Request_for_Clarification_Government_FINAL.pdf

Question # Section/Page Question to FBI Government Response Amendment Required

1.0/ Pg. 2

It is clear the government has done significant research on this solution already, as the requirements are already clearly defined. Can the government share which CRM SaaS cloud services were considered/evaluated?

This is not required to submit a response to this requirement. NO

1.0 /Pg. 2

Who is/was the previous incumbent for the current processes? No incumbent, this is new work. NO

2.1/Pg. 3

Can the government please clarify the contract type (T&M or

FFP) for CLIN 005?

CLIN 0005 is no longer part of this requirement and has been removed. YES

3.1 / Pg 3

The overview states that the STACH-VIC will be hosted on DAVE, which is the FBI's secret enclave. Will the government consider architectures where the Saas Cloud piece is hosted in the FBI environment?

The requirement for this solicitation is for the STACH-VIC to be hosted on DAVE. No architetures in lieu of DAVE will be considered. The solicitation is for an existing commercially available, FedRAMP certified CRM cloud SaaS. NO

5.0/Pg 20

The government indicates that individuals performing on this task have a TOP SECRET clearance. Would the government consider waiving this clearance requirement for those personnel performing the Cloud Saas configuration/customization tasks in support of CLIN 003?

TS clearence is required for personnel supporting this contract. NO

13.0/Pg. 35 Attachment A3 (STACH Price Template Attachment) was not included as part of the solicitation documents posted on FBO.

Can the government please make this information available?

As stated in the posting, the Price Template will be attached with the response to the RFC's and any Amendment to the

RFQ that may result from the RFC period. See newly attached A3 price template with this response. YES

15.1/Pg. 42

Would the government consider an extention to the submission date in order for the vendor products to be throughly validated against the requirements? This RFQ will be extended until 2/11/16. YES

15.2.4/Pg. 46

The government is requesting a regular font styple. Can you please calrify if the government considers Arial as a regular font style? Arial is acceptable at a 12 FONT. NO

15.2.4/Pg. 46

Are Margins (headers/footers) exempt from the 12 point font restriction? No NO

16.4.2/Pg. 50

The government indicates that it will evaluate total price. Can you please clarify if we should include pricing for the optional task in this total price

CLIN 0005 is no longer part of this requirement and has been removed. YES

N/A

Would the government consider eliminating the product pricing from the price evaluation criteria? NO NO

N/A

Does the FBI or DOJ have any enterprise-wide licenses available for the CSPs that were evaluated?

This is not required to submit a response to this requirement. NO

15.2.3 Can you please provide Attachment 3. It has not been posted on the FBO website. "Quote Volume C shall include the price template (attachment A3) and will provide all instructions and formulas listed on the spreadsheet. "

See answer to Question 6 above. YES

15.1 and 15.2.2 Can you please provide clarification on the length of Past

Performance. The table in section 15.1 say "6 pages" total but section 15.2.2 says "For all contracts listed, Quoter shall provide the following information, not to exceed four pages for each contract".

Four pages per totalling 12 pages total. Amendment will be made to RFQ. Yes

General Is the prime contractor required to have a facilities clearance to bid? If yes what type/level? Facilities Clearence is required based on the TS level requirement for personnel. A subcontractor may hold the facilities clearence for the team in order to house all TS clearences of personnel participating in the work on site. NO

5.0 / Page 23 Can the Government please clarify the statement "The contractor staff involved in this work shall possess a TOP SECRET clearance at the time of the quote submission". Since the implementation is at a FISMA moderate level for a cloud based

SaaS solution that does not reside on FBI networks can this requirement be waived?

TS Level clearance is required for work performed on the

STACH-VIC portion of the requirement as it requires access

FBI IT systems and facilities. NO

17 14.1 In which volume should this clause be incorporated? Quote Volume C NO

18 14.2 In which volume should this clause be incorporated? Quote Volume C NO

19 14.3 In which volume should this clause be incorporated? Quote Volume C NO

20 14.7 In which volume should this clause be incorporated? Quote Volume C NO

Q&A from Industry

RFQ0016671 - FBI STACH

Validation Checklist Can you please advise if you'd like to receive the response via email or CDs? In the validation checklist the submission is listed as "Number of Electronic Copies (2 of each Volume)" Via email as specified in the RFQ. T he Validation Checklist will be updated to remove Electronic Copy reference. YES

Attachment A5 Is this letter required for Government references or only for commercial customers? This letter is required for all references. NO

3.2.1 / Page 5 States "The CRM shall provide on-line reporting capability/portal that shall allow authorized users to see the status of usage and costs updated on a daily basis". What usage costs is the government expecting to see. SaaS solutions are license based paid annually so this would not apply.

See page 21, section 4.2. The government is aware that some CSPs may charge for exceeding storage or license limits. NO

3.3.1 / Page 11 Where will the contractor (integrator) develop Microsoft-based

.NET (C#) web application capable of making the necessary XML

SOAP or REST calls hosted on a Windows Server platform. Is this a FBI provided server or is the contractor expected to provide and host the server?

The FBI will provide and host the server. It's only implicit in

Section 3.3, though it's explicitly called out in Section 3.3.8. NO

4.2 and 4.3 / Page 21 Is the Cloud Configuration Support and Cloud Operations and

Maintenance Support to be provided onsite or can this be provided from Contractor facilities?

Configuration support shall be provided at Government facilities. O&M Services may take place at Contractor facilities. YES

4.4 / Page 22 Requires "STACH-VIC uptime shall be 99.95%". Since the application will be hosted on the government network this availability is dependent on the Government. How will the FBI account for uptime not meeting this requirement resulting from

Government network/hardware issues? This comment has been removed from the amended version of the RFQ. YES

The solicitation requires access to FBI space for work and interviews and system access for FBINet. Does the government require, as it has in the past, a TS Facility clearance to perform this work? TS level for personnel to be housed at a TS cleared facility See #5

Given the desire to have this system in place rapidly, will the government require the bidder to have previous FBI experience?

No. NO

Does the Prime Contractor need a certification that directly relates to the proposed CRM platform? No NO

Is the government confident that adequate small business competition exists, given these potential requirements described in questions 16, 17 and 18 above? In lieu of small business set-aside, would the government consider allowing large business prime with a small business participation requirement? This is not required to submit a response to this requirement. NO

In an effort to afford FBI better pricing for software, as well as open up competition to software integrators and other technology organizations who are not COTS Software resellers, will FBI allow bidders to split software and services in the transaction, provided (i) the team submits software quotes jointly; i.e., separating the software purchase order from the services purchase order such that FBI purchases the software directly from the reseller and the services directly from the integrator, and (ii) all of the pricing/terms and conditions are disclosed and can be evaluated as part of the proposal?

The intent of the Government is to obtain these services from one source through competition. NO

Is the FBI’s preference to pursue full and open competition or will the government use one of its own vehicles (such as IT Triple

S or GWAC for services such as CIO-SP3) for this procurement? Section 2.1 of the RFQ indications this is a SB set-aside via

GSA IT SCHEDULE 70. NO

What volume of users (backend CRM and external) will the system be expected to accommodate? Please see page 17, section 3.10. NO

For clarification, is the government proposing that the bidder use an existing cross domain solution (CDS) for upward and downward transfer, essentially being required to place files/metadata in a prescribed location, or will the successful bidder be asked to propose or otherwise support a CDS?

The government is requiring the contractor to use an existing cross domain solution for upward and downward transfer. NO

What is the place of performance for each portion of work?

What will be required to be done on site? What is the government’s direction on the use of uncleared development resources for portions of the work that do not require FBI facility or system access?

Please of performance is specified in the RFQ Section 5.0

PERSONNEL Pages 22 and 23. NO

In reference page 3 under CLIN 5, will the government please confirm that this CLIN is T&M?

CLIN 0005 is no longer part of this requirement and has been removed. YES

What information will be made available to enable bidders to scope and provide a T&M estimate for CLIN 5? Does the government require an estimate, or would only labor rates be adequate?

CLIN 0005 is no longer part of this requirement and has been removed. YES

As other agencies are seeking similar solutions with minimal custom code, does the FBI have any requirements around minimizing the amount of custom code it will need to manage going forward? May we suggest the government require bidders to include a table indicating for each requirement whether it can be fulfilled with (a) out of the box capability, (b) declarative development (a.k.a. configuration), or (c) custom code; and for custom code an estimate of the complexity (low, medium, or high) for each STACH-VIC Web application functional requirement. This is a business decision responding vendors will have to make on their own. This will not be required. NO

Has the government narrowed its list of acceptable SaaS solutions or are they open to any technology? The government will accept only SaaS solutions authorized by a Joint Authorization Board (JAB) or U.S. Federal

Government Agency as FedRAMP Compliant, as stated in section 3.2 and throughout the entirety of the document.

The government has not narrowed its list beyond the

FedRAMP moderate requirement. NO

Will the government require mobile interfaces or mobile apps now or in the near future? The government requires that the Cloud service be accessible by a mobile website or application, as stated in section 3.2 and throughout the entirety of the document. NO

Does the proposed CRM platform need to have demonstrated experience (prior ATO by a Government agency) for handling

PII?

The CRM platform shall be authorized by a Joint

Authorization Board (JAB) or U.S. Federal Government

Agency as FedRAMP Compliant, as stated in section 3.2 and throughout the entirety of the document. NO

Section 3.3.1 STACH-VIC Web Application

Functions

With regard to Section 3.3.1 STACH-VIC Web Application

Functions, the requirements indicate that the "Web application must make delete requests to the Cloud to mark select PII in the cloud for deletion, based upon a successful read request or completion of a tour." Teaching an application to be smart about whether a tour happened is more expensive than a simple time-based trigger. This and similar requirements may present a cost to the Government. As this task is fixed-price, will the government consider alternative "minimum viable" requirements that may derive solely from the Cloud solution to satisfy the deletion of PII? I.e. remove following a particular time (in days, weeks, months) after the completion of a tour?

No alternative solutions will be considered. The requirement is as stated in the RFQ. It is a requirement for

FBI personnel to have the ability to confirm attendees as stated in Section 3.2.1, which in itself is a sufficient trigger.

No AI or other algorithms are required to enable this functionality. NO

4.1.5/Page 20: Cloud Services Provider uses commercially reasonable efforts to make its on-demand services available to its customers 24/7, except for planned downtime, for which the Cloud Services

Provider gives customers prior notice, and force majeure events.

While availability SLAs can be negotiated in a contract, the calculation is measured quarterly and not monthly.

Can FBI please adjust this requirement and specify that the SLA requirements can be negotiated based on the Service provider chosen? The requirement will not be amended to reflect allowance to negotiate based on Service provider chosen. NO

4.1.5/Page 20: The Cloud Service Provider is a service provider and FBI would be one of hundreds of thousands of customers using the service.

Cloud Service provider utilizes one Disaster Recovery process for all customers. Cloud Service Provider commits to Recovery Point

Objective (RPO) of 4 hours and not 3 hours.

Can FBI please adjust this requirement to 4 hours accordingly?

The requirements will be amended to reflect 4 hours for disaster recovery. YES

45 3.2.4/Page 7:

If a Cloud Services Provider offers encryption of data in transmission and encrypted custom fields (ECF) capabilities for data at rest, will this meet FBI’s requirement to protect data (e.g.

PII data)?

Yes, so long as it meets or exceeds the Government requirement of 256bit AES in transit and 128bit AES at rest. NO

3.2.6.5/Page 9: The Cloud Service Provider is a service provider and the State would be one of hundreds of thousands of customers using the service.

CSPs can contractually commit to incident response reporting timeframes in a customer contract. One component driving the timeframes are the CSP’s ability to communicate to a wide customer base in the event of an incident. In a multi-tenant cloud environment, the CSP could be reporting to thousands of customers if there is a security incident impacting multiple customers.

CSPs utilize one incident response process for all customers.

Utilizing one approach allows for scalability and ease of operations.

As such, will the State adjust the requirements for breach notifications to align with the existing CSP reporting requirements that also align with FedRAMP? Immediate notification may be up to 24 hours.

The CSP shall comply with all FedRAMP Moderate security requirements, including those outlined in the FedRAMP

Incident Communications Procedure, v1.0. No exceptions shall be permitted.

NO

47 3.2.5/Page 7:

As a customer of the Cloud Service Provider, the FBI can export its data at any time during the subscription service. In the event of termination of the Cloud Service Provider's service, within 30 days after the effective date of termination, the CSP makes Customer data available to the Customer for export or download in .csv

(spreadsheets) files. Customer data on disk is flagged within the database and set to inactive status or what can be referred to as a "soft delete." This data is no longer available or accessible to the application but is backed up in the full database backup process. The data remains in this state for 180 days; this is done in the event that the customer decides to resume services or needs the data for a legal reason. At 180 days, the data is marked for deletion ("hard delete") and will be deleted after 30 more days. Once this "hard delete" is executed the customer data is physically deleted and non-recoverable from the database. Following the purge, the data will remain on backup for an additional 90 days prior to being overwritten and unrecoverable.

Can the FBI further specify this requirement to be more flexible based on the Cloud Service Provider's processes as described above and adjust this requirement accordingly?

CSV will be acceptable. NO

15.2.1/Page 44:

Given the large extent of information to be described and its complexity, would the FBI consider extending the page limitation to allow offerors to provide a more comprehensive response?

Page limitations will be revised to reflect the ability to provide response within 65 pages. YES

15.2.1/Page 44: Section 3.0 of the RFQ consists of several multi-part, multi-paragraph statements. Should Offeror's respond to each sentence separately in each paragraph? Can the FBI please clarify which items require a response?

It is up to the company responding to make the business decision on how to structure a response. However, it is imperative that responses address all requirements and tie the responses back to the appropriate section it pertains to. NO

50 3.2.6.1 Cloud Security Requirements / Page 7

The CSP shall provide a list of its personnel, identified by name and role, with system administration, monitoring, and/or security responsibilities that are to receive security alerts, advisories, and directives.

Is the government requesting dedicated support personnel from the CSP in order to control access and security of the system?

The CSP shall provide contact information to ensure the FBI can readily communicate information regarding incidents, as outlined in the FedRAMP Incident Communications

Procedure, version 1.0, dated APril 8, 2013. YES

Please update the RFQ to reflect this in the appropriate section.

51 5.0 PERSONNEL / Page 23

Performance on this contract requires a TOP SECRET clearance.

The contractor staff involved in this work shall possess a TOP

SECRET clearance at the time of the quote submission.

Will the government consider changing this requirement so TOP

SECRET clearance was limited to team resources that require access to data and resources on the classified FBINET network only and allowing a lower clearance for support personnel or resources working with systems on the FBIs unclassified UNET and/or the SaaS software?

The concern is if all resources need TS then this requirement may eliminate competition potentially unnecessarily if the resources do not need access to classified systems and PII data.

Refer to Question # 5. NO

52 RFQ 15.1(k) / Page 43

FedRAMP information is considered confidential and must be password protected. Is it acceptable to the government to download the FedRAMP documents from the FedRAMP OMB

MAX site? Agencies can review the authorization packages that are available by submitting a FedRAMP Package Request Form.

https://www.fedramp.gov/files/2015/01/FedRAMP-Package-

Access-Request-Form-v2-0.pdf

No. The vendor shall provide the FedRAMP package in full as part of the response. FBI employees accessing the information will sign an NDA if required. NO

53 RFQ 3.10 / Page 2

A budget is mentioned in section 2.0. What is the budget for this SaaS service?

This is not required to submit a response to this requirement. NO

54 RFQ 3.10 / Page 17

Should the system be capable of providing native mobile apps for the major mobile platforms--iOS, Android and Windows? YES. Shall be with Android platform. NO

55 Attachment A2/ Page 1

Insofar as the companies that have achieved FedRAMP certification for cloud-based CRM are large companies, how would the procurement of licenses be handled in the context of a small business set-aside contract? Would the FBI fulfill this requirement by purchasing from a small business reseller?

This is not required to submit a response to this requirement. NO

56 RFQ 3.3.1/ Page 11

Is the government open to using a CRM platform to meet the requirements of STACH-VIC instead of developing a

Microsoft.Net (C#) based custom solution, and making the necessary XML, SOAP and REST calls between CRM Online and

CRM OnPremise? This will not be considered. NO

57 RFQ 3.3.1/ Page 11

Will a login capability be provided to members of the public who schedule visits? If so, what authentication scheme is preferred?

No. Members of the public will not have capability to schedule visits. The only individuals who will have access are listed on page 17, section 3.10. NO

58 RFQ 3.3.1/ Page 11

Has the FBI tested the architectural approach it is specifying through a proof of concept? If so, which vendor or vendors participated?

This is not required to submit a response to this requirement. No

59 3.3.8.1/ Pg. 13

• Would the FBI consider solutions that use other databases running on DAVE like Oracle database? No. NO

60 15.2.1/ Pg. 45

• Will the solution be required to integrate with FBI’s

Provisioning and Access Control (PAC) system? No. NO

61 3.2/ Pg. 4

• Other agencies such as Department of Transportation Motor

Carriers already run CRM in a FedRAMP Cloud for some time.

Are these experiences relevant to FBI evaluation?

It is a business decision whether to include information regarding this experience within the response. NO

62 3.2/ Pg. 4 Can we initiate JAB Provisional Authorization for Siebel?

The government will accept only SaaS solutions previously authorized by a Joint Authorization Board (JAB) or U.S.

Federal Government Agency as FedRAMP Compliant, as stated in section 3.2 and throughout the entirety of the document. The government will not accept SaaS solutions that have not been initated or currently in process or currently in PMO review. The FBI will not sponsor a CSP wishing to initiate the FedRAMP process. NO