Inactive Total Small Business Set-Aside (FAR 19.5)

THIS IS A SOURCES SOUGHT NOTICE strictly for market research purposes. THIS IS NOT A FORMAL REQUEST FOR PROPOSAL (RFP) AND DOES NOT COMMIT THE NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST) TO ... THIS IS A SOURCES SOUGHT NOTICE strictly for market research purposes. THIS IS NOT A FORMAL REQUEST FOR PROPOSAL (RFP) AND DOES NOT COMMIT THE NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST) TO AWARD A CONTRACT NOW OR IN THE FUTURE. The purpose of this notice is for planning purposes only and to obtain information regarding the availability and capability of qualified small business sources (e.g., 8(a), service-disabled veteran-owned small business, HUBZone small business, small disadvantaged business, and women-owned or economically-disadvantaged women-owned small businesses) under NAICS 513210 with a size standard of $47.0M, that have the capability, experience, and expert knowledge in the area of providing a Software-as-a-Service (SaaS) browser-based Conference Registration System (Prod. Svc. Code DA10) to support NIST-hosted conferences, meetings, and other events. NIST is seeking a commercial-off-the-shelf (COTS) or custom developed registration system solution that efficiently manages event registration, payments, attendee tracking, and integration with NIST systems while meeting federal security requirements. Your response to the information requested will assist the Government in determining the appropriate acquisition method. NIST does not intend to award a contract on the basis of this notice, or otherwise pay for information requested. No entitlement or payment of direct or indirect costs or charges by NIST will arise as a result of submission of responses to this notice and NIST’s use of such information. There will be no question and answer period associated with this Sources Sought Notice. The COTS or custom Conference Registration System shall include and/or allow for: • Registration and Payment Processing: Online registration system, secure payment processing, refunds, discount codes. The ability to configure multiple types of registration fees, including early bird, standard, student, speaker, and group rates. To include multiple registration paths based on attendee profiles, including speakers, general, exhibitors, and government. • Attendee Management: Customizable registration forms, real-time reporting, badge generation, attendee tracking, and onsite check-in support. • Integration and Scalability: Ability to integrate with existing NIST IT infrastructure (e.g., Microsoft, Salesforce, Pay.gov, and other systems and apps). Open API for third-party integrations. • Communication an Engagement: Automated confirmations, reminder emails, post-event surveys. • Administration and Role-Based Access: Multi-tier roles with distinct permission levels, including Super Admin, Event Manager, Support Staff, Read-Only. Ability to assign different administrative privileges to manage event setup, approvals, reporting, and attendee communications. Audit logs for tracking administrative communications. • Scalability and Event Management: Support of unlimited events, registrations, and licenses without additional cost per event. Capability to handle concurrent events. To accommodate the processing of Personally Identifiable Information (PII), the Contractor and the Conference Registration System shall comply with Federal IT security and privacy requirements, that include: IT Security i. The Contractor must have an Assessment and Authorization (A&A) performed at the moderate level as it relates to the requirements set forth in the Federal Information Security Modernization Act (FISMA), resulting in a Federal Agency Authority to Operate (ATO) [Proof of evidence must be shown through an ATO signed by the issuing Federal Agency], and must be able to produce a complete assessment package that NIST can review – the Contractor must confirm that the issuing Federal Agency has given permission to allow NIST to review the assessment package; or ii. The Contractor must have obtained FedRAMP certification at the moderate level [Proof of evidence must be shown through a FedRAMP ATO letter]; The ATO letter(s) must clearly show that the Contractor has been authorized at the moderate level for a system that provides conference registration services. If the Contractor is using subcontractors, each party that will store, process, transmit, or have any type of access to PII or other sensitive information shall have the stated authorization at the moderate level. Privacy The Contractor must have obtained a privacy authorization from a Federal Agency Chief Privacy Officer or Senior Agency Official for Privacy (SAOP) [Proof of evidence must be shown through a SAOP-approved Privacy Impact Assessment {PIA} that has been published on the Federal Agency’s website] Two-Factor Authentication The Conference Registration System (or application) must accept a Personal Identity Verification (PIV) card for user authentication in accordance with the Homeland Security Presidential Directive 12 (HSPD-12): Policy for a Common Identification Standard for Federal Employees and Contractors. The application must also be able to implement Okta as the multi-factor authentication solution for user authentication. Section 508 The Conference Registration System shall comply with Section 508 of the Rehabilitation Act. PAY.GOV The application must be able to integrate with PAY.GOV to accommodate collections of ACH and plastic card payments of registration fees. The application must be able to process PAY.GOV refunds for plastic card payments. The application must provide card validation requirements IAW PAY.GOV Guides and Technical References (https://qa.pay.gov/agencydocs/html/guides.html). The Conference Registration System must support a testing and production environment that includes: Collection services (to include refunds) through Trusted Collection Services (TCS): The TCS certificate must be controlled and inventoried to ensure that access to the certificate is restricted to those persons with a need for access, and must be secured in a FIPS 140-2 compliant certificate container Agency-Specific Collections Data • Customizable collections fields • Capture accounting data to be passed for interfacing into the NIST accounting system • Field configuration In addition to PAY.GOV, NIST will also accept checks, wires, and inter-government payments from registrants. The Conference Registration System must allow for administrators to confirm receipt of payment in the system from sources other than PAY.GOV. In order for an organization to clearly convey their capability to fulfill the above-identified need, the following information MUST BE submitted: 1. Capabilities Statement discussing core competencies. 2. Narrative providing evidence of the ability to offer a robust SaaS subscription-based conference registration system containing the content and compliant with all system specifications and IT requirements described in this notice. 3. A URL granting access to the portal of the on-line SaaS subscription-based product 4. A description of the organization’s previous experience providing a browser-based conference registration platform solution capable of providing the requirements described in this notice. 5. Indication of whether the SaaS subscription-based conference registration system described in this notice is currently offered via the organization’s GSA Multiple Award Schedule (MAS) contract, Governmentwide Acquisition Contract (GWAC), or other existing Governmentwide contract vehicle; and, if so the contract number(s) for this/those vehicles. 6. Any published pricing. 7. Any other relevant information that is not listed above which the Government should consider in finalizing its market research. 8. Current socioeconomic status of the organization including applicable North American Industrial Classification System (NAICS) code. 9. Indication of whether the organization has an active registration, including on-line representations and certifications, at the System for Award Management (www.sam.gov) website – to be considered for award under any official solicitation, the entity must be registered and active in SAM at the time of solicitation response. Contractors must have a valid, current registration to be considered for award under any official solicitation. 10. FedRAMP ATO Letter 11. If any element(s) of this Sources Sought Notice is/are considered a deterrent to competition, the respondent shall include that information with its response, discussing how their solution differs from the stated requirements described in this notice. No telephone requests will be honored. All information provided will become property of NIST and will not be returned. This Sources Sought Notice is for informational and planning purposes and is not to be construed as a commitment by the Government. This is not a solicitation for proposals and no contract will be awarded from this announcement. No reimbursement will be made for any costs associated with providing information in response to this announcement and any follow-up information requests. Respondents will not be notified of the results of their capability statement assessment but may be contacted for additional information. The Government reserves the right to use information provided by respondents for any purpose deemed necessary and legally appropriate. Any organization responding to this Sources Sought Notice should ensure that its response is complete and sufficiently detailed to allow the Government to determine the organization’s qualifications to perform the work. Respondents are advised that the Government is under no obligation to acknowledge receipt of the information received or provide feedback to respondents with respect to any information submitted. Any proprietary, classified, or sensitive information should be presented as an addendum to the non-restricted/non-proprietary information. All information requested above must be submitted by e-mail to randy.schroyer@nist.gov. Responses must be submitted not later than the response date for this Sources Sought Notice. Responses shall be limited to 15 pages, including attachments.