Questions and Responses.docx

Questions and Responses, current as of December 4, 2025.

1. Would you kindly confirm if this is an entirely new effort or is there an incumbent currently providing these services? If so, would you please provide the incumbent contract details?

-This is a new requirement, no present incumbent.

2. What will be the contract value for this opportunity?

-This will not be disclosed.

3. Are there any set-aside considerations for this opportunity?

-Set asides will be considered.

4. The RFI indicates that the solution should be air-gapped, but elsewhere notes that it should allow mobile devices to connect to the system “from anywhere.” Those two features are in conflict with one another, so we were hoping for clarity.

-The solution should not connect to the “open” internet. Access will be via PITC and be enabled for entitled mobile users, with EOP generated/supplied encryption keys and PKI certificates which are maintained on-prem. Mobile access is a validated core need.

5. Would the government please confirm how many users you expect to be using the CRM system? For instance, roughly how many people does EOP have managing requests, etc.

-The plan is for 4 teams to participate in the early release phase (OPL Business/Political, IGA, and OLA). Since we don’t know what type of licensing will be invoked (named users, seat licenses, server licenses, enterprise) it’s probably safe to say 50 users for initial pilot and scale up to 300 post pilot

6. Are there any preferred technologies or platforms for the CRM solution?

-Respondents should suggest recommended hardware requirements needed for their solution and government will evaluate.

7. Will the Government provide hardware specifications for on-premises deployment, or should vendors propose them?

- Government does not intend to spec the solution platform. Respondents should suggest recommended hardware requirements needed for their solution and government will evaluate.

8. Could you clarify which source systems the CRM must integrate with?

-As stated, users would connect to the solution via EOP’s Presidential Information Technology Community (PITC) network, whether access was via desktop or mobile. Any needed patches, encryption keys, etc. would likewise be transmitted to the CRM solution via the PITC network (through the firewall and other security controls).

9. Are there any specific security compliance standards (e.g., FISMA, FedRAMP) that the solution must meet?

- Since this will be on-prem, FedRAMP should not be applicable. EOP does not have specific GFI to provide around FISMA, solution compliance would be determined as part of the solution evaluation and ATO process, but I expect a solution would likely be evaluated for at least Moderate level for FISMA compliance given the nature of the solution and the data it would contain.

10. How will data migration from existing systems be handled? Will sample data be provided?

-Government can provide some dummy data if needed; CSV should be fine for bulk uploads but vendors can suggest alternatives for the government to consider.

11. For bulk upload, is there a preferred file format or template beyond CSV?

- Government can provide some dummy data if needed; CSV should be fine for bulk uploads but vendors can suggest alternatives for the government to consider.

12. Should the solution support mobile access in the air-gapped environment? Response Format The RFI specifies a 4-page limit for responses. If our submission exceeds this limit, will additional pages be considered, or must everything strictly fit within the 4 pages?

- As for the last question, the term “air gapped” seems to be creating significant confusion. As stated, users would connect to the solution via EOP’s Presidential Information Technology Community (PITC) network, whether access was via desktop or mobile. Any needed patches, encryption keys, etc. would likewise be transmitted to the CRM solution via the PITC network (through the firewall and other security controls). The main concern is the solution should have no direct connections to the open internet or data transmissions handled outside the PITC network.