QandA_ETS2_12-23-2010.xlsx

Post 9-21-10

a. If so, what has GSA incorporated into the pricing section or the overall evaluation criteria to insure that the Reservation Only fee charged by the eTS2 provider accurately reflects the true cost of providing the service?

b. If not, please define at what point in the reservation process this fee should be charged by the TMC.

c. If not, please advise how the ETMC will be reimbursed for the use of the OTRS.

a. If so, what has GSA incorporated into the pricing section or the overall evaluation criteria to insure that the Reservation Only fee charged by the eTS2 provider accurately reflects the true cost of providing the service?

b. If not, please define at what point in the reservation process this fee should be charged by the TMC.

c. If not, please advise how the ETMC will be reimbursed for the use of the OTRS. CLIN 0001AG applies to accommodated TMC online reservation services, and GSA intends to amend the solicitation to revise the description of CLIN0001AG to be "OTRS Domestic/Intl RESERVATION ONLY w/o Air/Rail (Lodging and/or Car Only). agent assisted reservation transactions (ATRS) containing only lodging and/or car rental bookings (no air or rail). Although the CLIN is a Transaction Type B, requiring no ticketing, the fee is inclusive of all Contractor-provided services including both reservation and fulfillment by the ETMC (to the extent necessary).

The CLIN does not include ATMC fees which are negotiated on a task order level. This is not the charge to a Federal agency that uses an ATMC for use of the online booking engine. This is an agent assisted reservation that is not done online and applies only to ETMC agent services. The ATMC fees are negotiated separately from this solicitation and are governed by the customer agency Task Order.

B 1 B.1 CLINs 0001AG, 0001SBAG and related option CLINs are for an "ATRS Domestic/Intl RESERVATION ONLY w/o Air/Rail (Lodging and/or Car Only)", specifying that it is for an agent-assisted reservation. It is our understanding that these CLINs, as with CLINs 0001AF and 0001SBAF, are for use in making an online reservation only, with the fulfillment and any agency assistance to be completed and charged by the Accommodated TMC? If so, would the Government replace the "ATRS" with an "OTRS"? If no, please provide additional information to explain the intent of these CLIN. CLIN 0001AG applies to accommodated TMC online reservation services, and GSA intends to amend the solicitation to revise the description of CLIN0001AG to be "OTRS Domestic/Intl RESERVATION ONLY w/o Air/Rail (Lodging and/or Car Only). agent assisted reservation transactions (ATRS) containing only lodging and/or car rental bookings (no air or rail). Although the CLIN is a Transaction Type B, requiring no ticketing, the fee is inclusive of all Contractor-provided services including both reservation and fulfillment by the ETMC (to the extent necessary).

The CLIN does not include ATMC fees which are negotiated on a task order level. This is not the charge to a Federal agency that uses an ATMC for use of the online booking engine. This is an agent assisted reservation that is not done online and applies only to ETMC agent services. The ATMC fees are negotiated separately from this solicitation and are governed by the customer agency Task Order.

a) Product demonstrations (late Feb - Mar 2011)

b) IV&V (Late April to early June 2011)

b) Final Proposal Revisions (July - Aug 2011)

c) Final Award (Sept 2011)

The Government's vision for ETS2 is a streamlined, adaptable world-class travel management service that continually applies commercial best practices to realize travel efficiencies and deliver a transparent, accountable, and sustainable service that yields exceptional customer satisfaction.

To clarify the Government’s basis for commercial buying practices, the Federal Acquisition Regulation (FAR) governs Federal Government commercial buying practices and acknowledges that the Government may have requirement modifications not customarily available in the commercial marketplace and are able to be applied when they do not significantly alter the non-governmental function, characteristics, or purpose of what is being bought. We believe that some modifications are necessary to accomplish our vision, while retaining commercial services.

General Unfortunately, the investment required to meet the proposed "Indefinite Delivery, Indefinite Quantity" contracting model, combined with the contract renewal provisions, will be extremely high. For example, we believe customized security requirements alone will require an investment tens of millions of dollars. In addition, future technology enhancements and security upgrades remaining undefined, [offerors] bidding for this business will have no ability to assess the total investment required over the course of the 15-year award.... If the GSA were to alter the request to implement a truly "commercially-accepted" system with robust yet not unreasonably onerous security enhancements -- which are consistent with the spirit of GSA's intentions -- then ETS2 could be built quickly and cost effectively using the same travel technology used by the largest multi-national corporations. Our challenge is to incorporate these commercial best practices into ETS2, at a best value, market competitive price, while also satisfying heightened security requirements as demanded by Federal Travel Regulation (FTR), the Federal Information Security Management Act, and Privacy Act, etc. The Government has well-recognized and prioritized the Nation’s substantial cyber-warfare vulnerabilities for commercial businesses as well as Government-specific services and systems. This is a challenge we all face and it will only be solved through continued innovation, strong partnership, and sound stewardship for key programs like E-Gov Travel Services.

While we anticipate some investment would be necessary for legal and regulatory compliance, our intention has never been to cause or create security requirements that call for investing tens of millions of dollars. GSA has always intended to implement a commercially available service "with robust yet not unreasonably onerous security requirements”, and as a result, we felt it important to review and clarify security requirements in this acquisition, which have been updated in Amendment 10. Additionally, previously submitted questions on security requirements have been revised and are reposted with these questions.

General The 72-hour disaster recovery requirement is not required for commercial systems which currently process traveler data for hundreds of large corporations. The requirement for 72-hour disaster recovery is minimum acceptable standard for web-based commercial services, which our market research substantiates as a valid requirement. We consider Government travel to be mission critical and waiting more than 3 days for online travel services to be restored would impair many agencies ability to accomplish their missions, and well as significantly impact overall customer satisfaction. Web-based services are performing at this level or better for their commercial customers for similar reasons, and we require the same level of performance for the Federal Government.

1. Will GSA consider a waiver for commercial vendors that have instituted a structured internal background processes that would satisfy an HSPD12-background check?

2. Please provide the HSPD-12 guidelines and criteria for persons who are foreign nationals?

3. What is the process for approval by the PMO for foreign nationals?

4. Please provide the clarity for the level of personnel backgrounds required by a subcontractor. Is the Prime responsible for the sub-contractor and their sub-contractors ( Example GeThere is hosted by HP ) ?

5. Attachment 4 outlines the requirements for submissions – When do the background checks need to be completed ?

6. Will an interim clearance be granted? If so, what is the criteria based on and how will this be communicated? Access to US Government data within the accreditation boundary is granted to U.S. citizens with need-to-know status and who have current approved HSPD-12 background investigations; should access be required by a foreign national who is able to meet the HSPD-12 requirements, the ETS2 Contractor must present that individual and the justification for their access to the ETS2 PMO for approval before submitting them for a HSPD-12 background investigation. The requirement applies to subcontractors as well. An organization may not substitute other investigative processes for an HSPD-12 background investigation.

The background investigation process should be initiated as early as possible and access with a Preliminary Adjudication may be considered acceptable by the PMO while awaiting final Adjudication. Criteria will be determined by a number of factors including, but not limited to, Government PMO determination in support of customer agency needs.

Access to US Government data outside the accreditation boundary will require a PMO approved comercial equivalent background investigation.

C.6.1.5.1 84 4 80 What will be the criteria for the qualification of foreign nationals (located in or outside of the United States) gaining access to government data for the execution of authorized roles and responsibilities? Many of the commercial vendors offering their products are global companies with employees world-wide. Are background clearances for subcontractors’ hosting support (for example is the hosted facility for an online booking engine subcontractor required to be cleared)? What is the anticipated cost of the Background Investigation and who will bear this cost? How is this requirement to be applied to servicing US embassies in foreign countries where services will usually be provided by foreign nationals? Access to US Government data within the accreditation boundary is granted to U.S. citizens with need-to-know status and who have current approved HSPD-12 background investigations; should access be required by a foreign national who is able to meet the HSPD-12 requirements, the ETS2 Contractor must present that individual and the justification for their access to the ETS2 PMO for approval before submitting them for a HSPD-12 background investigation. The requirement applies to subcontractors as well. An organization may not substitute other investigative processes for an HSPD-12 background investigation.

The background investigation process should be initiated as early as possible and access with a Preliminary Adjudication may be considered acceptable by the PMO while awaiting final Adjudication. Criteria will be determined by a number of factors including, but not limited to, Government PMO determination in support of customer agency needs.

Access to US Government data outside the accreditation boundary will require a PMO approved comercial equivalent background investigation.

Security requirements are policy-driven and cannot be waived or weakened because of cost considerations. Such These costs must be borne in the overall proposed contract pricing for any ETS2 components within the accreditation boundary.

C.6.1.10.1 91 3 82 Who will determine how ETMCs will be evaluated for meeting security requirements? How will GSA establish a uniform and fair approach to ensuring TMCs meet security requirements? How can Federal compliance regulations be standardized and enforced with Global commercial companies such that compliance will not limit business operations and opportunities due to stringent government requirements? How will GSA compensate the prime vendor and/or the ETMCs for the investment and compliance costs associated with meeting these requirements? How will GSA enforce the compliance of accommodated TMCs providing travel management services through the TSS contract? For ETMC organizations, will all Travel Agents supporting government agencies under ETS2 be required to have HSPD12 background checks? If so, who will fund the background checks for these agents or any other ETMC support personnel? Will the ETMCs be included in the system boundary as one ETS2 solution, or will they undergo Certification and Accreditation Security Assessments as separate entities? EMTCs security requirements will be determined by whether proposed to be included within the accreditation boundary per objective in Section C.6.1.2 #2 added in Amendment 10. ETMCs included within the boundary will be evaluated against government C&A standards, while those not included within the accreditation boundary will be evaluated against commercially accepted equivalents.

Access to US Government data within the accreditation boundary is granted to U.S. citizens with need-to-know status and who have current approved HSPD-12 background investigations; should access be required by a foreign national who is able to meet the HSPD-12 requirements, the ETS2 Contractor must present that individual and the justification for their access to the ETS2 PMO for approval before submitting them for a HSPD-12 background investigation. The requirement applies to subcontractors as well. An organization may not substitute other investigative processes for an HSPD-12 background investigation.

The background investigation process should be initiated as early as possible and access with a Preliminary Adjudication may be considered acceptable by the PMO while awaiting final Adjudication. Criteria will be determined by a number of factors including, but not limited to, Government PMO determination in support of customer agency needs.

Access to US Government data outside the accreditation boundary will require a PMO approved comercial equivalent background investigation.

Security requirements are policy-driven and cannot be waived or weakened because of cost considerations. Such These costs must be borne in the overall proposed contract pricing for any ETS2 components within the accreditation boundary.

The background investigation process should be initiated as early as possible and access with a Preliminary Adjudication may be considered acceptable by the PMO while awaiting final Adjudication. Criteria will be determined by a number of factors including, but not limited to, Government PMO determination in support of customer agency needs.

Access to US Government data outside the accreditation boundary will require a PMO approved comercial equivalent background investigation.

C.6.1.1 357 1) u. Report on the following information monthly per OMB M-10-15 FY 2010 Reporting Instructions, (effective January 1, 2011):

i. Inventory;

ii. Systems and Services (including monthly scan reports);

iii. Hardware;

iv. Software;

v. External Connections;

vi. Security Training;

vii. Identity Management and Access; and

viii. Obtain and maintain a valid certification and accreditation or be subject to termination of the contract for cause.

Comment: Brand new requirement, may need to do this for current contract as well, but adds additional reporting. This is in conjunction with new Continuous Monitoring requirements that will begin soon. Monthly scanning has been removed as a requirement and included as an objective in Amendment 10.

Per Amendment 10, data within the accreditation boundary (TAVS) must be physically separated from commercial data. Logically or physically separating data by customer agency for components outside the accrediation boundary is an objective.

C.6.1.1 72 1 552 Section C.6.1.1 1h) It is stated that "at a minimum, separation of agency data shall be achieved by the use of separate database instances." This new requirement presents undue burden, as it will require a completely new design/architecture of the application and the associated serves associated with each database. This requirement negates the government's desire to "minimize operational and maintenance costs. Generally an application uses one database, which can have the data logically separated by agency. This requires a small number of database administrators and allows for a smooth backup process. Conceivably, an ETS2 Contractor could have 90 separate databases if structured as stated in the new requirement. Additional staff as well as equipment will be required to comply with the requirement of this solicitation.

Another factor to consider is that a separate license must be purchased for each database being scanned. Not only will having separate database instances increase the cost for the scan licenses, it will also increase the amount of time required for performing the scans, and most likely will require additional staff. If ETS2 goes to the proposed requirement for monthly scans, with this architecture required for recording and tracking the POAM any vulnerability identified will increase, and the ETS2 PMO's LOE required to minor the POAM will also increase. Another aspect that can have grave ramifications as result of this change is the back-up and storage of the data. Separate back-up software as well as backup media will be required, escalating the cost. So in reality, the ETS2 contractor would need to price the voucher/transaction cost based on setting up ETS2 and performing the associated takes based on the assumption that the ETS2 PMO awards a single contract an the eTS contractor will have 90 separate database instances and all the associated costs.

The question is, why can't the requirement stated so that the ETS2 contractor can give the Government both physical and logical separation as was the intent of the original requirement. The physical separation would not mean separate data centers, as most people interpret physical separation, but would mean a separate server(s), which would contain US Government data. Thus the US Government data would be physical soreed on a separate server from non-US Government and commercial data, but it could be in the same data center. In addition ach agency can logically separated within one database, and separate database instances would not be required. This way the ETS2 Contractor can meet the required of the EST2 Solicitation for physical and logical separation at a more reasonable price to the government and with less negative impact. Per Amendment 10, data within the accreditation boundary (TAVS) must be physically separated from commercial data. Logically or physically separating data by customer agency for components outside the accrediation boundary is an objective.

Questions and Answers QMAD-JM-100001-N, December 23, 2010