, applications and databases used in performance of the contract, regardless of location, upon Agency request.

Does this also entail supporting OPM to assess and monitor the IT systems and infrastructure at the OPM facility for supporting installations, technical capabilities, operations, documentation, records, devices, applications and databases used in performance of the contract? If yes, then could the government please provide the number of devices, applications, databases, infrastructure, list of the type of services and the staffing qualifications expected as deliverable as part of this contract?

71 This is not a deliverable. This is a common requirement that is requried of all contractors.

This should not be burden requiring additional staffing levels by the contractors to support.

The Goverment must have the ability to monitor all devices.

Attachment 4 - 1752.239-86

136 The Contractor must support OPM in its efforts to assess and monitor the IT systems and infrastructure used in support of the performance of this contract.

The Contractor must provide logical and physical access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, devices, applications and databases used in performance of the contract, regardless of location, upon Agency request. The Contractor will be expected to perform automated scans and continuous monitoring activities which may include, but will not limited be to, authenticated and unauthenticated scans of networks, operating systems, applications, and databases and provide the results of the scans to the Contracting Officer’s Representative (COR), or allow the COR to run the scans directly.

Is it the Government's intent for the Contractor to host IT tools/infrastructure in support of the OPM facility at the Contractor Facility? Can the Government provide some additional data regarding the size, type, and general specification of the systems to be hosted?

The contractor must be able to provide access to but is not required to host infrastructure.

Attachment 4 / Part 2 / 1752.224-76

127 COMPLIANCE WITH INFORMATION PROTECTION REQUIREMENTS

(APR 2015)

As this is a big commitment and establishes full compliance with any request from the Customer in regards to all aspects of IT Security, will the Contractor be provided advance notice?

73 Yes.

Attachment 4 / Part 2 / 1752.239-81

138-139 Contractor personnel performing work related to IT security are required to complete specialized IT security training based on the role-based requirements listed below…" and "The ISSO and Information Security Specialists must be a CISSP within 6 months of contract award..."

Will this be required specifically for an individual assigned to this contract, or if we have a person certified within the company will that meet this requirement?

74 A person certified within the company who is performing tasks specified in the SOW can be a person coming from within the company. However, OPM should have input to the appropriateness and level of work/involvement by existing personnel.

Attachment 4 / Part 2 / 1752.239-86 / a

137 The Contractor will be expected to perform automated scans and continuous monitoring activities which may include, but will not limited be to, authenticated and unauthenticated scans of networks, operating systems, applications, and databases and provide the results of the scans to the Contracting Officer’s Representative (COR), or allow the COR to run the scans directly.

If the Contractor does not operate a system, will there still be an expectation to provide scans?

75 OPM does not require the contractor to perform or provide IT system security scans if they are not operating an information system that handles OPM, data, or an information system that accesses OPM networks.

Attachment 4 / Part 2 / 1752.239-86 / b, c, d

137-138 All Contractor systems must … Is "all contractor systems" defined as only those associated to the OPM CRU Contract work?

76 Yes.

L.6 Encourage the Government to increased the number of pages for the Technical to 200. Frankly, with all of the SOW specifications and numerous Staffing Plan discussion requirements, it will be very difficult to limit our response to just 50 pages. Typically our staffing plan, training, plan, quality control plan, etc., are individually in excess of 20-50 pages. Without an increase in the page allocation, the Government won't be getting an in-depth and comprehensive response.

77 RFP revised at section L.

L.6 160 prior experience/past performance please confirm what experience the government is looking for: similar or specific investigation support experience.

78 RFP revised at section L.

L.6 157 "Table Font" Can the government confirm that Times New Roman font should be used for tables and graphics?

79 Yes.

L.6 157 References are available for review in the reading room by appointment at: On what date will access to the reading room begin? 80 Reading room access can be coordinated as of the date the RFP was issued by OPM.

L.6 (3) iv. (Staffing Plan)

160 Key Personnel Clarification This requirement indicates that Trainers and the FSO are considered Key Personnel as part of Start-up but not key as defined in H.4. In H.4 the FSO is listed as key personnel.

Can the government provide clarification on which positions are considered Key Personnel for the technical proposal submission?

81 RFP revised. Reference the response to question number 66.

L.6(c)(4) 161 A list of the most recent three (3) Contracts and subcontracts completed during the last three (3) calendar years that most closely relate to the work specified in this SOW.

A list of the most recent three (3) Contracts and subcontracts completed during the last five (5) calendar years that most closely relate to the work specified in this

SOW.

82 RFP revised at Section L.

L.6(d) 164 Volume estimates are provided below. These estimates are based on agency's projected volumes and historical data. These estimates are only to give the bidder to provide some idea of volume by product type. These estimates are only to provide some idea of volume by case type. These are not guaranteed volumes and in no way predict future volumes.

Please provide the forms referenced in the Volume Estimates table in the Item Types/Products column.

83 RFP revised at Section L.

L.6(d) 164 Table The provide table does not provide workload estimates.

Does the Government intend to fully till in the table prior to final RFP release?

84 RFP revised at Section L.

L.6c(3)(v) 160 Provide the following proposed locations: Training location, location of facility that will hold case notes and case related material, and data center. Provide if you currently operate within the facility. If so, please provide if your facility is in compliance with the OPM-FIS Security Manual, as it relates to inspections (Refer to Appendix B for a summarized list);

Our understanding is that training currently takes place on Government site. Would the Government please clarify what the purpose is for a "data center" in the following statement.

"Provide the following proposed locations: Training location, location of facility that will hold case notes and case related material, and data center."

85 RFP revised throughout.

L.6c(3)(v) 160 Provide the following proposed locations: Training location, location of facility that will hold case notes and case related material, and data center.

Can the Government please describe the intention behind the data center? Are there physical requirements such as power, CPUs, up-time, backup requirements, failback plan, etc.? What is the classification level of any data to be held at the data center?

86 Refer to question number 85.

L.6c(3)(v) 160 Provide the following proposed locations: Training location, location of facility that will hold case notes and case related material, and data center.

It is the Contractor's understanding that contract training previously happened on the Government facility. Can the Government please provide an explanation on the type of training to occur at the Contractor facility, duration, frequency, and classification level?

87 Refer to question number 85.

L.6c(3)(vi) 160 Respondents are asked to specifically outline the training/qualifications of the identified staff. The training/qualification standards for personnel operating in this capacity for OPM are outlined in C.3 [Training].

The RFP indicates: "Respondents are asked to specifically outline the training/qualifications of the identified staff".

Please clarify what is meant by "identified staff".

88 RFP revised at Section L.

L.6c(4) 160 In this section, please submit the information requested below for both the offeror and proposed major subcontractors

Prior Experience/Past Performance. Please define the criteria for being deemed a "major subcontractor".

89 RFP revised at Section L.

L.6c(4) 160 In this section, please submit the information requested below for both the offeror and proposed major subcontractors

We assume major subcontractors may be described when providing information for the Government to evaluate prior experience. Are citations required for major subcontractors when evaluating Past Performance, or for the prime contractor only?

90 RFP revised at Section L.

M (M.1 and M.7) Pages 180 and 183 M.1: For this Indefinite Delivery/Indefinite Quantity (ID/IQ), the Government anticipates making a single award, dependent upon the quality and competitiveness of the proposals received.

M.7: In accordance with FAR Part 15.101-1 and FAR Part 15.3 a best value award will be made to the responsive responsible offeror whose proposal is evaluated most advantageous to the Government.

Summit proposes the contract language be amended, as follows:

M.1: “the…