Inactive

This is a SOURCES SOUGHT NOTICE strictly for market research purposes. THIS IS NOT A FORMAL REQUEST FOR PROPOSAL (RFP) AND DOES NOT COMMIT THE NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST) TO ... This is a SOURCES SOUGHT NOTICE strictly for market research purposes. THIS IS NOT A FORMAL REQUEST FOR PROPOSAL (RFP) AND DOES NOT COMMIT THE NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST) TO AWARD A CONTRACT NOW OR IN THE FUTURE The purpose of this notice is for planning purposes only and to obtain information regarding the availability and capability of qualified small business sources (e.g., 8(a), service-disabled veteran-owned small business, HUBZone small business, small disadvantaged business, and women-owned or economically-disadvantaged women-owned small businesses) under NAICS 511210 with a size standard of $38.5M, that have the capability, experience, and expert knowledge in the area of providing a Software-as-a-Service (SaaS) browser-based Conference Registration System. Your response to the information requested will assist the Government in determining the appropriate acquisition method. NIST does not intend to award a contract on the basis of this notice, or otherwise pay for information requested. No entitlement or payment of direct or indirect costs or charges by NIST will arise as a result of submission of responses to this notice and NIST's use of such information. There will be no Question and Answer period associated with this Sources Sought Notice. The Conference Registration System shall include and/or allow for: a. SaaS application that permits NIST staff access and administrative rights to set-up, monitor, and manage registration pages and registrations for multiple large and small conferences b. The public to register for conferences in an intuitive and straightforward manner c. On-site registration and self-check with badging d. Registration templates customizable for each conference e. Administrative access to create standard and customized reports f. Multiple levels of administrative privileges g. Ability to provide multiple registration fee options h. Ability to provide multiple registration paths based on attendee profile (e.g., U.S. citizens vs Foreign Nationals) i. Ability to create new templates for future conferences j. Unlimited no. of conferences and events k. Unlimited no. of administrative user licenses l. Single sign-on for administrative users m. Ability to accept multiple forms of payment, such as: credit/debit cards, ACH, checks, and wire and other Government transfers n. Accommodates up to 10,000 registrations/yr. o. APIs for connecting to and integrating with other applications p. Speaker/session module that offers distinct portals for managing speaker and session materials To accommodate the processing of Personally Identifiable Information (PII), the Contractor and the Conference Registration System shall comply with Federal IT security and privacy requirements, that include: IT Security i. The Contractor must have an Assessment and Authorization (A&A) at the moderate level as it relates to the requirements set forth in the Federal Information Security Modernization Act (FISMA), resulting in a Federal Agency Authority to Operate (ATO) [Proof of evidence must be shown through an ATO signed by the issuing Federal Agency], and must be able to produce a complete assessment package that NIST can review - the Contractor must confirm that the issuing Federal Agency has given permission to allow NIST to review the assessment package; or ii. The Contractor must have obtained FedRAMP certification at the moderate level [Proof of evidence must be shown through a FedRAMP ATO letter]; The ATO letter(s) must clearly show that the Contractor has been authorized at the moderate level for a system that provides conference registration services. If the Contractor is using subcontractors, each party that will store, process, transmit, or have any type of access to PII or other sensitive information shall have the stated authorization at the moderate level. Privacy The Contractor must have obtained a privacy authorization from a Federal Agency Chief Privacy Officer or Senior Agency Official for Privacy (SAOP) [Proof of evidence must be shown through a SAOP-approved Privacy Impact Assessment {PIA} that has been published on the Federal Agency's website] Two-Factor Authentication The Conference Registration System (or application) must accept a Personal Identity Verification (PIV) card for user authentication in accordance with the Homeland Security Presidential Directive 12 (HSPD-12): Policy for a Common Identification Standard for Federal Employees and Contractors. Section 508 The Conference Registration System shall comply with Section 508 of the Rehabilitation Act. PAY.GOV The application must be able to integrate with PAY.GOV to accommodate collections of ACH and plastic card payments of registration fees. The application must be able to process PAY.GOV refunds for plastic card payments. The application must provide card validation requirements IAW PAY.GOV Guides and Technical References (https://qa.pay.gov/agencydocs/html/guides.html). The Conference Registration System must support a testing and production environment that includes: Collection services (to include refunds) through Trusted Collection Services (TCS): The TCS certificate must be controlled and inventoried to ensure that access to the certificate is restricted to those persons with a need for access, and must be secured in a FIPS 140-2 compliant certificate container Agency-Specific Collections Data • Customizable collections fields • Capture accounting data to be passed for interfacing into the NIST accounting system • Field configuration In addition to PAY.GOV, NIST will also accept checks, wires, and inter-government payments from registrants. The Conference Registration System must allow for administrators to confirm receipt of payment in the system from sources other than PAY.GOV. SINGLE SIGN-ON Authentication. The software must integrate with NIST Single Sign-On (SSO) for NIST Enterprise Users. The preferred integration is via SAML to the NIST Active Directory Federation Services (ADFS). The NIST ADFS instance can provide both Kerberos based SSO and PIV card authentication for NIST staff. External users (non-NIST) shall be authenticated via the application using credentials consistent with NIST Special Publication (SP) 800-63, Electronic Authentication Guideline (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-2.pdf); the DoC IT Security Program Policy (ITSPP) Commerce IT Requirement (CITR) 021, Password Management (https://connection.commerce.gov/sites/connection.commerce.gov/files/media/files/2014/citr-021_password_management.pdf); and, the system's accessed Level of Assurance (LOA). The required minimal LOA is Level 3. In order for a vendor to clearly convey their capability to fulfill the above-identified need, they MUST SUBMIT the following information: 1. Brief narrative providing evidence of the ability to offer a robust subscription-based product containing the content and compliant with all system specifications and IT requirements described herein. 2. A URL granting access to the portal of the on-line SaaS subscription product 3. Capabilities Statement discussing core competencies. 4. Current socioeconomic status of your company including applicable North American Industrial Classification System (NAICS) codes. 5. Indication of whether your company has an active registration, including on-line representations and certifications, at the System for Award Management (www.sam.gov) website. Contractors must have a valid, current registration to be considered for award. No telephone requests will be honored. All information provided will become property of NIST and will not be returned. This synopsis is for information and planning purposes and is not to be construed as a commitment by the Government. This is not a solicitation for proposals and no contract will be awarded from this announcement. No reimbursement will be made for any costs associated with providing information in response to this announcement and any follow-up information requests. Respondents will not be notified of the results of their capability statement assessment but may be contacted for additional information. The Government reserves the right to use information provided by respondents for any purpose deemed necessary and legally appropriate. Any organization responding to this Sources Sought Notice should ensure that its response is complete and sufficiently detailed to allow the Government to determine the organization's qualifications to perform the work. Respondents are advised that the Government is under no obligation to acknowledge receipt of the information received or provide feedback to respondents with respect to any information submitted. No proprietary, classified, or sensitive information should be included in your response. The Government reserves the right to use any non-proprietary technical information in any resultant solicitation(s). All capability statements and information requested above must be submitted via e-mail to randy.schroyer@nist.gov. Responses must be submitted not later than the response date for this Sources Sought Notice. Responses shall be limited to 10 typed pages, including attachments.