Draft_RFQ_Questions_Final.pdf

Number Section/Page Questions/Comments to FBI Government Response

1 15.2.2/page 45

For purposes of Volume B Past Performance evaluation, does the term

"Quoter" include both the prime vendor as well as named subcontractors? Will relevant contracts of named subcontractors be considered by the FBI to be evidence of successful past performance? The term Quoter refers to the Prime Contractor.

2 1.0 / page 2 Can the FBI provide information regarding the current number of tour requests by month or per year?

This question will not be addressed nor is response necessary to submit a response for this requirement.

3 1.0 / page 2 Can the FBI provide information regarding the current tour capacity by month or per year?

This question will not be addressed nor is response necessary to submit a response for this requirement.

4 1.0 / page 2 Can the FBI provide information regarding the anticipated number of tour requests by month or per year?

After implementation, the anticipated number of requests per year is 22,000 visitors. After three years, the anticipated number of requests is 45,000 per year.

5 1.0 / page 2 Can the FBI provide information regarding the anticipated tour capacity by month or per year?

After implementation, the anticipated capacity per year is

18,000 visitors. After three years, the anticipated capacity is

36,000 visitors per year.

6 1.0 / page 2

Can the FBI provide historical information regarding cyclical trends in tour requests (associated with specific political or cultural events, holidays, seasonal highs and lows, etc…)?

Tour request highs and lows correspond with the traditional

DC tourism trends.

7 3.1 / page 3 Can the FBI provide historic tour security check denial percentages?

This question will not be addressed nor is response necessary to submit a response for this requirement.

8 3.1 / page 3 Can the FBI provide an anticipated tour security check approval/denial timeframe?

The FBI anticipates that visitors will be notified of approval or denial within two weeks of submission.

9 3.1 / page 3 Are tour security check approvals associated with a specific tour (date and time) or are tour security check approvals valid for a defined time period? If they are valid for a defined time period please provide that definition.

Security check approvals are associated with a specific date and valid for that date only.

10 8.0 / page 24

The paragraph in section 8.0 defines the base period as two years in length, however the bulleted list in section 8.0 defines the the base period as 17 months. Will the FBI define the base period?

This will be revised to reflect a one year base period in both areas.

FBI STACH RFQ Questions and Comments

11 8.0 / page 24

The FBI has broken this contract into a base period exceeding one year and three 12 month options periods. If it the FBI's expectation that the base period is coincident with the development phase of the project, does that mean that the FBI expects the development phase to take longer than one year?

This will be revised to reflect a one year base period in both areas.

12 3.1 / page 3

Can the FBI provide the list of systems that were evaluated, SaaS and others, in the analysis of alternatives and how it was determined that the

SaaS approach represents the most cost effective and taxpayer-accountable solution? Will he FBI provide the criteria was used to evaluate these systems and how each was scored against the criteria? This information will not be provided, nor is it required to submit a response.

13 3.1 / page 4

In relation to question 13 above, please provide FBI's definitions of

"SaaS" vs "cloud hosted COTS and GOTS solution"? For example, some would define SaaS as a cloud hosted COTS solution, so it would be helpful to know how the FBI defines the key differentiators between these types of solutions?

The FBI has standardized on the definition and description of cloud as prescribed by the National Institute of Standards and

Technology, as described in their document titled "NIST

SP800-145." Please refer to page 2 of said document for definitions/descriptions of the service models. Based on this premise, the FBI is not concerned how the service is delivered. The desired outcome is for the FBI to not have to manage any of the technology stack except for top-level configuration of the user interface and related controls as specified in the solicitation; SaaS is the natural choice for this outcome and also proves to be the lowest cost to the taxpayer.

14 3.2.1 / page 5

CLIN 0001, CLIN 0002 and CLIN 0003 specify the service and development to be provided on a Firm Fixed Price (FFP) basis. Page 5 states that the "portal shall allow authorized users to see the status of usage and costs updated on a daily basis". Regarding costs, is the FBI looking for just the prorated monthly cost based on FFP CLINS or should costs accrued under CLIN 0004 & potentially CLIN 0005 for

T&M based services be included in the reporting here?

The intent of this language is to gain insight in overages in usage/consumption of licenses should the FBI exceed their license usage for a given month.

15 3.3 / page 10

Will the FBI confirm that the SecD XDM Cloud outlined in the diagram is the same network as the FBI's UNET (enterprise unclassified network)?

The SecD XDM service (it is not a cloud), is exposed to the

Internet, and uses the same network connection as UNET, but for this application, will not interface with the internal UNET network.

16 4.4 / page 22 Will the FBI specify if the 99.95% uptime SLA excludes scheduled downtime for maintenance? Yes; for scheduled maintenance only.

Recommend that the FBI host an Industry Day for the STACH contract in order to improve vendors’ understanding of the program requirements. We believe this will also serve to increase efficiencies in proposal preparation, evaluation, and contract award, and ultimately enhance the FBI’s ability to obtain the highest quality services with the lowest risk. This will be taken under consideration.

Recommend that the FBI considers expanding its past performance criteria and allow at least one reference from within the FBI. This will be taken under consideration.

Request clarification on whether the three Past Performance citations are limited to the prime contractor (integrator) or if vendor or sub-contractor past performance may also be included. See question #1 above.

20 3.1 STACH Overview Can the government please clarify STACH-VIC being an unclassified web app is to be hosted on FBINET a classified system?

Confirmed; it is being hosted on a classified system as it represents the best balance of cost, security, and risk mitigation, because of its need to interface with classified systems. In our study, it proved more costly to secure the solution on UNET and also provide a method to interface with the classified systems.

“Authorized FBI personnel shall be able to use their FBI-issued

Smartphone to access the Cloud website or a Cloud mobile application “ No response needed here, ties to next two questions.

What type of Smartphone is it? What OS is it running; i.e. iOS, Android, etc?

The smartphone is currently Android Samsung S5, running

Lollipop version 5.0 build BOG5

3.2 Cloud

Is there a preference between mobile application versus a mobile website?

There is not a preference.

“The CRM shall provide on-line reporting capability/portal that shall allow authorized users to see the status of usage and costs updated on a daily basis”

No response needed here, ties to next question.

Please clarify the ability to view usage and costs? Is this referring to usage and costs associated with hosting or is this referring to data being stored in the solution as part of the business process (i.e. tour costs).

See question 14.

“and only the master account should have access to restore the data should the need arise” No response needed here, ties to next question.

Is the expectation that FBI resources would have the ability to restore data through backups if needed or would this service be provided by the hosting provider upon request?

The cloud service is expected to back up their systems and provide some level of restoration capability in the event of a failure. As per the solicitation, in this case the configuration and logs are more important than the visitor data, since the data lifecycle in the cloud will be so short.

“STACH-VIC shall be required to accomplish the necessary XML

SOAP or REST calls to the Cloud service for retrieving the visitor data, storing it, formatting it in user-configurable XML, comma separated values (CSV), and Microsoft Excel (XLSX) formats, and making it available via a web application for download as well as exposing the data as a service for XML-based machine to machine consumption.”

No response needed here, ties to next two questions.

Please clarify “user-configurable XML”. Is this using standard tags but the users can define which fields to select or is this just retrieving a pre-defined schema that will be defined once requirements are finalized?

Yes.

Please clarify “exposing the data as a service”. This is one (1) service to retrieve (not update) data from STACH-VIC in a pre-defined XML schema?

For this solicitation, the data will be exposed for read-only use. The visitation determination will be entered directly into the vendor cloud.

3.2.4 Cloud Data

Storage, Recoverability, and Deletion

3.3 STACH-VIC

(FBINET Content

Distribution)

3.2 Cloud

3.2.1 Cloud Functions

“The contractor shall configure and maintain the Windows operating environment and the applications necessary to facilitate the content storage and distribution.

No response needed here, ties to next question.

If this is housed in the FBINET, is maintaining the windows operating environment be the responsibility of the contractor or would this be done as regular maintenance of the FBINET by FBI IT resources?

The Windows updates and policy configuration maintenance will be managed by the FBI; the contractor will be needed to ensure the web application continues to function after said updates or changes.

4.2 Cloud Configuration

Support (Onsite

Contractor)

Is the expectation that the resources for sections 4.2 – 4.5 would be onsite full time or available by phone with the expectation that they would be available for onsite support when required? The description of services appear more like offsite call support with the need to be onsite periodically.

Personnel supporting maintenance in referenced sections shall be required to support offsite and respond within required timeframes.

41 3.1 STACH Overview Is the FBI looking for a scalable cloud offering? Not for this application.

3.2 Cloud

What is the customer’s definition of cloud? From the description it appears there will be a “traditional” software installation on virtualized

FBI servers (similar to private cloud) and no public cloud implementation (e.g. running on a FedRAMP certified CRM solution on third party cloud infrastructure). Oracle supports these cloud models as well as a traditional installation.

The FBI has standardized on the definition and description of cloud as prescribed by the National Institute of Standards and

Technology, as described in their document titled "NIST

SP800-145. Please refer to sections 3.2 for the cloud requirements, and 3.3 for the COTS web application to be hosted on FBINET.

3.2.1 Cloud Functions

Is there already a solution in mind? If so, will the FBI specify the CRM product? No

3.2.1 Cloud Functions

Has the Oracle RightNow solution been evaluated? Oracle was not contacted, so either a) our product was evaluated without our knowledge and therefore might not be fully represented, or b) we were not considered but would like the FBI to evaluate our solution with our assistance and support.

This question will not be addressed nor is response necessary to submit a response for this requirement.

15.0 Instructions, Conditions, and Notices

to Quoter Is this a budgeted program?

This question will not be addressed nor is response necessary to submit a response for this requirement.

Section 1.0 “General

Background”, 1st paragraph

The RFQ states “Processes currently in place are not ideal for handling the current amount of requests nor the expected increase”. It would be very beneficial to potential bidders if the government provided additional information and documentation around existing processes and existing information systems being used to support the tour activities.

This question will not be addressed nor is response necessary to submit a response for this requirement.

3.3.8.1 Virtual Server

Environment

Section 3.2 Cloud (p. 4)

Many vendors have solutions that may not be fully FedRAMP certified/compliant at this time, but these vendors have active efforts underway to achieve the necessary certification/compliance. To enable the government to receive a broader range and more comprehensive set of responses, will the government consider solutions which are in the process of achieving FedRAMP certification at the time of proposal submission -- but would have a contractually-mandated requirement to

Full certification and compliance are required at time of submission.

48 Section 4.0 “Tasks” (p.

19)

The set of tasks listed in Section 4.0 does not include any legacy system conversion/migration activities. Will the government require the integrator to perform legacy system data conversion/migration to the new

CRM solution as part of the scope of tasks? If yes, please provide

Conversion and migration activities are not required as no legacy systems exist.

Page 1, 2nd paragraph

Attachment 2 states “ The Federal Bureau of Investigation (FBI) will leverage whenever feasible, cloud services assessed and granted provisional authorization through the FedRAMP process to increase efficiency and ensuring security compliance.” Many vendors are in the process of achieving FedRAMP compliance for various components of their CSP/CRM solution at this time. For example, some vendors currently have a Platform as a Service (PaaS) component that is

FedRAMP Moderate Certified and are in the process of adding other components to this already certified environment. Will the government consider solutions which are in the process of achieving FedRAMP certification (for all components of the proposed solution) at the time of proposal submission -- but would have a contractually-mandated requirement to be properly certified and compliant at time of contract award (vs time of proposal submission) ? See question 47