CANCELLED-Commercial Solutions Opening (CSO): Commercial Payment Solutions - GSA Internal Purchase, Travel, and Fleet Services

Questions & Answers / Clarifications

This document provides responses to vendor questions regarding the "Commercial Solutions for the Modernization of the GSA SmartPay Program" (CSO) pilot. It clarifies various aspects of the solicitation, including intellectual property, contract terms, technical requirements, and operational details.

• Intellectual Property & Data Rights: GSA will negotiate specific intellectual property terms and data rights during Phase II. While GSA prefers vendors retain core IP, they may tailor data rights clauses.
• Pilot Duration: The pilot project is planned for a maximum of two years, including one year for transition activities and one year for transaction processing.
• Overseas Employees: The solicitation does not explicitly prohibit overseas employees, but adherence to security clearance and suitability determination requirements is mandatory, which may necessitate presence in the U.S.
• Data Sources: FY25 YTD numbers for GSA Purchase, Travel, and Fleet cover October 2024 to February 2025. Updated numbers can be found on the GSA website.
• Contract Award Timeline: GSA anticipates evaluating solutions and awarding contracts around October 2025.
• Pilot Scope: The pilot project is restricted to selected GSA internal accounts and full integration with GSA internal systems only.
• No Cost to Government: All effort associated with this requirement is at no cost to the government for the entire period of performance.
• Branded Products: Vendors may reference branded products for technical accuracy, but not for promotional purposes.
• Mobile Applications: A mobile application is not required for core functionality, but if proposed, it should be commercial and potentially deployed on government-issued devices.
• Data Retention: Record retention requirements are 6 years.
• Integration: Offerors invited to Phase II will receive specific information regarding integration specifications, schema formats, and middleware.
• Payment Alternatives: GSA is seeking alternatives to convenience checks for payments to vendors who do not accept charge cards.
• FedRAMP Certification: GSA will not assist vendors in expediting the FedRAMP certification process if a product is not already certified.

Several sections of the solicitation have been amended to provide these clarifications. Bidders should review the updated solicitation for precise details. The Q&A document clarifies requirements related to intellectual property, contract duration, security, technical integration, and operational procedures, directly impacting how vendors should prepare their proposals and solutions.

Amendment / Modification

This document is Amendment 02 to the "Commercial Solutions Opening (CSO) Solicitation for Commercial Payment Solutions" (Solicitation #47QRAB25R0002-02).

This amendment revises the solicitation, which was originally issued on June 30, 2025, and previously amended on July 2, 2025.

No specific impacts on proposal deadlines or submission requirements are detailed in this amendment summary, but it is crucial for all potential bidders to review the full amendment to understand any changes to the solicitation.

Form / Attachment / Pricing Sheet

This document provides a template for the pricing structure related to the opportunity. Bidders are expected to use this format to detail their proposed costs and fees.

• Costs/Fees: Section for detailing various costs such as implementation, subscription, and platform fees.
• Refunds: Field to specify any applicable refund rates (in basis points).
• Profit Sharing: Field to indicate profit-sharing percentages, potentially related to revenue or interchange.
• Other Commercial Cost/Pricing Approaches: A section to outline alternative pricing models like tiered pricing, multiple fees, or other approaches.

This pricing sheet is critical for bidders to understand the required format for submitting their cost proposals. It outlines the specific categories of costs and financial arrangements the government is interested in, directly impacting how proposals will be prepared and evaluated.

Form / Attachment / Pricing Sheet

This document, "IT Security Procedural Guide: Security and Privacy Requirements for IT Acquisition Efforts," serves as Attachment 2 to Section 8.0 of Solicitation #47QRAB25R0002. It outlines the mandatory security and privacy requirements for GSA IT acquisition contracts. It is intended to be incorporated into Statements of Work (SOWs) or contracts, or used as a reference for specific security and privacy contract language.

• Scope: Covers IT acquisition contracts involving externally hosted information systems, GSA facilities, Low Impact Software-as-a-Service (LiSaaS), cloud information systems, mobile applications, and nonfederal systems with Controlled Unclassified Information (CUI).
• Requirements: Details federal laws, regulations, guidance, NIST publications, and GSA policies that contractors must adhere to.
• Essential Security Controls: Identifies key security controls (e.g., Account Management, Event Logging, Penetration Testing, Configuration Settings) and provides GSA implementation guidance.
• Assessment and Authorization (A&A): Outlines the process for system assessment, authorization, and continuous monitoring, including required documentation such as System Security and Privacy Plans (SSPPs) and Plan of Action & Milestones (POA&Ms).
• Privacy Requirements: Addresses the handling of Personally Identifiable Information (PII), including Privacy Threshold Assessments (PTAs) and Privacy Impact Assessments (PIAs).
• Specific System Types: Provides tailored security and privacy requirements for External Information Systems, Internal Information Systems, LiSaaS, Cloud Information Systems, Mobile Applications, and Nonfederal Systems.
• Version History: Revision 9, dated January 15, 2025, indicates the latest update to these requirements.

This document is critical for any bidder responding to Solicitation #47QRAB25R0002. It defines the comprehensive IT security and privacy standards that must be met by the contractor. Bidders must carefully review these requirements to ensure their proposed solutions and company practices align with GSA's stringent security and privacy mandates. Failure to comply can impact proposal evaluation and contract performance.