Amendment_003_USM-HQ-13-0018.pdf

UNITED STATES MINT

SOLICITATION USM-HQ-13-0018

AMENDMENT NUMBER: 003

SOLICITATION DATE: 3/22/2013

SOLICITATION RESPONSE

DUE DATE:

5/03/2013

ISSUED BY/RESPOND TO:

Colleen.Grinnell@usmint.treas.gov Department of the Treasury United States Mint

CONTRACTOR NAME:

ADDRESS:

POINT OF CONTACT: TBD

PERIOD OF PERFORMANCE: TBD

CONTRACT TYPE: TBD

ESTIMATED TOTAL VALUE:

DESCRIPTION:

AMENDMENT 002 to Solicitation USM-HQ -13-0018 for Order Management System – Retail Sales End to End Solution See Attached.

The Contractor agrees to furnish and deliver all items and perform all services as set forth herein. The rights and obligations of the parties to this contract shall be subject to and governed by the contract and all attachments thereto.

By executing this document, the Contractor agrees to all terms and conditions included herein and has read the Notice Regarding Inapplicability of Laws Governing Procurement or Public Contracts (I.26).

Offer

SIGNATURE

Typed Name:

Title:

Date: _____________________________

FOR

Acceptance

SIGNATURE

Typed Name:

Title: Contracting Officer Date: __________________________

FOR THE UNITED STATES MINT

mailto:Colleen.Grinnell@usmint.treas.gov

The purpose of this amendment is to make the following changes to the Solicitation.

1. Attached is the Question/Answer Listing as of 3:00 p.m., April 1, 2013.

4/1/2013 Page 1

U.S. Mint Solicitation No. USM-HQ-13-0018 Order Management System – Retail Sales End to End Solution Questions & Answers

Question Date

Solicitation Section

Solicitation Page

Solicitation Paragraph/ Clause

Question Answers

3/22/2013 RFP

Attachment 9 – Contractor Performanc e Questionair re

In the RFQ document you state that the PCI and Past Performance documents should be emailed to you by 4/19 at 3:00 EST. On the Past Performance document (attachment 9) it says it is due 4/17 at 3:00 EST. Which is correct?

The Past Performance Volume and all associated Past Performance documents are due by April 19, 2013 at 3:00 EST.

3/22/2013 RFP – Cover Page

Cover Page Is today's release a draft as indicated in the solicitation number?

No. This is the final solicitation.

3/25/2013 RFP – Cover Page

Cover Page On March 22 RFP USM-HQ-13-0018 was released through FBO as you know. The front page of the solicitation shows the solicitation number as DRAFT USM-HQ-13-0018. I wanted to confirm whether this is still a draft or if this is the final solicitation.

This is the final solicitation.

3/26/2013 Section L Given the PCI Level 1 Service Provider Requirement, please confirm this solicitation is limited to the list of vendors on Visa’s Global Service Provider Registry (http://www.visa.com/splisting/searchGrsp.do)?

No, listing on the Visa Registry is not a requirement.

http://www.visa.com/splisting/searchGrsp.do

4/1/2013 Page 2

Date

Solicitation Section

Solicitation Page

Solicitation Paragraph/ Clause

Question Answers

3/26/2013 Section L.3 Regarding L.3 General Instructions, we will submit in Microsoft Word or Excel and the file Size of 4MB per Volume. Would USM allow the files be submitted in multiple 4MB emails that may or may not be zipped? For example, Volume II Technical’s 150 pages could be submitted electronically as “Volume II Technical, part 1 of 3” and part 2 of 3 and part 3 of 3. Is this file submission acceptable?

Yes. The United States Mint would allow files to be submitted in multiple 4MB emails.

3/26/2013 Section L.3 Would USM allow PDF documents for email submittal with Word and Excel on CDs submitted with the hardcopies?

No.

4/1/2013 Page 3

Date

Solicitation Section

Solicitation Page

Solicitation Paragraph/ Clause

Question Answers

3/28/2013 Section L As a PCI-DSS Qualified Security Assessor (QSA) we have substantial experience in evaluating and validating solutions requiring PCI-DSS Level 1 certifications. In the RFP, the US Mint asks for the PCI-DSS Level 1 certification for the proposed solution by 19-APR, however it is not possible to have this certification for the proposed US Mint solution. This is because it is not possible for a QSA to conduct a PCI-DSS Level 1 assessment until our proposed US Mint solution components have been configured/deployed in our service environment in accordance with the specific US Mint requirements. This includes such items as being integrated with the US Mint systems specified in the SOO, POS hardware/software deployed at the US Mint, and PCI-DSS related agreements in place with the US Mint payment processing provider (pay.gov). It will not be possible for any offeror to produce the PCI-DSS Level 1 Service Provider certification for the proposed end-to-end US Mint solution unless there is an offeror that already provides this exact service to the US Mint as specified in the RFP. For PCI-DSS Level 1 Service Provider compliance the in scope end-to-end hardware, software, processes and responsibilities need to be assessed. This assessment may even require review of US Mint processes for retail POS operations since sale location staffing resources are out of scope per the SOO. As currently stated, we believe this requirement severely limits competition and will prevent fair competition among highly qualified companies in the OMS field. Will the US Mint modify the timing of the PCI-DSS certification date from prior to proposal submission to during the contract period of performance?

No, the United States Mint will not modify the submission date for a PCI Level 1 Certificate past April 19, 2013. The United States Mint acknowledges that the Offeror will have to configure and interface their existing solutions with our IT systems and therefore will not be able to provide a PCI level 1 certificate for an implemented United States Mint solution until the contract period of performance. To clarify our instruction, the Offeror is required to provide a PCI Level 1 certificate for existing systems and services the vendor proposes to use for the Mint end-to-end solution.

4/1/2013 Page 4

PAGE LEFT BLANK INTENTIONALLY