NCI Computer Services

You are here

Cancer Genomics Cloud Pilots BAA Frequently Asked Questions (FAQs)

FAQs Submitted Through 02/27/2014

122. FAQ #119 answer specified 1" margins. NIH grant standard margins are 1/2 inch. The BAA was silent on the issue of margins. How should a potential offeror handle this information?

A. Disregard the answer to Question #119. There are NO margin requirements stated in the BAA so any margin will be acceptable.

FAQs Submitted Through 02/24/2014

121. I sent a question to the NCICloud mailbox on 2/21/2014; will it be answered in the FAQs?

A: Questions that have been received after 2/20/14 may be answered in the FAQs, time permitting. Please continue to check the FAQs page for updates.

120. Can the current proposal response due date of February 27, 2014, 4:00 pm local time be extended?

A: It is anticipated that there will be no extension to the proposal response date.

119. What are the margin requirements for proposals in response to BAA N01CO42400-80?

A: Standard 1 inch margins should be used.

FAQs Submitted Through 02/20/2014

118. I have a question regarding the "hosting entity" for connectivity and accessibility referred to in the Mandatory Qualification Criteria of the BAA for Cancer Genomics Cloud Pilots (# N01CO42400-80). Must this provider be either the primer or a subcontractor thereof? Or can this entity be listed as a line item/cost incurred on the prime. In the latter case, a letter of commitment would be supplied by the hosting entity to supply the prime with the required connectivity and accessibility.

A: Per the BAA, Section III.C.2., the prime contractor, subcontractor, or the institution that is hosting the data must have the ability and commit to making these resources available to the community outside the hosting institution. If the hosting entity is a subcontractor or listed as a cost incurred by prime contractor evidence from the hosting entity must be provided that the organization will allow access to the solution and that it will provide the required connectivity and accessibility. Additional requirements are outlined in this section and must be met by the hosting organization.

117. Urgent request for further clarification to FAQ #56 which says, "each cloud pilot is expected to have a copy of the data." Suppose an offeror is able to supply assurance that their solution will be co-located with a highly available and performant replica of the TCGA data funded through other means. May such an offeror dispense with planning and budgeting for an additional, redundant copy of the data?

A: Offerors must include planning and budgeting for the project-specific data as outlined in Section I. G entitled Post-Award Data. As the TGCA data is updated, awardees will be required to obtain periodic data updates throughout the project.

116. On page 35, the Statement of Work (SOW) is said to be a 10 page maximum, however, on page 17 it is stated that the Security Plan (SP) must be included with the SOW. At this time, does the Government expect a fully developed SP? It may be difficult to do this within the SOW given the page limit. Please advise.

A: See response to Question #113.

115. Does the Government expect the technical proposal to speak to the five points on page 30? If so, would the responses to these items satisfy the requirements for an initial SP? Would including a lengthy attachment so violate any page restrictions?

A. See response to Question #113.

114. If the Government expects a fully developed SP as part of the proposal package, should this be included as an attachment and not as a part of the technical proposal?

A. See response to Question #113.

113. Re: "The Offeror shall submit an initial Security Plan with its technical proposal..." Does the initial Security Plan count toward the page limit for the Technical Proposal? Or may we write a brief synopsis and then attach the full plan?

A. An initial Security Plan counts towards the 60 page limit of the Technical Volume, not toward the 10 page limit for the SOW. An initial SP must address the five items described in Section IV.B.5. Technical Design/Approach, paragraph b. Technical, will be submitted as part of the technical volume. The BAA directs the offeror to deliver the initial SP document along with the SOW. A revised SP is due within 30 days of contract award and must be updated as needed throughout to the contract per the Delivery Schedule found in Section I.F.5.

112. In Volume 1, Item 11-a, under Mandatory Qualifications Criteria, the BAA requires "supporting documentation to evidence ability of Offeror to meet all MQC's." What is an acceptable document as proof that all MQC's are met?

A. See Application and Submission Information, Section IV.B.3 regarding Mandatory Qualification Criteria.

111. On Page 28, the BAA requires a representation from the CIO relative to the connectivity requirements. This proposal requirement is described as an "affidavit" the use of "affidavit" has certain legal connotations and typically requires a prescribed form acceptable to the person to whom the affiant is making representations. Is the NCI seeking an "affidavit" (notarized, stated under oath, etc.) or merely a representation from the CIO that indeed the institution can meet the required technical requirements? Would such a representation be acceptable on institutional letterhead making the appropriate representation as described below in a form other than a legal "affidavit"?

A. Offerors must submit a signed letter from the CIO or equivalent from the hosting entity on institutional letterhead demonstrating that the organization can meet the connectivity and accessibility requirements per BAA section IV.B.3.b. Additional information regarding this topic may be found in FAQ responses to Questions #75 and #76.

110. Does the Copyright need to be transferred to the Government or can the prime contractor or a subcontractor retain copyright in the software written with funding from the award?

A. The contractor may assert copyright in software first produced and developed under the contract because such software must be distributed under an approved non-viral, open-source license.

109. Reference Section III.C, please confirm our understanding of the eligibility requirement relating to experience with large data sets. Based on the answers to questions 64 and 69, we believe the government requires that a team member (prime or subcontractor) must have the requisite experience on a single project or simultaneously on multiple projects totaling at least 100 TB. Is this understanding correct?

A. Yes.

FAQs Submitted Through 02/16/2014

108. Can the source code written with funding from the award be released publicly under the same license that is granted to the U.S. Government (e.g., Apache 2)?

A: Per Part II, Section I.H of the BAA, all software developed under this BAA must be released under an approved non-viral open source license in accordance with FAR 52.227-17. To clarify, the software must be released under an Open Source Initiative-approved, non-viral, open source license. See http://opensource.org/licenses. This requirement applies to the release of the software to all stakeholders, including the U.S. Government and the public.

107. Can you confirm that the Government expects prospective awardees to comply with NIST SP 800-53 rev 3 rather than rev 4 (which is the latest version)?

A. For the implementation of the pilot, the Government expects to comply with NIST SP 800-53 rev 3. That is currently the baseline that NIH uses in their Security Assessment and Authorization (SA&A) process.

In the event that the prospective awardees chooses to host their pilot in a FedRAMP-authorized cloud, the security controls that are not the responsibility of the Cloud Service Provider are expected to comply with NIST SP 800-53 rev 3. That is the current FedRAMP baseline.

106. Were the security categorizations on page 18 and 19 determined using FIPS-199?

A. Yes.

105. We just tried downloading the Workbook "Breakdown of Proposed Estimated Cost (Plus Fee) and Labor Hours" using the links specified on page 37 of the BAA:

This leads to a PAGE NOT FOUND error in both cases. Can you please advise or send us the Workbook directly?

A: Please see the following updated links: http://oamp.od.nih.gov/DGS/reference-material-prospective-offerors-and-contractors/contracting-forms

Updated link to the page Breakdown of Proposed Estimated Cost (Plus Fee) and Labor Hours form:
http://oamp.od.nih.gov/sites/default/files/DGS/contracting-forms/spshexcl_dec2012.xlsx

104. On page 17 it is stated that the Risk Assessment (RA) must be included with the SOW. At this time, does the Government expect a complete RA? It may be difficult to do this within the SOW given that the system has not been completed at this time. Please advise.

A. The RA is not due with the SOW. The initial RA is due within 90 days of contract award.

103. Since many of the controls for FISMA-moderate are currently planned, our security plan may include many "planned" control implementations. Is this acceptable at this time?

A. Yes.

102. The BAA provides explicit instructions regarding the information to be included on the Cover Sheet of the Technical Volume. The instructions for the Business Volume state that the cover sheet should contain the same information as the Technical Volume, but with the label "Volume 2 — Business Volume." However, these instructions contradict the instructions for preparing the first page of the proposal in Table 15-2 of FAR Subpart 15.4-Contract Pricing. When preparing the cover sheet for the Business Volume, should we follow the instructions in the BAA or in Subpart 15.4 related to Certified Cost Pricing Data? Or should we include a separate "first page" that complies with the requirements in Table 15-2 in addition to the cover pages for the Technical and Business Volume?

A. Please follow the BAA instructions for the Business Volume cover sheet. No we do not require a separate sheet.

101. Our existing commercial software, ABC Software, will be a core part of our submission, although we will be developing other software around ABC Software to satisfy the full requirements of the BAA. It appears that under Section H, the use of commercial software in this way is anticipated, specifically: "To the extent that an Offeror intends to use or include commercial products in its designs, the products must be available both to the Government and the public through standard commercial terms." In the same section is the requirement that all software developed under a resulting contract be delivered with unlimited rights under open source. Can you confirm that we would not be required to release the code of our commercial software, as long as it's made available under standard terms?

A. See response to Question #88.

100. Does the government require a prime, large or small, to perform a specific percentage of work? If so, what are the percentages?

A. See response to Question #67.

99. Can letters of support be submitted in addition to the letters of commitment from subcontractors and collaborators?

A. Letters of Support are not a requirement of this BAA.

98. Would Firm-Fixed Price contracts be acceptable?

A. No.

97. Is the NCI or an affiliate of the NCI supplying the hardware infrastructure for the BAA? We ask simply because in various sections, it is indicated the awardee must begin transferring data immediately upon award (page 18). The inference is the hardware must be in place in advance of the award. If not, then it is assumed as part of our proposal we will be providing an innovative approach that includes all aspects defined throughout the BAA including:

  • Servers and storage
  • Necessary bandwidth
  • Secure hosting (cloud) facilities
  • Application layer that provides the innovative approach leveraging the proposed infrastructure
  • Personnel as required in the BAA
  • Sustainable maintenance and support

Is that correct?

A. The Awardee is expected to provide the hardware infrastructure in support of this BAA.

96. The BAA states that applying organizations must demonstrate that they: "can meet the connectivity requirements of a minimum of 10 Gb/sec current connectivity from the commodity internet to the cloud infrastructure, with a capacity up to 40 Gb/sec." Is there an expectation that the 40 GB/sec connection be deployed during the 2 year duration of the pilot? Or is the intent to demonstrate a capacity that, if needed, can be leveraged at the production phase that will follow the pilot?

A: See response to Question #94.

95. BAA page 28, MQC 1: Will providing the contract or subcontract number of a past or current research project(s) involving at least 100TB of biomedical data satisfy the requirement for "evidence of a prior research project(s)"? If no, please clarify the evidence requirement.

A: The evidence requirement includes, but is not limited to, information such as contract/subcontract/grant number, description of the project, period of performance, dollar value, etc.

94. We have concerns about the requirement for "a minimum of 10 Gb/sec current connectivity from the commodity internet to the cloud infrastructure, with a capacity up to 40 Gb/sec." Very few academic institutions have the capacity for 40 Gb/sec connectivity in place right now, so this requirement will limit the pool of potential Offerors to large commercial cloud vendors and a few academic institutions. Could you please clarify exactly what our CIO will need to attest to when referring to "capacity up to 40 Gb/sec" for connectivity. Does all equipment have to be in place with the fiber, internet service and hardware all switched on on February 27, 2014? Alternatively, can our CIO attest that we have the capability to offer 40Gbps and that it can be operational at the end of the design phase (Base Period of the contract)?

A: The prime contractor and/or the institution that is hosting the data must have the ability and commit to making these resources available to the community outside the hosting institution. This must include a minimum of 10 Gb/sec current connectivity from the commodity internet to the cloud infrastructure, with a capacity up to 40 Gb/sec.

FAQs Submitted Through 02/07/2014

93. Does a party (e.g., a public cloud provider) that hosts the data and the compute resources NEED to be the Prime for the proposal? For example, can a prime have Company A as a sub-contractor even if Company A is hosting all the data and providing all the compute resources?

A: See answer to question #69.

92. On Q28 of your FAQ, you mention that "the government must be given sufficient information and rights that it can create a replica of the environment outside of the developers' site. Company A has been approached by a few organizations to support their proposal and the final cloud architecture may use some Company A-internal source code exposed via public APIs to external parties, and some open-source technologies. While Company A cannot externalize its entire software stack to NCI, we are OK with exposing the stack via public APIs that NCI could use to replicate the architecture. Does this meet NCIs "ability to replicate" requirement?

A: Yes, as long as these APIs are available under standard terms to the Government and the public.

91. FISMA: by what date does the prime or subsidiary cloud provider need to exhibit FISMA-moderate compliance? Is it at the time of proposal submission (Feb2014), or after a party is selected as one of the awardees in Sept2014? Or somewhere in the middle?

A: Per Section I.F.5 of the BAA, Authority to Operate, based on a FISMA Moderate rating, must be in place no later than 90 calendar days from the start of Option Period 2.

90. Do the non-viral open source licensing requirements only apply to new software authored with funding from the award?

A: Yes.

89. Can the system incorporate software that is licensed under a viral license (e.g. GPL) if incorporation of that software does not impact the license of the new software developed with funding from NCI (e.g. use Linux as the operating system)?

A: Yes.

88. Can the system incorporate proprietary software, not developed with funding, but licensed for implementation of the system (e.g. an Oracle Database)?

A: Yes, proprietary software may be used for implementation of the system as long as that software is available on the standard commercial market (i.e. there are standard terms under which the service is offered to the Government or the public) (Section 1.D.2 of the BAA).

87. For hardware that is purchased under this contract, will NCI own the equipment? Or is title for the equipment held by the prime contractor?

A: Title to Contractor Acquired Property will be held by the Government unless otherwise negotiated. See FAR 52.245-1.

86. For software purchased under this contract, is the software licensed to NCI? Or to the prime contractor?

A: Title to Contractor Acquired Property will be held by the Government unless otherwise negotiated. See FAR 52.245-1.

85. On page 35 of the BAA (section 9 thereon), the solicitation indicates that "Proposals will contain the following two tables:…" and provides templates for general estimates of small business participation in table (a). Is a full small business subcontracting plan prepared in accordance with FAR 52.219-9 or any of its alternates required to be submitted at the time of proposal, or merely the summary information described in table (a)? If not required at the time of proposal, and if an award is issued, would it be acceptable to provide a subcontracting plan in accordance with the noted FAR clause within a reasonable amount of time after award if said FAR clause or any of its alternates is a requirement of any contract issued in conjunction with an award?

A: Technical Proposals must include Small Business Subcontracting Utilization section as described in Sections IV.B.9.a. and IV.B.9.b. Business Proposals must include a Small Business Subcontracting Plan in accordance with FAR 19.704 as described in Section IV.C.4.f.

84. BAA Part II Full Text of Announcement, I Funding Opportunity Description, Section D Research and Technical Objectives, Paragraph 1, Core Data and Use Cases, Page 7, The BAA identifies the data set of more than 2.5PB of storage capacity (Core data plus an additional TCGA dataset). Please clarify how much of this storage capacity will require fast access to large compute (1000-5000 nodes) farm. That is, will this entire dataset capacity require 10 GB/sec access?

A: See answer to Question #15.

83. BAA Part II Full Text of Announcement, I Funding Opportunity Description, Section A, Introduction/Background, Pages 5-6. NCI has outlined that one of the key drivers for these pilots is the cost to maintain (and access to) the storage environment for the core dataset for cancer genomics research. The following questions are related to functionality that impacts the overall and over time storage costs. Please clarify the following technology /functional requirements for the TCGA datasets anticipated to be part of these pilots:

  • a. What protocols are required?
  • b. What is the average working set size?
  • c. Is tiered storage (i.e. most frequently to least frequently accessed) required, and if so, what is the profile of each tier from a quality of service, IOPS throughput, and availability perspectives?
  • d. What is the expected data again or data change rate (daily, weekly, monthly) for the pilot dataset?
  • e. What type of backup is required (e.g. online, 14 day, 28 day, more?)
  • f. What restore time (RPO, RTO) is required/desired?
  • g. What is the profile of the backup needed for this dataset?
  • h. What, if any archiving is required?

A: See answers to Question #15 and #35.

82. Can the Government please clarify if it is acceptable to bid "commoditized cloud providers, private cloud providers" (as stated on page 7) when cost from these providers typically include as a part of their service cost "high-speed internet connectivity, cooling, power, backup power, facilities, etc." It is stated on page 35 section 8.d that the BAA will not provide funds for these services.

A: See the answer to Question #44.

81. Does the NCI authorize in-kind contributions or cost-share (including no-cost labor and/or materials) either directly from the prime or as pass through in-kind contributions/cost share from its subcontractors? If such contribution/cost share is authorized, will the Agency include the value of this contribution/cost share in the offeror's total evaluated cost?

A: Please see answer to Question #62.

80. I am writing with a question regarding BAA N01CO42400-80 titled "Cancer Genomics Cloud Pilots" released on January 13th, 2014. Is it allowable for prime A to subcontract company B, who in turn subcontracts company C based in India?

A: The vendor is expected to provide a full subcontracting plan at the time of award. The mechanism for arranging subcontracts is up to the vendor. Technical Proposals must include Small Business Subcontracting Utilization section as described in Sections IV.B.9.a. and IV.B.9.b. Business Proposals must include a Small Business Subcontract Plan in accordance with FAR 19.704 as described in Section IV.C.4.f. See Section III.A.2. regarding foreign participation.

79. Regarding question 19 for the FAQ posted on the NCI's Cancer Genomics Cloud web page: No one we have spoken to (at multiple institutions) has ever seen a Federal government contract without a salary cap. Our subcontractors have seen question 19 of the FAQ, but don't believe it. Could you please confirm whether the contract issued under this BAA is subject to any salary cap?

A: The NIH Salary Cap does not apply as answered in Question 19. However, the HHSAR Clause 352.231-70, Salary Rate Limitation, will apply to any award made from this BAA. The current salary rate limitation is Executive Level II.

78. BAA page 28, MQC 1: Based upon the Government's comments during the Pre-Proposal Conference on January 6, 2014, the meaning of "involving" was understood to include project types ranging from an approach using a single repository containing 100TB of data to an approach using interconnected data stores collectively containing at least 100TB of biomedical data. Is this correct? If not, please clarify the requirement.

A: See the answer Question #64.

77. BAA page 28, MQC 2: Per the Government's comments during the Pre-Proposal Conference on January 6, 2014, please confirm that the Offeror is not required to be the "hosting entity."

A: See the answer for Question #69.

76. BAA page 28, MQC 2: Can the requirements for MQC 2 be satisfied by one affidavit or are two separate affidavits required?

A: See Section IV.B.3.2. for proposal submission instructions regarding Mandatory Qualification Criteria #2. One signed affidavit from the CIO or equivalent for all items in MQC #2 may be sufficient depending on your particular situation.

75. BAA page 28, MQC 2: Will the Government please provide a pro forma draft of the affidavit(s) required for MQC 2?

A: See Section IV.B.3.2. for proposal submission instructions regarding Mandatory Qualification Criteria #2. There is no template or draft for this section of the proposal.

74. On page 7 "Core Data and Use Cases" of the draft BAA there is a link to the TCGA datatype table, and for the Clinical Data, there is also a link to the BCR Data Dictionary. The dictionary, which contains definitions and enumerations for each element in the TCGA XML files, also includes links to other two information resources, the CDE Browser and NCI Thesaurus. What is the origin and purpose of this additional information?

A: The additional information was created in conjunction with the TCGA team, and serves two purposes. Firstly some helps define the data more precisely, and may assist understanding it. Beyond that, the information may help the objective of integrating TCGA data with other data within a cloud implementation. To help define or understand the data; the links behind the XML tag name and valid values provide a link into the NCI Thesaurus (NCIt) where synonyms and related concept information is available. Interoperability is assisted via the Common Data Element (CDE) links. These links include information about other projects that have collected the same variable, the data for which could be integrated with TCGA data.

73. I am writing to get clarification on an issue in BAA#: N01CO42400-80, at several points (e.g., pages 10 and 37) the documents state, "compute services in the range of 1000-5000 nodes." Please clarify what you mean by "nodes" here. In some contexts nodes might refer to physical servers, CPU, or CPU cores. The precise meaning here has significant implications.

A: See response to question #15.

72. Do all controls for FISMA moderate security need to be operational for the pilot? If not, what are the minimum FISMA controls that must be operationally available for the pilot?

A: See response to Question 91.

71. The security requirements for the pilot implementations include preparation of an IT Security Plan, IT Risk Assessment, FIPS 199 Assessment, and performance of security control testing and evaluation (page 9 of the final BAA). The pilots must be FISMA compliant, but will a full FISMA audit be conducted during the performance period?

A: HHS complies with the Office of Management and Budget (OMB) reporting regulations for FISMA and Agency Privacy Management requirements for annual review of the certification and accreditation status of contractor and government systems. The pilots will be audited during the period of performance. Per Section I.F.5 of the BAA, Authority to Operate, based on a FISMA Moderate rating, must be in place no later than 90 calendar days from the start of Option Period 2. Based on reported deficiencies and the system owner's plan to address them, the associated risk will be evaluated by Government authorizing official(s) to determine approval of the system to operate (issue the Authority To Operate).

70: The BAA seems to require that the entire solution can be then transported to any environment using commercially available technology. As you know, some of these commercial entities have built their own technology infrastructure for scaling up data storage, processing, and dissemination to the multi-petabyte requirements of the internet. So the question is whether we may make the infrastructure design available using different commercially available technology if/once we are required to move it as it would be unlikely that these commercial entities would open up their proprietary technology. I think that being strict about this requirement will prevent most of the large cloud service providers to participate in the pilot. Yet, it would be relatively simple to provide detailed diagrams that would allow the NCI to port the solution to commercially available equipment and infrastructure.

A: It is not required that the solution be transported to any environment. Per the Research and Technical Objectives (Section I.D.2.), the requirement is that NCI must be able to replicate the design using technology and services that are available on the standard commercial market (i.e. there are standard terms under which the service is offered to the Government or the public).

69: The BAA requires that the prime is the organization providing the technical infrastructure but that the prime must demonstrate significant expertise in the management of multi-terabyte biological data. In this case, we were planning to use Company A as the technical backbone but to have University B as the organization with the domain specific expertise. In this case, can we be the prime on the BAA even if Company A will be providing the IT infrastructure?

A: The prime contractor is not necessarily required to provide the technical infrastructure. Per the Mandatory Qualification Criteria (Section III.C.2.), the prime contractor and/or the institution that is hosting the data must have the ability and commit to making these resources available to the community outside the hosting institution.

68. With regard to the application of FAR 52.227-14, I see from the FAQ page that Alternates II and III will not be considered as they are inapplicable to this procurement. If an award is granted to a college or university, will Alternate IV be applicable?

A: No. Alternate IV is not applicable in view of the programmatic objectives for this initiative. However, a Contractor may seek permission from the Contracting Officer to assert copyright on a case-by-case basis for data or documentation (other than software) that is first produced under a resulting contract if the Contractor can clearly demonstrate that assertion of copyright in such work will not undermine the Government's programmatic objectives for this initiative. Software first developed by a Contractor is subject to FAR 52.227-17 and must be delivered under an Open Source Initiative-approved, non-viral, open source license. See http://opensource.org/licenses.

67. Is there guidance on how much of the budget needs to be with the prime?

A: No, however, cost proposals should indicate the level of prime contractor involvement indicative of their significance in the project so that they are not merely performing management functions.

FAQs Submitted Through 01/24/2014

66. Is it possible to get a list of companies that responded to the RFI for teaming purposes since there were only 5?

A: A list of the organizations who participated in the RFI conducted on www.ncicloud.ideascale.com is not available. For teaming purposes, you may refer to the list of attendees for the Pre-Proposal Conference held 01/06/2014, posted at: http://cbiit.nci.nih.gov/ncip/nci-cancer-genomics-cloud-pilots

65. Could you confirm whether there are any FAR provisions noted in the BAA that would not be required to pass through/flow down to subcontractors of a primary awardee?

A: All FAR provisions noted i