Risk MAP IT OM Industry Day Questions and Answers_9.3.2024.pdf

Question # Topic Area Question Government Response

1 General

Regarding the RAPID IT O&M Support BPA, please confirm, or clarify, that this is the recompete of Risk Mapping, Assessment, and Planning (Risk MAP) Customer and Data Services (CDS) Operations and Maintenance (O&M) Support contract Nos. 70FA6018D00000005 and 70FA6023F00000039.

Scope of Risk MAP CDS will be within the RAPID IT O&M Support BPA.

2 General Has FEMA decided to keep the ‘Operations & Maintenance of legacy applications’ and the ‘Modernize in Place’ scope under one contract?

This requirement is currently anticipated to be a single award IDIQ contract.

However, we are currently in the market research stage and have not determined an Acquisition Strategy yet.

3 General

Maintaining two distinct scopes in a single contract may present challenges with competing priorities, staffing resources with different skill sets, approaches, and cost management. Would FEMA consider splitting the scope of O&M Support and Modernization into two separate contracts?

This requirement is currently anticipated to be a single award IDIQ contract.

However, we are currently in the market research stage and have not determined an Acquisition Strategy yet.

Has FEMA decided on the acquisition strategy - unrestricted, a set-aside for small businesses, or some hybrid approach with some work being unrestricted or set-aside solely for small businesses?

We are currently in the market research stage and have not determined an Acquisition Strategy yet. As such, no set-aside determination has been made

5 General What contracting vehicle does the government anticipate using for the RAPID IT O&M Support BPA?

We are currently in the market research stage and have not determined an Acquisition Strategy yet.

6 General What will be the acquisition strategy for this opportunity be, has it been finalized?

We are currently in the market research stage and have not determined an Acquisition Strategy yet.

7 General Is there any information that can be shared related to Acquisition Strategy? Small Business Set Aside, Full and Open, Single or Multi Award?

We are currently in the market research stage and have not determined an Acquisition Strategy yet. As such, no set-aside determination has been made.

8 General

We believe a small business/8(a) would be in the best interest of FEMA because of their specialized skills, ability to quickly adapt and innovate. It would also help FEMA meet its socioeconomic goals. Small business likely would propose a large business subcontractor and therefore give FEMA the benefits of having both small businesses and large businesses. Would FEMA consider a small business/8(a) set-aside for part of or the entirety of the Risk MAP IT/O&M Support/Modernization solicitation?

We are currently in the market research stage and have not determined an Acquisition Strategy yet. As such, no set-aside determination has been made.

9 General Is there a specific contract vehicle that will be used?

We are currently in the market research stage and have not determined an Acquisition Strategy yet.

10 General What contract vehicle does FEMA anticipate releasing the CDS solicitation under?

Please note the change in name of procurement for future reference. We are currently in the market research stage and have not determined an Acquisition Strategy yet.

11 General Can the government verify if the GSA MAS contract vehicle will be used and timing for Draft RFP release?

We are currently in the market research stage and have not determined an Acquisition Strategy yet.

12 General What contract type does FEMA anticipate using? If hybrid, which objectives would align to each contract type?

We are currently in the market research stage and have not determined an Acquisition Strategy yet.

13 General Does FEMA anticipate issuing a PWS/SOW or SOO for the RAPID IT O&M Support BPA solicitation? The Government plans to share a draft PWS.

14 General Is the government expecting to release a more detailed draft PWS/SOW prior to release of the final RAPID IT O&M Support BPA RFP? The Government plans to share a draft PWS.

15 General Other than the Statement of Objectives (SOO), will industry be provided a DRAFT RFP/SOW for industry to review and comment? The Government plans to share a draft PWS.

16 General

We request that the government consider releasing a draft of the SOO and schedule of deliverables required for invoicing and payment for vendor review and comments prior to the release of the final solicitation.

The Government plans to share a draft PWS.

17 General We recommend that the solicitation include the acceptance process/criteria for or all contract deliverables, including reports, documents and software builds.

We are currently in the market research stage and have not determined an Acquisition Strategy yet.

18 General Will the government be holding 1:1s as described in the RFI?

As deemed necessary, the Government may engage one-on-one with industry based on RFI capability statements submitted.

19 General

Regarding the Proposed Acquisition Timeline for RAPID IT O&M Support BPA, does the date of June FY25 refer to the targeted solicitation release, or the targeted award date?

The solicitation is anticipated to be released in FY25.

20 General Is there a notional timeline on when the RFP will be released and when responses are due? The solicitation is anticipated to be released in FY25.

21 General Is the government able to provide procurement details for the non-IT contracts?

Please refer to government procurement sites for future Risk MAP procurements.

22 General

For CX Priority Projects, can you speak to how FEMA intends to contract these opportunities? Will CX opportunities be separate task orders? Do you plan to use BIC contracts?

Please refer to government procurement sites for future Risk MAP procurements.

NOTE: These questions and answers are provided for information purposes only, and are not considered the final acquisition strategy or terms and conditions of a Request for Proposal.

Risk MAP Information Technology Operations & Maintenance Support BPA Industry Day - June 5th 2024 Questions and Answers

NOTE: These questions and answers are provided for information purposes only, and are not considered the final acquisition strategy or terms and conditions of a Request for Proposal.

Risk MAP Information Technology Operations & Maintenance Support BPA Industry Day - June 5th 2024 Questions and Answers

23 General

We recommend that FEMA consider adding a formal transition-in period to the contract. The CDS scope for transition in would include:

o Transition and of historic data to new Contractor system o Turn-over of all Government keys, ID/access cards, and security codes o Transfer of hardware and software warranties, maintenance agreements and licenses o Access to systems, software and technical documentation within 5 days of project start to allow for review and knowledge transfer between incoming vendor support and outgoing vendor o Transition of access and license accounts to the 40+ CDS managed applications o Transfer of all necessary business and/or technical documentation o Orientation phase and program to introduce FEMA RAPID and Contractor personnel, programs, and users to the Contractor's team, tools, methodologies, and business processes o Transfer of Government Furnished Equipment (GFE) and Government Furnished Information (GFI), and GFE inventory management assistance.

o Phased requirements for onboarding and staff up resources to support the project.

Government acknowledges and will consider.

24 General

What is the anticipated transition duration from Risk Mapping, Assessment, and Planning (Risk MAP) Customer and Data Services (CDS) Operations and Maintenance (O&M) to the RAPID IT O&M Support BPA?

At this time, the government is planning a 90-day transition.

25 General

To enhance competition, we request the government provide an electronic reading room for vendors to review pertinent draft and final solicitation documents and technical documentation and software. We recommend the following be made available in the reading room:

o Draft and final solicitation files o Technical Documentation (RSD, RTM, SDD, ICD, VDD, Master Test Plan, Test Cases/Scripts, Implementation Plan and Installation Guide) o Source Code and database scripts o Product Backlog o Defect Log and Test Results o Historical metrics and list of defects/issues encountered in the last two years o Release Notes, User Manual, and Operations Guide Having these artifacts available is needed for the vendors to accurately estimate the work to be accomplished under this task. Without this, the incumbent as a clear advantage in preparing a proposal.

Government acknowledges this request. The Government plan to include a virtual Reading Library when the procurement is released.

26 General

Since an OpenHazus Interagency Reimbursable Work Agreement for Discovery Phase contract was previously awarded, will the development of OpenHazus be solicited separately than Risk MAP IT O&M Support?

Not at this time. The scope of Open Hazus will be within the RAPID Risk MAP IT O&M Support BPA.

27 General

Is the government considering a separate procurement of the OpenHazus solution to integrate and align with the broader NHRAP program goals and objectives?

Not at this time. The scope of Open Hazus will be within the RAPID Risk MAP IT O&M Support BPA.

28 General

Does the government anticipate any delays with the procurement based upon the current change over and transitioning in key government staff and upcoming election/potential change of administration?

Not at this time. The solicitation is anticipated to be released in FY25.

29 General

Given the future vision for the Risk MAP IT program, would FEMA consider evaluating domain relevance in addition to size, scope, and complexity when evaluating past performances?

Government acknowledges and will consider.

30 General Can the government verify if past experience references will be allowed from teaming partners so FEMA gets the best team? Government acknowledges and will consider.

31 General

Given the Risk MAP IT portfolio complexity, uniqueness of the various system components, and importance of business domain experience, would FEMA consider acquisition methods such as having an oral presentation and/or a technical challenge phase?

Government acknowledges and will consider.

32 General Will the creation of a technical solution and demonstration of that solution be one of the evaluation factors for the Risk MAP CDS O&M RFP?

Government acknowledges and will consider.

33 General Will an oral presentation be one of the evaluation factors for the Risk MAP CDS

O&M RFP?

We are currently in the market research stage and have not determined an Acquisition Strategy yet.

34 General Will the 2024 Risk MAP IT solicitation follow the 2017 solicitation structure including a technical factor with PWS and past performance?

We are currently in the market research stage and have not determined an Acquisition Strategy yet.

NOTE: These questions and answers are provided for information purposes only, and are not considered the final acquisition strategy or terms and conditions of a Request for Proposal.

Risk MAP Information Technology Operations & Maintenance Support BPA Industry Day - June 5th 2024 Questions and Answers

35 General

Industry has concerns of the presence of a significant organizational conflict of interest (OCI) for prime contractors or major subcontractors from contracts GS00Q14OADU113 / 70FA6018F00000058 and 47QRAD21D1010 / 70FA6024F00000004 seeking to bid as prime on a future RiskMAP CDS contract.

Can the government confirm it recognizes this OCI and that the OCI will be cited in a future CDS solicitation?

Government acknowledges and will consider.

36 General Which current contractors will be OCIed out for the Risk MAP IT solicitation?

We are currently in the market research stage and have not determined an Acquisition Strategy yet.

37 Risk MAP Non-IT What is the process to convert the new mapping/engineering requirements into technical requirements for CDS contract implementation?

User and System Requirements will be documented and synthesized following the SAFe methodology.

38 Risk MAP Non-IT

Is development of flood models to inform and educate technical and non-technical stakeholders on flood risk within the scope of FEMA non-IT program?

Or is it part of the FEMA IT program?

Educating stakeholders and users is a Program-level initiative involving both non- IT and IT components.

39 Risk MAP Non-IT Does FEMA envision OpenHazus as a key component of the Future Flood Risk Data (FFRD) initiative?

OpenHazus will serve as a consequence modelling engine that will support myriad hazard datasets to include, FRRD. FFRD will serve as the principle flood hazard dataset within OpenHazus. Both flood hazard data and consequence modelling methodologies will be interlinked between the 2 initiatives to ensure consistency across the Risk MAP Program.

40 Risk MAP IT

Slide 47 indicates there are 200K+ RAM user accounts and 1.1K+ authenticated FEMA and public users. Can the government describe the user-taxonomy and security model between the RAM user accounts and privileged FEMA/public users?

When applicable, this information will be shared during Risk MAP IT O&M Transition.

41 Risk MAP IT

Of the 40 different applications, there are a good number with map functionality.

Understanding that there is a different purpose for each, is there an intent to consolidate some of them during the adaptive maintenance/modernization in place?

Yes, this is part of the Risk MAP IT Modernize in Place activities.

42 Risk MAP IT

Is there a reason there are so many RiskMAP subsites? Is FEMA open to a reduction in the number of sub-applications to improve the customer experience?

Yes, this is part of the Risk MAP IT Modernize in Place activities.

43 What are the top 3 technical issues that the applications are currently facing?

This information will be included in the Risk MAP IT O&M virtual reference library.

44 Risk MAP IT

Has there been any outreach to users for user interviews/user tests to gauge common pain points? If not, does RAPID have plans to work with the different user bases to understand their particular needs and frustrations?

Yes, this information will be included in the Risk MAP IT O&M virtual reference library.

45 Risk MAP IT What qualitative or quantitative data do they have related to customer satisfaction? Can it be shared prior to RFP release?

When applicable, this information will be shared during Risk MAP IT O&M Transition.

46 Risk MAP IT What flavor of Agile do the ARTs follow and is there a preference for any specific methodology?

Risk MAP IT uses Scaled Agile Framework (SAFe) to maintain its systems.

47 Risk MAP IT How is the scope of work described on Slide 94 aligned to the two Agile Release Trains?

Risk MAP IT uses Scaled Agile Framework (SAFe) to maintain its systems.

48 Risk MAP IT Will all applications be migrated to the FEMA Cloud prior to the RFP release?

The Risk MAP RAM System plans to be fully within FEMA AWS Cloud by Fall 2024.

49 Risk MAP IT Do all applications in the cloud use containerization and other modern technologies?

Not yet; however that is part of the Risk MAP IT Modernize in Place activities.

50 Risk MAP IT Is DevSecOps and automation/pipeline management performed by the CDS vendor or is it performed by the OCIO Cloud team?

The scope will be within the RAPID Risk MAP IT O&M Support BPA.

51 Risk MAP IT

It is our understanding that the previous work under CDS in support of the RiskMAP program included some software components that are owned by/proprietary to the incumbent developer, such as IBM Aspera. Can FEMA provide a list of what proprietary software is in use? Will the complete baseline of software be made available to the awardee or will accommodations need to be made for the vendor to provide the functionality associated with proprietary software?

Yes, this information will be included in the Risk MAP IT O&M virtual reference library.

52 Risk MAP IT Are there existing SLAs on the applications?

This information will be included in the Risk MAP IT O&M virtual reference library.

53 Risk MAP IT What are the uptime and accessibility requirements?

Yes, this information will be included in the Risk MAP IT O&M virtual reference library.

54 Risk MAP IT How much data will be uploaded on average every day, week month?

This information will be included in the Risk MAP IT O&M virtual reference library.

55 Risk MAP IT Where will the data sets that support OpenHazus be located?

This information will be included in the Risk MAP IT O&M virtual reference library.

56 Risk MAP IT Does FEMA have an estimate of the data set size that will be accessed by OpenHazus? Are these data sets structured or unstructured?

This information will be included in the Risk MAP IT O&M virtual reference library.

NOTE: These questions and answers are provided for information purposes only, and are not considered the final acquisition strategy or terms and conditions of a Request for Proposal.

Risk MAP Information Technology Operations & Maintenance Support BPA Industry Day - June 5th 2024 Questions and Answers

57 Risk MAP IT Slide 47 indicates there are 33,000 regular users of HAZUS desktop software and mobile apps. Is the client SW thick-client or thin-client / web-based?

This information will be included in the Risk MAP IT O&M virtual reference library.

58 Risk MAP IT How are desktop software application and mobile application updates disseminated to the 33,000-person userbase?

This information will be included in the Risk MAP IT O&M virtual reference library.

59 Risk MAP IT Are the mobile apps available for both android and iOS devices?

This information will be included in the Risk MAP IT O&M virtual reference library.

60 Risk MAP IT Does the Technology Stack described on Slide 50 cover the desktop and mobile apps? Yes.

61 Risk MAP IT What responsibilities does the FEMA Product Owner have for improving CX on the RiskMap IT program?

FEMA Product Owners play an integral role to enhance Risk MAP IT customer experience.

62 Risk MAP IT For the portfolio of applications migrated in 2024 which applications, if any, were rearchitected?

This information will be included in the Risk MAP IT O&M virtual reference library.

63 Risk MAP IT What categorization of ATO is the RAM cloud environment and when is it planned to be granted?

When applicable, this information will be shared during Risk MAP IT O&M Transition.

64 Risk MAP IT Since the RAM system isn’t cloud native what testing is being done to ensure functionality and performance in the AWS cloud environment?

When applicable, this information will be shared during Risk MAP IT O&M Transition.

65 Risk MAP IT Are parallel ops between on-prem and cloud being conducted?

The Risk MAP RAM System plans to be fully within FEMA AWS Cloud by Fall 2024.

66 Risk MAP IT Can the government confirm if it is open to an Agile Release Train Engineer Key Personnel Position? Please refer to draft PWS for Key Personnel requirements.

67 Risk MAP IT Does FEMA intend to use only AWS or also move into multi-cloud environment with Azure and Google Cloud? FEMA is open to consideration that brings best in value.

68 Risk MAP IT

Would FEMA provide information on the services supplied by the FEMA’s Enterprise AWS Cloud services contractor to be consumed by the FEMA Risk MAP IT program.

Yes, this information will be included in the Risk MAP IT O&M virtual reference library.

69 Risk MAP IT

Is there a specific catalog of approved cloud native services available in the FEMA’s Enterprise AWS Cloud that the FEMA Risk MAP IT program must use?

Can FEMA provide a list of those services?

Yes, this information will be included in the Risk MAP IT O&M virtual reference library.

70 Risk MAP IT

Is there a specific catalog of approved DevSecOps CI/CD tools available in the FEMA’s Enterprise AWS Cloud that the FEMA Risk MAP IT program must use?

Can FEMA provide a list of those tools?

Yes, this information will be included in the Risk MAP IT O&M virtual reference library.

71 Risk MAP IT

At the completion of the current Risk Mapping, Assessment, and Planning (Risk MAP) Customer and Data Services (CDS) Operations and Maintenance (O&M) contract, does the government anticipate cloud migration will be completed?

The Risk MAP RAM System plans to be fully within FEMA AWS Cloud by Fall 2024.

72 Risk MAP IT Are there any systems, applications, or services under the Risk MAP CDS O&M Program that require a new architecture as opposed to modernize-in-place?

Not at this time.

73 Risk MAP IT Will Risk MAP IT contractor be supporting/maintaining the OpenHazus system? Yes, this is part of the Risk MAP IT Modernize in Place activities.

74 Risk MAP IT

Does FEMA expect Open Hazus to replace Hazus? Or does FEMA plan to have both running concurrently for the duration of the next solicitation of the Risk MAP IT program?

Yes, this is part of the Risk MAP IT Modernize in Place activities.

75 Risk MAP IT

Legacy vulnerability scanning solutions lack the ability to scan beyond VMs running in the cloud. With the migration to FEMA's AWS Cloud, how will the government conduct security scanning of all workloads now running in the cloud (serverless functions, containers, applications, etc.)?

When applicable, this information will be shared during Risk MAP IT O&M Transition.

76 Risk MAP IT

How is the government considering a new operational model for migration to the cloud? Specifically, is the government open to exploring how security scanning, monitoring, devsecops and more can be consolidated into one platform?

The Risk MAP RAM System plans to be fully within FEMA AWS Cloud by Fall 2024.

77 Risk MAP IT

Recognizing the changes to the mission focus and approach over the past years and into the future, does FEMA see the need to rearchitect and reimplement some of the major existing components of the systems that may require deviation from the strategy to modernize-in-place to achieve optimal results?

Yes, this is part of the Risk MAP IT Modernize in Place activities.

78 Risk MAP IT

Given the complexity and importance of GIS centric system requirements and the vast amount of associated data, does FEMA see the need for a GIS Engineer with minimum 10 years of relevant domain experience as key personnel?

Please refer to draft PWS for Key Personnel requirements.

Sheet1