Planning_Assumptions_TEFCA.pdf

TEFCA RFI Planning Assumptions Use the following planning basis to develop staffing estimates and annual rough order of magnitude (ROM) costs for the draft PWS. These estimates support market research, do not guarantee future workload, and may change in future solicitation.

Planning item Basis for respondent estimates

Estimate period and scope

Estimated Period of Performance: 12-month Base Period plus four 12-month Option Years (5 years total). Provide a separate annual ROM for each of 4.1 (Governing Documents and Caucus Facilitation), 4.2 (Onboarding, Operations, and Implementation), and 4.3 (Compliance, Investigations and Dispute Resolution), and a combined ROM for any combination you propose. State any discount from combining.

Phase- In Show a separate one-time phase-in line for a 30-business day transition from the incumbent.

State assumptions about access to existing systems, data, and documentation.

QHIN workload Assume approximately 11 designated QHINs to support and 1-2 QHIN applications to review annually. Respondents should state assumptions about onboarding effort and network growth.

Governance and meetings

Assume 15-20 major governance document updates annually across the Common Agreement, SOPs, and technical documents. Include routine maintenance and at least monthly Cybersecurity Council meetings under 4.2. Include prep work and report outs including meeting minutes along with 60-minute meetings at the following frequency: QHIN Caucus every two weeks, Participant/Subparticipant Caucus monthly, Governing Council quarterly. Each document update will require public posting and reconciling public comments into revised drafts for review. Assume 2-4 workgroups may be formed annually for specific issues that require more focused discussions.

Investigations and disputes

Assume 2 investigations and 2 formal disputes annually. Based on the anticipated Compliance and Enforcement SOP we expect a dispute can take a minimum of 40 hours.

State the assumed complexity, effort per case, and volume of routine inquiries. Identify shared effort between 4.2 and 4.3 to avoid double counting.

Testing and infrastructure

There are currently 24,500 organizations and over 100,000 sites in the directory, testing and retesting volume depend on implementation schedules which can range from 6-12 months.

Coverage and incident response

Standard 8-hour business day service hours, with after-hours availability for any outages dependent on severity and scale of the outage, and outage and security incident workload.

Include the CISO role when addressing 4.2.

Respondents: Use the supplied workload values and clearly identify additional assumptions, exclusions, and primary cost drivers. If a workload estimate is not provided, respondents should identify the workload they assumed when developing their cost estimate.

Identify the three factors that have the greatest effect on your rough order of magnitude (ROM) cost estimate. For each factor, show how the total estimate would change if that factor increased or decreased by 25%, keeping the other factors unchanged.

Security and ownership: All deliverables produced under the award are the sole property of the United States Government, which retains unlimited rights to these materials, including associated documentation and copyrights, with the contractor retaining no right, title, or interest.

Pricing Basis:

1. Labor. Show full-time-equivalent staff by labor category for each function, including the CISO role described in 4.2.

2. Contract type. State the contract type you assumed for each function (fixed price, cost-reimbursement, time-and-materials, labor-hour, hybrid) and, where work is variable (investigations, disputes, incident response), whether you priced it as a fixed amount or as level of effort.

3. Infrastructure. Show hosting, security assessment, penetration testing, and tooling costs separately from labor, for the directory, public key infrastructure, testing platform, application portal, and website.

4. Government Furnished Equipment such as laptops will not be provided.

5. Government Furnished Resources, assume for the basis of pricing the vendor will use government’s authority to operate (ATO).

6. Place of Performance: Contractor Site

These assumptions are for planning purposes only. They do not indicate the Government’s budget, when a contract may be awarded, or how the work may ultimately be contracted.