HSPD-12_CSA_Solicitation_QTA0016LYA1005_-_Questions_and_Answers_-_Amendment_2.xlsx
XLSX spreadsheet 132 KB Posted
- Attached to
- HSPD-12 CORE SERVICES ACQUISITION (CSA)
- Solicitation number
- QTA0016LYA1005
- Issued by
-
GSA Federal Acquisition Service
About this file
HSPD-12 CSA Solicitation QTA0016LYA1005 - Questions and Answers - Amendment 2
View the file
Other files
Show all 31
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Questions and Answers
| QUESTION No. | RFP SECTION | PAGE | QUESTION | ANSWER | |
| 1 | Section B | B-22 | 0012 (Derived PIV Service Price). Will the Government confirm that no card issuance is required for the derived PIV service? Card issuance is identified in table B, we believe this is an oversight. | PIV card issuance is required before Derived PIV credential is issued by USAccess | |
| 2 | Section B | B-22 | The Schedule B CLIN Table lists Transition Milestones in CLINS 0011A-0011D however these milestones are not reflected anywhere in the PWS. Can the government just make this all a single CLIN? | No. The government chose this mechanism to allow more definitive transition plans and progress payments. | |
| 3 | Section C | C-9 | C.5.2.1.8 references Attachment N. However, no attachment N is included with the solicitation. Will the Government provide Attachment N. | RFP has been updated. The correct attachment is Attachment L. | |
| 4 | Section C | C-12 | Item F references Section C.5.6 of the RFP. However, there are two sections labeled C.5.6. Will the Government clarify the section labeling by relabeling the second of these C.5.7? | Relabeled | |
| 5 | Section C | C-21 | C.5.9.2 “The contractor shall conduct ILT in-person or via webinar”. Will the Government provide the webinar service? Alternatively, should offerors include the cost of the webinar service in their proposals? If so, can you identify which CLIN to bill under? | The government expects the contractor to provide the webinar service and shall include pricing in their proposal under CLIN 6. | |
| 6 | Section C.5.2.1.10 | C-9 | It is stated that the contractor is to “Maintain, at a minimum, separate environments that allow for, development efforts…” Is this intended to describe the contractor’s own development environment or a development environment to be accessible by GSA or its customers? | The government intends that the development environments encompass the contractor's own development environment and be openly accessible to GSA and its customers. | |
| 7 | Section C.5.2.1.10 | C-9 | It is stated that the contractor is to ensure “All environments shall be functionally identical to prevent unknown flaws causing issues in Production”. How is it expected that development and UAT environments be functionally identical to training and production environments if these environments are intended to be used to develop and test new functionality prior to release to production? | It is expected that the contractor maintain updated functionality with each release or system change, to include software versions and hardware characteristics. The government recognizes that it is not possible to create exactly identical environments for each of these modes throughout the development process. The intent is to prevent rework due to errors caused by dissimilar environments. | |
| 8 | Section F-6 | F-14, 15 | The expectation that the offerors key personnel would be limited to one change total per year for a contract spanning a decade seems unrealistic and unusual. The duration of the contract makes it especially hard for an offeror to foresee the variety of events that could impact key personnel on a personal and professional basis. Because of the penalty noted by the government this places unnecessary reluctance on the part of the offeror’s willingness to bid the best qualified personnel for fear of the large penalty should unforeseen life events occur to more than one key personnel in a year. Given this, would the government consider removing the penalty while still addressing the governments concern by evaluating the offerors record on key personnel turnover in the past performance section? | The Government recognizes this difficulty and has adjusted the RFP. Contractors should keep in mind that high turnover rates have detrimental effects on programs. | |
| 9 | Section C.5.2.3.1- H | C-12 | “The contractor’s solution, whether cloud-based or hardware-based, must work harmoniously with existing Customer Agencies’ middleware.” | ||
| Please confirm this is in reference to APL PIV Middleware which conforms to NIST standards and testing. | This refers to APL PIV middleware. This ensures Customer Agencies do not have to invest further to manage existing credentials. | ||||
| 10 | Section C.5.2.4 & B | C-14, B-7 | The solicitation makes several references to Credentialing Infrastructure components- including, “credentialing workstation”, “credentialing equipment”, “Enrollment / Activation Station”, Fixed, Mobile, Shared, LCS, LAS, streamlined lightweight activation, etc. We understand all credentialing equipment must be provided new by the contractor. |
Can the government confirm that the components of the Credentialing Infrastructure to be provided are the following;
1. Fixed Stations (can be shared or dedicated- stay in single location)
a. APL approved: 10 print fingerprint capture station, document scanner, camera, backdrop, software, hardware, PIN pad, smart card reader, Single-fingerprint for 1:1 authentication
2. Mobile Stations (can be shared or dedicated- can be shipping and moved)
a. APL approved: 10 print fingerprint capture station, document scanner, camera, backdrop, software, hardware, PIN pad, smart card reader, Single-fingerprint for 1:1 authentication (same station and pricing as Fixed)
3. Light Activation Kits
a. Activation and Post Issuance Activities; small and lightweight including CMS middleware, APL PIV Middleware, and single-fingerprint for 1:1 authentication, smart card reader
| If the above is correct Can the government please include a CLIN for Light Activation Kit pricing? | The Government has added a CLIN for the light activation kit described in the RFP and the shipping container for mobile stations. Fixed and mobile stations shall be functionally identical and consist of the following APL-approved peripherals: fingerprint capture station, document scanner, camera, backdrop, software, hardware, PIN pad, smart card readers, PIV middleware, CMS middleware. This ensures Customer Agencies do not have to invest further to manage existing credentials. | ||||
| 11 | Section C.5.2.4 | C-15 | “The contractor shall provide onsite maintenance (break/fix) for fixed and mobile stations within 24 hours of the service request. If the technician is unable to fix the equipment, the contractor shall send replacement equipment to the site within 48 hours.” Is this for transition or steady state? Additionally, can the government clarify that the onsite maintenance is only required after Help Desk problem identification and troubleshooting is unsuccessful? Will the government accept 48hr equipment replacement after Help Desk troubleshooting has identified that new equipment is required? | This is for steady state. The Government accepts that Help Desk troubleshooting is a necessary first step prior to incurring a 48-hour equipment replacement timeframe. The Government updated the RFP to allow the Help Desk 24 hours to troubleshoot before the 48 hour equipment replacement timeframe begins. | |
| 12 | Section C.5.2.8 | C-19 | “The contractor shall use the card data model in use by USAccess at the time of award.” |
Is this sentence related to PIV-I or Temporary credentials? Can the government confirm that the card data model in use will adhere to standards for interoperability and not contain proprietary information or methods?
| If related to PIV-I can the government confirm that the PIV-I card data model is defined by the Federal CIO Councils “Personal Identity Verification Interoperability For Non-Federal Issuers” the relevant NIST and industry standards as well as the Federal PKI Policy Authority? | This is in reference to both PIV-I and Temporary Smart Cards. USAccess will use the PIV-I data model as defined by the Federal CIO Council. | |||
| 13 | Section C.5.2.12 | C-23 | “Certificate and card life shall convey and the contractor shall ensure the CA will manage existing, active credentials (including updates and rekeys) and newly issued credentials from the new solution concurrently.” | |
| If the CA is under a separate contract how would the government expect the contractor for core services to ensure the CA continues to operate for existing and new credentials? The CA should continue to operate regardless. Does the government have reasons to believe it will not? | The contractor's solution shall accomodate lifecycle management for all existing and future credentials and certificates. If at a future time, the Government transitions to a new CA, the contractor's solution shall accomodate those changes as well. | |||
| 14 | Section C.5.2.1.8 | C-9 | “Capability to perform back-end attribute exchange (BAE) with PIV Credential Issuers (PCI) external to USAccess. A description of current efforts is included in Attachment N.” | |
| There is no Attachment N, did the government mean Attachment L? Attachment L does not include a description of BAE efforts, does the government mean ONIX description is that using BAE standards? | The Government has updated the RFP. There is no Attachment N, this is in reference to Attachment L. This is a future capability. | |||
| 15 | Section C.4 Scope | C-2 | “All work that the contractor completes at the request or payment of the Government becomes property of the Government, and the contractor shall transfer it to the Government at the end of the period of performance.” |
Can the government please confirm the solution provided at the end of the transition is completely owned by the vendor?
| Secondly, please confirm the intent of the government is that any solution which the government will expect to become property of the government will be clearly defined and agreed to by both parties prior to any funding activities to ensure there is no confusion on who owns what. | The government does not expect that any hardware or software will become Government property. The Government will retain data rights as detailed in the Schedule of Deliverables in the RFP. | ||||
| 16 | Section C.5.1.3 | C-7 | What are those items that are routed to support outside normal business? The contractor shall automatically route incoming calls outside normal operating hours to an alternate, on-call person, who shall answer and handle the issues, including weekends and Federal holidays. Tier 1 support shall be available 24x7x365. Tier 1 shall escalate calls to on-call Tier 2 or 3 personnel outside normal business hours as needed. Should the contractor assume calls outside normal business hours would only be for system wide outages? Non-standard business hour support outside of system wide out outages would dramatically increase cost. | The contractor shall not assume that only system-wide outages would be reported outside business hours. The Help Desk Tier 1 will not have 24x7x365 staff onsite. The RFP requires an on-call Tier 1 capability for non-duty hours, which can escalate calls to Tier 2 or 3 as necessary in addition to assisting Customer Agencies. | |
| 17 | Section C, 5.2..13 | C-23 | “The contractor shall provide support for and development of future innovations in the area of identity and credential management throughout the period of performance.” |
As currently written, the evaluation does not encourage innovation at all and relies on the re-use of the processes and methodologies already in place for the MSO customers without establishing benefits for new and innovative features.
| If innovation is a big part of what the government is looking for, how will this be reflected in the evaluation of the as is/to be section of the response? What specific criteria are used to ensure that innovation is judged fairly? | The As-Is documentation was provided to ensure that all offerors are aware of the current system capabilites. The Government is not intending to prescribe contractor's solutions. Offeror's presentation of innovation should include a description of how that innovation will be achieved with the current environment as a baseline. The Government has included CLIN 5 as a mechanism to encourage innovation. | ||||
| 18 | Section C.5.1.1 | C-4 | What level security clearance is required for each position? | GSA requires anyone handling PII to have a minimum of a Tier 2 background investigation. | |
| 19 | Section C.5.2.3.2 | C-12 | SIP Support/Mechanism and OCD: Will GSA provide the all of the WSDLs associated with the “ATTACHMENT_G_SIP_Interface_Document_v3.11.2.docx” document and all other relevant SIP documentation in order to equalize information that the incumbent has and which is necessary for offerors’ proposal response and for the OCD? | The Government expects the offerors will provide a functioning interface for demonstration at the OCD. The interface document (Attachment G) is intended to provide all offerors with standardized information about the data elements Customer Agencies use to interface with USAccess. The Government does not intend to dictate the mechanism for using that interface. | |
| 20 | Section C.5.2.3.2 | C-12 | SIP Support/Mechanism and OCD: Can GSA provide the SIP Interface Client Tool, which offerors may use as a baseline SIP client in order for GSA evaluators to determine that the SIP Interface presented during the OCD is validated against a known client application? Offerors would need a minimum of 30 days prior to the OCD. | No. The SIP Interface Client Tool was developed by the incumbent and provided to agency customers. All information related to the SIP interface tool has already been provided in the RFP. | |
| 21 | Section C.5.2.3.2 | C-13 | “The contractor’s solution shall provide the capability for USAccess Customer Agencies to pull data, including billing data, for reporting or data provisioning/utilization purposes.” | ||
| Q: Is the pulling of “billing data” a new SIP requirement, and is currently not a feature of the As-Is SIP Interface? | This is a new SIP requirement. | ||||
| 22 | Section C.5.2.3.2 | C-13 | “The contractor’s solution shall provide mutually authenticated web services to allow agencies to manually input Applicant data or to import single or multiple data records related to sponsorship and adjudication functions, and to provision and utilize data.” | ||
| Q: In this automated SIP interface context, how do agencies “manually” input Applicant data? What mechanism is used to manually input this data? | Customer Agencies have the ability to enter data a single record at a time using web portals. Not all Customer Agencies use the SIP. The Government requires that manual input is available as an alternative to SIP. | ||||
| 23 | Section F | F-2, F-9 | Section F-5 identifies two different Transition Plan Deliverables, one for PWS C.5.1.1.1 and one for PWS C.5.2.12. The Instructions for Offerors (L) and Evaluation Criteria (M) only address a single transition plan. Will the Government clarify its intent for Transition Plans deliverables? The deliverable tables lists transition plan twice-can the government please edit the solicitation to clarify that there is only one transition plan deliverable. | Transition Plan deliverable in C.5.1.1.1 was removed. The only Transition Plan is now associated with C.5.2.12. | |
| 24 | Section F | F-12 | The COOP Plan due date is “Draft: Due with proposal.” However, unlike the other deliverables due with the proposal, the COOP Plan is not addressed by Section L or section M. There is no page count, nor any evaluation criteria for the COOP Plan. Is the government looking for the approach to the COOP plan as part of the proposal versus the entire COOP plan? The COOP plan could be a large document that would impact the page count. This is typically a deliverable after contract award, requiring a plan to be submitted prior to contract award seems to give a significant advantage to the incumbent and present a method to reduce or prevent competition. Given this will the government require the COOP plan to be delivered after Contract Award instead of with the proposal? | RFP has been updated. Draft COOP Plan is now due no later than 30 days after contract award. | |
| 25 | Section J.B | J-5 | Will the Government provide a copy of the USAccess Deployment Readiness Guide? | The deployment readiness guide content is incorporated into Attachment B - As-Is documentation. | |
| 26 | Section J.B | J-5 | Will the Government provide a copy of the Deployment Readiness Worksheet? | The deployment readiness worksheet content has been added to the ammended RFP in Attachment B - As-Is Documentation. | |
| 27 | Section J 4 | J-20 | How many users will access each portal? | ||
| How many requests per day with the current system? | There are approximately 30,000 role holders that access the system. There are approximately 3000-5000 transactions a day. | ||||
| 28 | Section J 4 | J-21 | How many transactions per minute during peak load? | ||
| How many requests of each type of transaction occur per day? | There are approximately 600 activations, 400 card destructions, 300 PIN unlock, 200 card replacement (reissue/reprint), 20 card resumes (unsuspend), 70 card suspensions, 300 card terminations, 800 card update/rekeys, and 50 issuance terminations per day. The peak hours for system activity are generally between 9:00 AM ET and 2:00 PM ET. | ||||
| 29 | Section J | J-1 | “Attachment M Minimum Invoicing Data Elements” is listed as an Attachment. However, the actual Attachment M is titled “Sample Customer Agency Invoice.” Does the Government intend to provide an attachment that provides the minimum invoicing data elements? | Attachment has been updated and is now called "Sample Customer Agency Invoice." The sample invoice was updated and now contains the minimum data elements for Customer Agency invoicing. | |
| 30 | Section L.8.1 Factor I, Sub-Factor A, Item 4 | L-5 | It is stated that “The contractor’s solution shall produce a NIST SP 800-157 compliant Derived PIV credential”. Since the test procedures for 800-157 have not been implemented how will solutions be evaluated for 800-157 compliance? | The Government has removed the requirement to demonstrate Derived PIV as part of the OCD. However, Derived PIV does remain a requirement, C.5.2.7, and the written technical proposal will be evaluated based on offerors' response to that requirement. | |
| 31 | Section L.8.1 Factor I, Sub-Factor A, Item 5 | L-5 | It is stated “The contractor shall demonstrate the Temporary Smart Cards being successfully used for physical and logical access for multiple, consecutive users.” The capability for logical access use will be limited in many cases to very select mechanisms. Some mechanisms do not allow for a replacement card to be used for Logical access if the intention is for Windows Smart Card logon or for any web-based mechanism that uses specific attributes of the credential such as certificate serial number or, hash of the public key. This is due to the fact that these attributes will change with a replacement card and will only be operational if there is a change at the relying party end to accept that update. What is the intent of the capability demonstration for logical access, Windows Domain logon or web access? | The intent is to demonstrate logical access for logon and web access and physical access. | |
| 32 | Section M.2 | M-2 & M-4 | Is it the government’s intent to have Requirement C.5.1.1 Management Requirements in its entirety in the Program Management Approach Sub-Factor A PMP and the Technical Approach Sub-Factor B Transition Plan? We recommend that C.5.1.1 in its entirety be evaluated in the Program Management volume and that C.5.1.1-ii. Which relates to the transition plan be evaluated in the Sub-Factor B Transition Plan | Transition Plan deliverable in C.5.1.1.1 was removed. The only Transition Plan is now associated with C.5.2.12. Requirements in C.5.1.1 will be evaluated in the Program Management Approach sub-factor. Requirements in C.5.2.12 will be evaluated in the corresponding sub-factors. | |
| 33 | Section M.2 | M-2 & M-3 | Is it the government’s intent to have Requirement C.5.3.8 Testing in its entirety in the Technical Approach Sub-Factor B Transition Plan and Sub-Fact D Written Technical? We recommend that C.5.3.8 in its entirety be evaluated in the Technical Sub-Factor C Written Technical response to avoid repetition. | C.5.3.8 Testing will be evaluated in its entirety in the Written Technical reponse. | |
| 34 | Section M.2 | M-2 & M-3 | Is it the government’s intent to have Requirement C.5.2.12 in its entirety in the Technical Approach Sub-Factor B and Sub-Factor C? | C.5.2.12 has been updated to include descriptions of Transition Plan (Sub-Factor B) and To-Be and Gap Analysis documentation (Sub-Factor C). | |
| 35 | Section M.2 | M-3 | Can the government confirm that the subsections of C.5.2.1 Minimum System Requirements will also be in the evaluation of Sub-Factor D? | The subsections of C.5.2.1 will be evaluated in Sub-Factor D. The Government will be able to observe these in the OCD, but will be evaluated in Sub-Factor D. | |
| 36 | Section M.2 | M-1 | Will the government provide evaluation point values for Factors I-III and their corresponding Sub-Factors? | No, the Government is not using point values for this evaluation. | |
| 37 | Section M.2 | M-3 | Given Sub-Factor C is 20 pages but based on Attachment B which is 33 pages long, can the government allocate more page count to Sub-Factor C? We recommend at minimum 30 pages. | The Government updated the RFP and is allowing a maximum of 30 pages for Sub-Factor C. | |
| 38 | Section M.2 | M-2 | In the previous SSP, the government identified a 270 day transition period. Is this still the government’s estimate for transition? | The offerors must provide a time estimate for the transition period. | |
| 39 | Attachment B | J-34, J-35 | 5.8.6 Reissuance and 5.8.7 Reprint both list “Lost or Stolen” as a reason for initiating the activity. | ||
| Will the Government clarify the conditions under which a lost or stolen card is re-issued, and the conditions under which it is reprinted? | Reprints and reissues are done at the request of the Customer Agency. It is up to the Customer Agency to determine which activity is appropriate. | ||||
| 40 | Attachment B 5.3 | J-25 | Can the MSO confirm whether a biometric duplicate check is a requested feature? It doesn’t appear in the Credential Process workflow (only a Security Officer document review) but it does appear in other as-is locations (such as Security Officer duties in Attachment B 3.2.4) | The Government is amending section C.5.2.2 paragraph 2 to specifically include a requirement for biometric duplicate checks. | |
| 41 | Section C.5.2.18 | C-10 | The government states that the initial refresh of all credentialing equipment during the transition period is to “ensure that all credentialing infrastructure equipment is new and there is not a mix of old and new equipment in the field.” Will the government confirm that the offeror must include new card printers (45 referenced in the PWS) and new shipping cases? | The Government does not intend for the existing card printers (approximately 45) to be replaced during the initial technology refresh during the transition period. The Government will work with the contractor to determine if peripherals, including printers, need to be replaced during the Option Period 5 technology refresh. shipping cases will be included with new printers that are delivered. | |
| 42 | Attachment H | J-74 | Is the bulk upload pdf and/or excel? | Bulk Upload is currently a CSV file, however, the Government does not dictate the method the contractor should utilize for this requirement. | |
| 43 | Attachment L | J-89 | “The Temporary cards have PIV card data elements and certificates that become part of the key history on the PIV card. Treasury is participating in this proof of concept.” | ||
| Has the government verified with the FPKI Policy Authority that placing a PIV Authentication certificate and key histories on a temporary credential that is not personalized/does not resemble a PIV is allowed? | Certificates for Temp cards will have non-PIV OIDs. | ||||
| 44 | Attachment L.8.1 #6 | L-6 | How will the MSO evaluate the bidders regarding the SIP? We recommend that the MSO provide all bidders with the SIP test client (that is currently available to the USAccess agencies during their SIP on-boarding). This test client tests each of the SIP methods – it would be an independent and consistent method to evaluate all bidders. | No. The SIP Interface Client Tool was developed by the incumbent and provided to agency customers. All information related to the SIP interface tool has already been provided in the RFP. | |
| 45 | Attachment O | J-92 to J-94 | The section states “The following is the graphical representation of the USAccess PIV card topology. Mandatory items are in red font, optional items are in green font and items that are not available are in black font.” | ||
| However the color-coded graphical representation is inconsistent with the table on J-92 and J-93. Will the Government confirm where the two are inconsistent, that the table is correct, and graphical representation is not? | The diagram and table have been updated in the RFP. | ||||
| 46 | Attachment G – SIP Interface Document, Appendix D – Query SIP Parameters | 35 | The SIP documentation is incomplete. The QuerySIP method response is truncated. Please provide the corrected list of QuerySIPResponse results and the complete SIP documentation. | The Government updated the SIP interface document in the ammended RFP. | |
| 47 | C.5.2.12 | C-23 | The government mentions minimizing “rework” in the transition stage. Will the government clarify what they mean by rework for transition? | Re-engineering of Customer Agency development efforts for existing integrated systems. | |
| 48 | C.5.2.9.2 | C-21 | The government mentions both a Contractor provided Web-Based training tool as well as the GSA online learning tool GoLearn.gov. | ||
| Can the government confirm that both tools would contain the same training material but that the Web-Based tool is for remote users that are outside of the GSA Network and cannot access GoLearn.gov? Can the government provide estimated populations for both tools? | The government is providing a revised version of this section, which will distinguish between the WBT environment to be provided by the contractor for role-based training and practice skills, and content for the MSO to use in its online learning system, OPM's GoLearn system. | ||||
| 49 | L.8 | L-2 | Can the government provide a timeline estimate on when OCD’s will be scheduled in relation to final proposal submittal? And also how much notice will the government give contractors before OCD scheduling? | The Government will schedule OCDs no later than 5 business days after the proposal due date. It is anticipated that OCDs will take place approximately 4-5 weeks after proposals are due to the Government. | |
| 50 | Attachment B - 2.2.1 | J-6 | The solicitation mentions “Identify the number of Enrollment/Activation Stations to be deployed to each site and whether a particular site will be a “Shared” or “Leased” (aka, “Dedicated” Center).” It is our understanding that “dedicated” and “leased” are 2 different terms (not one). A “dedicated” site is a site that is not shared outside that Agency or Component within the shared service, and is noted as such in the scheduling tool. A “leased” site isn’t a site at all, rather an enrollment station owned by GSA (and managed by HP). Can you please clarify this terminology? Combine with other activation, enrollment, how does it impact writing, pricing, CLIN, etc.? | The Government has updated the RFP to remove all references to "leased" stations. The terminology referred to is from the As-Is section of the RFP. Going forward, the Government will only have shared and dedicated stations. | |
| 51 | Section B tables | COOP plan-Can the government provide perspective offerors the current GSA COOP plan? | The COOP Plan is dependent on the contractor's specific solution. The COOP Plan will be developed and delivered by the contractor. The Government will not provide the current contractor's COOP Plan. | ||
| 52 | L.7 | L-1 | Will the government allow Appendices that are not considered in the page count? | Any appendices over and above the page count will not be evaluated. | |
| 53 | L.7 | L-1 | Can the government allow a compliance matrix that is not considered in the page count? | Yes. The RFP was updated to allow contractors to supply a compliance matrix that is not included in the page count. | |
| 54 | L.7 | L-1 | Will the government extend the Transition Plan page count to 30 pages? | Yes, the Transition Plan page count is now 30 pages. The RFP was updated. | |
| 55 | B and Attachment D | In Attachment D the government lists the current credentialing infrastructure footprint. | |||
| Can the government confirm Attachment D contains the list of all of the credentialing equipment for refresh during transition? If it does not can the government please provide the complete list of credentialing infrastructure by type, location and agency? | An updated credentialing infrastructure list to include agency, type, and location was included in the amended RFP. | ||||
| 56 | Sub-Factor C | M-3 | The government identifies innovation and best value as major objectives for this procurement. Yet the government requires the as-is Attachment B to remain the same. | ||
| Will the government allow for innovative approaches to items in Attachment B As-Is? If so, can the government clarify where these approaches should be placed in the written response and update the evaluation criteria accordingly? | The purpose of the As-Is documentation is to provide a baseline for the required functionality and current state of the Program. It is not the Government's intent to prescribe contractors' solutions. Innovative approaches to items in the As-Is documentation are encouraged. Descriptions for the To-Be and Gap analysis were added to the amended RFP to clarify where this innovation should be placed. | ||||
| 57 | Section J | General | Will the government provide a list of Agencies that use the SIP interface and the specific methods they use it for? | The Government can provide a list of Customer Agencies that use the SIP. The specific methods by which Customer Agencies use the SIP changes frequently. All instances of SIP should be built to the standard and the data elements contained therein should be the same no matter what each Customer Agency is using. | |
| 58 | L.8.1 | L-6 | For the SIP demonstration the government states that “the solution must be live and operational, not a mock up.” |
How does the government expect offerors that are not the incumbent to demonstrate this without access to a live Agency system currently using the SIP?
| Is there a customer Agency willing to provide SIP interface access for this demonstration? | The response to this question will be provided with Amendment 3. | ||||
| 59 | J | J-89 | With regards to ongoing PIV-I efforts, how many PIV-I credentials has the MSO Program issued? And how many does it anticipate throughout the first year of this contract? | USAccess is in the proof of concept phase for PIV-I. It is anticipated that about 500 PIV-I credentials will be issued during the proof of concept phase. The Government anticipates approximately 12,000 - 15,000 PIV-I cards to be issued during the base year of this contract. | |
| 60 | L.8.1 | L-3 | On several occasions the government has referred to the SIP interfaces as proprietary to the incumbent contractor. While we understand SIP is a requirement and must be addressed in the written response, as well as delivered in transition, how does the government expect contractors to demonstrate a “live and operational” version of the SIP based on Attachment G only which is incomplete? And how can the government evaluate this element of the OCD without bias? | The SIP interface itself (Attachment G) is not proprietary. The Government does not require that the SIP demonstrated in the OCD be in Production, however, it needs to be a functioning version of the interface. The updated Attachment G contains all SIP interface information. The evaluation team will consider the best value for the Government and incorporate the factors that are included in the RFP. | |
| 61 | Section J, Attachment G | All | The SIP Interface Document does not provide details of the WS-Security configuration required. The offerors need the WSDLs for the two web services as well as an existing sample client implementation to adequately demonstrate the SIP. | ||
| Will the government provide these? | The sample client implementation was provided to agencies by the incumbent and cannot be provided by the Government. The Government expects that an offeror will be able to use the provided interface specification to produce a product with SIP capability. | ||||
| 62 | Section J, Attachment G | All | To ensure that the implementation of the SIP web service is seamless to existing service clients for demonstration, we would need an existing Customer Agency that uses the SIP interface to confirm interoperability. | ||
| Will the government provide this? | It is not necessary for the system to be in Production or for there to be a live Government customer for the demonstration. | ||||
| 63 | Attachment G | All | The SIP Interface Document does not include support for features like PIV-I, Derived PIV and Temporary Credentials which are also to be demonstrated at the OCD. | ||
| Can the government confirm that if the SIP interface is to be demonstrated at the OCD, that it would include these functions? | The Government does not intend to include PIV-I, Derived PIV and Temporary Credentials in the SIP portion of the OCD. | ||||
| 64 | Section C, 5.2.3.2 | C-12 | |||
| 44 | “The contractor’s SIP solution shall provide the ability to create and update all applicant record types, look up current credential status, and look up any records with modifications” |
"The SIP must maintain the data structure, business rules and transaction capability that exist in the current USAccess system."
| Please clarify what capabilities are required through the SIP interface. | Both statements cited are accurate. One relates to the capabilities and the other to the conditions under which the capabilities are delivered. The capabilities are create, update, query, delete, as described in the SIP interface document - Attachment G. | |||
| 65 | L.8.1, 6 | L-6 220 | “This demonstration shall clearly show bi-directional data flow based on the specifications provided in the PWS.” |
The PWS does not list an explicit list of service methods that must be implemented, so it isn’t clear what methods need to be demonstrated in the OCD
| Without information on what SIP methods are required in the PWS, let alone the OCD, and without access to a system using the SIP interface currently or access to SIP tools; how will the government fairly evaluate non-incumbent and incumbent contractors for this OCD demonstration? | The Government expects the contractors will provide a demonstration of their SIP offering. The evaluation team will consider the best value for the Government and incorporate the factors that are included in the RFP. | ||||
| 66 | Section J, Attachment L, L.8.1 | L-6 220 | Depending on the availability of the missing pages of the SIP Interface Document, the WSDLs and the sample service client application, the offeror would need sufficient time to develop and demonstrate a replacement SIP web service that would provide a seamless transition for existing customers. Will the government provide the appropriate amount of time to the vendors to prepare for the OCD after all material is provided? | The Government has provided an updated Attachment G that includes all information. Please see above regarding the WSDLs and sample service client application. The Government will schedule OCDs no later than 5 business days after the proposal due date. It is anticipated that OCDs will take place approximately 4-5 weeks after proposals are due to the Government. | |
| 67 | C.5.2.8 & Attachment U | C-19, Pricing Scenario Tab - CLIN 9A-9G | For PIV-I, can the Government confirm that the vendor is to supply both the physical card body, as well as, the PKI certificates used for the PIV-I card, so as to allow for a complete solution? We believe this would provide cost benefits to the Government. | No, The Government intends to continue to provide card stock and certificate services via separate contracts. | |
| 68 | C.5.2.8 & Attachment U | C-19, Pricing Scenario Tab - CLIN 9A-9G | For PIV-I, if the vendor is not to supply the card body, can the Government provide the vendor’s make, model and version of cards that will be supplied for use in the PIV-I solution? | USAccess uses Oberthur ID One PIV v2.3.5 Cosmo V8; ID One PIV (Type A)Large D (V7), as well as compatible with future versions of these cards as specified in the RFP. | |
| 69 | C.5.2.8 & Attachment U | C-19, Pricing Scenario Tab - CLIN 9A-9G | For PIV-I, if the vendor is not to supply the PKI certificates, can the Government provide the name of the CA Shared Service Provider that will be used along with all necessary technical specifications for the interface for these services to allow for the vendor to price the proposed solution? | The current PKI certificate CA Shared Service Provider is Entrust Managed Service. | |
| 70 | C.5.2.8 & Attachment U | C-19, Pricing Scenario Tab - CLIN 13A-13G | For the Temporary card, can the Government confirm that the vendor is to supply both the physical card body, as well as, the PKI certificates used for the Temporary Card, so as to allow for a complete solution? We believe this would provide cost benefits to the Government. | No, The Government intends to continue to provide card stock and certificate services via separate contracts. | |
| 71 | C.5.2.8 & Attachment U | C-19, Pricing Scenario Tab - CLIN 9A-9G | For the Temporary card, if the vendor is not to supply the card body, can the Government provide the vendor’s make, model and version of cards that will be supplied for use in the PIV-I solution? | USAccess uses Oberthur ID One PIV v2.3.5 Cosmo V8; ID One PIV (Type A)Large D (V7), as well as compatible with future versions of these cards as specified in the RFP. | |
| 72 | C.5.2.8 & Attachment U | C-19, Pricing Scenario Tab - CLIN 9A-9G | For the Temporary card, if the vendor is not to supply the PKI certificates, can the Government provide the name of the CA Shared Service Provider that will be used along with all necessary technical specifications for the interface for these services to allow for the vendor to price the proposed solution? | The current PKI certificate CA Shared Service Provider is Entrust Managed Service. | |
| 73 | C.5.2.8 & Attachment U | C-19, Pricing Scenario Tab - CLIN 9A-9G | For the Temporary card, it is suggested that a PIV Authentication certificate can be used. Has the Government determined that this meets FPKI Common Policy and is in line with the letter and intent of FIPS 201-2? | Certificates used for the Temporary Card solution contain non-PIV OIDs. | |
| 74 | Attachment U | Pricing Scenario Tab CLIN 4A-4H | For the opt in credentialing should we assume this is a full credentialing/enrollment and issuance system with local printing capabilities similar to how other federal agencies currently perform printing and issuance in a single visit? Basically, is this a Fixed Enrollment station with local printing capabilities added to it (printer and software) instead of a station that is only used for printing? | The government is not dictating what form-factor the local printing capability should have. Local Printing stations are currently full enrollment/issuance stations (currently laptop based) that also have the capability and equipment to print cards. They can be mobile or fixed stations. | |
| 75 | C.5.2.12 | C-23 | Given that all offerors must replace the entire credentialing infrastructure; can the government provide information or details on the plan for Transition Out and decommissioning of existing credentialing equipment? | The Governemnt will negotiate with the incumbent the decommissioning of existing credentialing equipment. | |
| 76 | C | C-14 | Can GSA confirm that no existing ATO is required for this opportunity but that all offerors are required to obtain an ATO at a HIGH categorization until FedRAMP HIGH is available? | No existing ATO is required for this opportunity, however, no Production data will be provided to the contractor until an ATO at a HIGH categorization is obtained. | |
| 77 | C | C-14 | “The system is required to obtain and maintain a GSA Authority to Operate (ATO) at Federal Information Processing Standard (FIPS) 199 Security Categorization of HIGH or Federal Risk and Authorization Management Program (FedRAMP) HIGH (when available).” However Section C.5.5 states, “The contractor shall be FedRAMP certified for any cloud-based solution proposed. Prior to receiving any GSA MSO customer data for use in the PROD environment of the system, the Contractor’s end-to-end system will need to obtain an ATO.” | ||
| FedRAMP HIGH baseline is not available at this time. Please confirm that the requirement is for all vendors to obtain an ATO HIGH Categorization through the GSA process and that when FedRAMP HIGH is released offerors would then be required to obtain FedRAMP HIGH certification? | Contractors are required to obtain an ATO at a HIGH categorization prior to receiving any data for use in the Production environment. When FedRAMP HIGH is available, the contractor will be required to obtain FedRAMP HIGH certification. The RFP was updated. | ||||
| 78 | Attachment D | J-40 to J-60 | Will the Government provide the hosting agency for each row listed in the Current Credentialing Footprint of Attachment D? This information is needed for accurate transition planning. | The Government has updated the RFP to include this information | |
| 79 | Attachment D | J-40 to J-60 | It is not clear whether the rows in the Current Credentialing Footprint table correspond to credentialing sites, or individual credentialing stations. Will the Government clarify whether each row represents a site or station? | This table shows all light and fixed sites. Fixed sites typically have one Enrollment and one Activation workstation. Light sites are typically one workstation. | |
| 80 | C.4 | C-2 | “All work that the contractor completes at the request or payment of the Government becomes property of the Government, and the contractor shall transfer it to the Government at the end of the period of performance.” | ||
| We believe this was an oversight on the government’s part, will the government change the language to state that “All work that the contractor completes at the request and payment of the Government becomes property of the Government” | The solicitation will be ammended to include this updated language. | ||||
| 81 | Attachment B | J-5 to J-38 | Attachment B states in the objective that: “All functionality and capabilities described in this As-Is document must be available on day one of normal operations for the successful Core Services contractor.” Attachment B also names specific brand name products within the As-Is Documentation. Specifically: |
• Time Trade (Page J-8)
• LCS Kits, HMS0035A and HMS0035B (Page J-11)
• LA Kit, HMS0043 (Page J-11)
• TIBCO Workflow Engine (J-14)
• ActivIdentity MyDigitalID (J-31)
• ActivClient Middleware (J-32)
| Will the Government confirm that only the functionality and capabilities described in Attachment B are required, and not the specific brand name products? Will the Government confirm that offers’ may propose solutions using products other than those named in Attachment B to provide the required functionality and capabilities? | The functionality and capabilities described in Attachment B are required, however the Government does not intend to prescribe the contractors' solutions. The specific brand name products are not required. Contractors should propose innovative solutions to meeting the required functionality and capabilities described. | |
| 82 | Attachment B |
Section F.5 Section L.8.1 Section M.2 J-5 F-9 L-7 M-3 Will the Government clarify what is required for the Gap Analysis deliverable that responds to Sub-Factor C? Specifically, is the Government looking for:
(1) an analysis of gaps between the existing, As-Is state and the offeror’s proposed To-Be solution (to support evaluators in their effort to accurately determine what if any existing functionality or capability is omitted from proposed To-Be solutions), or
(2) A detailed description of specific transition activities required to move from the current (As-Is) state to the future (To-Be) state (to support evaluators in their effort to accurately determine the feasibility and completeness of the transition to these solutions)?
The RFP seems inconsistent, supporting each interpretation in places. Either way, further clarification is needed. If the Government is looking for #1 (as suggested by the term “Gap Analysis” as well as Attachment B “All functionality and capabilities described in this As-Is document must be available on day one of normal operations …”), then the detailed Gap Analysis descriptions for F.5, L.8.1, and M.2 are all misleading and should be updated. Accordingly, will the Government update the detailed descriptions for F.5, L.8.1, and M.2 related to Gap Analysis?
| If the Government is looking for #2 (as suggested by the Gap Analysis descriptions in F.5, L.8.1 and M.2), then there seems to be a fair amount of overlap between the Transition Plan (Sub-Factor 2) and the Gap Analysis (Sub-Factor 3), with minimal page count for each. Accordingly, will the Government clarify and distinguish between the information offerors should provide in the Transition Plan and the information offerors should provide in the Gap Analysis? | Descriptions of the Gap Analysis have been updated in the RFP. The Government is looking for the contractors to provide documentation explaining the differences between the As-Is and the To-Be state. Detailed descriptions of how the contractor will get from As-Is to To-Be should go in the Transition Plan. | |
| 83 | Section L.8.1 | |
| Section M.2 | L-7 | |
| M-3 | Section L.8.1 Sub-Factor C and section M.2 Sub-Factor C both state: “The contractor shall describe in detail how each component of the existing solution, to include all requirements described in this RFP, will transition to the future state over time.” |
This seems to be an error, as the RFP describes requirements for the future state, not the existing solution. The current state is described in Attachment B, but at the level of “functionality and capabilities”, not “requirements” or “components”. Attachment B is organized along 11 dimensions of functionality and capabilities:
• Credentialing Infrastructure
• Roles
• USAccess Portals & Interfaces
• Credentialing Process
• Configuration Management
• US Access Help Desk• Communications
• Training
• Billing Support
• Reports
• Initiatives in Progress Will the government update the text for Section L.8.1 Sub-Factor C and M.2 Sub-Factor C to state “The contractor shall describe in detail how each functionality and capability of the existing solution, to include all functionality and capabilities described in Attachment B, will transition to the future state over time”?
| Alternatively, will the Government provide detailed information regarding each requirement and each component of the existing solution so that offerors have adequate information to respond to the existing RFP instructions and evaluation criteria. | The Government has updated the RFP to include the suggested text for Section L.8.1 and M.2. | ||||
| 84 | Attachment B | J-7 | Will the Government clarify whether the Risk Management Framework Configuration Management Tool is provided by the Government or Offeror. If provided by the Contractor, will the Government provide additional detail about the functionality and capabilities of this tool? | Information about the RMFCM Tool can be found here: NIST SP 800-53 R4 Online Database http://csrc.nist.gov/groups/SMA/fisma/support_tools.html | |
| 85 | Attachment B | J-10 | Will the Government clarify whether the term “IA” as used in “IA Decommission” is an acronym or a typographical error? If an acronym, will the Government clarify the meaning of IA? | "IA" is a misprint | |
| 86 | Attachment B | ||||
| Section C | J-5 to J-38 |
C-1 to
| C-36 | The terms “biometric duplicate check” and “Biometric Duplicate Server” are used 4 times and 1 time, respectively, in Attachment B, but not at all in the PWS. Will the government clarify whether the biometric duplicate check capability is provided by the existing system, or by an external system? | ||||
| If provided by the existing system, will the Government confirm that 1:N biometric duplicate check is a required capability for the proposed To-Be solution? | The RFP has been updated to require 1:N biometric duplicate check as a requirement. The biomentric duplicate check is currently provided by a component of the incumbent's solution. | ||||
| 87 | Attachment B | J-28 | The acronym “CBS” is used. Will the government confirm that the intended acronym is “CMS”? | "CBS" stands for Card Bridge Service which works with a component of the incumbent's solution. | |
| 88 | General | Will you be able to extend the submission date by 45 days to allow offeror’s the time necessary to provide a complete response to the RFP requirements and transition plan? | The submission date for proposals is now June 10. | ||
| 89 | General | Is there a way for vendors to register on this solicitation as an “Interested Vendor”. On some solicitations vendors can see what other vendors are interested in this procurement in order to make strategic alliances or make certain hardware components available to prime bidders. I don’t see that option on the solicitation tabs. | There is a system error on FBO.gov and the option to Allow Vendors To Add/Remove From Interested Vendors or Allow Vendors To View Interested Vendors List cannot be changed. If Vendors are interested in being placed on the list please contact the Point of Contacts listed and your information will be shared as part of Amendment 3. | ||
| 90 | L.6.2 Electronic Submission of Quotations | L‑3 | Would the government please extend the proposal due date three weeks beyond the current due date of May 20, 2016? | The submission date for proposals is now June 10. | |
| 91 | L.8 & M.1 | L 4 & M-1 | In section L.8 and M.1, the solicitation states that |
“The Government will only consider proposals from offerors that have products and services on the GSA FIPS 201 Approved Products List (APL), found here; https://www.idmanagement.gov/IDM/IDMFicamProductSearchPage.”
This language is ambiguous. It can be interpreted as limiting the pool of offerors to those who manufacture the products to be used in their proposed solution, and excluding from the competition offerors who, as part of their proposal, intend to include FIPS 201 APL products manufactured by other vendors.
Is this interpretation correct?
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .