SOQKEE VENDOR
QUESTION & ANSWERS
QUESTION(S)
ANSWER(S)
1. Please clarify if there was covered a proof of concept stage that was supposed to be initiated last year?
1. No, It was decided that a proper RFP would be released. One that would outline functional (Business and Security) requirements. A proof of concept (PoC) that might or might not address critical requirements would be a waste of resources and effort. If there is a close competition among bidders, then we will initiate the proof-of-concept competition to decide our final choice of vendor.
2. What is an outcome of the proof of concept stage? Would it be possible to share more details?
2. If we are moving into the PoC stage then all competitors will receive additional instructions. The PoC will focus more on the Business functional (AI) aspects of the software.
3. US EO 14110 was revoked by Pr Trump in 2025. Should it be skipped from the requirements?
3. This RFP draft predated those changes -- In acceptance of those changes, and the possible redaction of OMB M-24-10 and M-24-18 we will defer to NIST AI 100-1 as appropriate verbiage for managing the risk associated with creating and using AI. AI does pose risk and until we better understand the true nature of that risk; we prefer to mitigate said risk before we realize said risk. The goal here is protect our future investments and use AI responsible. Additionally, President trumps did not fully revoke 14110. The order was to review 14110; to ensure 14110 did not conflict with item 2 in his EO "Executive Order 14110 that are or may be inconsistent with, or present obstacles to, the policy set forth in section 2 of this order." Sec. 2. Policy. It is the policy of the United States to sustain and enhance America’s global AI dominance in order to promote human flourishing, economic competitiveness, and national security.
Fact is: EO 14110 was written based on guidance provided by NIST. Unless President Trump revokes Public Law 113–283 (FISMA) or revokes both NSA's and NIST's authority provided under Public Law, then 14110 will remain in effect and we will adhere to NIST AI 100-1. (https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf)
Fact is: EO 14110 was written based on guidance provided by NIST. Unless President Trump revokes Public Law 113–283 (FISMA) or revokes both NSA's and NIST's authority provided under Public Law, then 14110 will remain in effect and we will adhere to NIST AI 100-1. (https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf)
4. Yes, that is one of our Federal Government targeted customers
4. Will the developed application be used for the DoD Market?
5. Could you please clarify this statement?
Our company has offices in different countries and work with employees of different nationalities. Employees are hired in accordance with their skills, qualifications, and expertise in specific technologies. Please clarify a requirement for the US-based project Manager and Engineers, a nationality requirement. Will this impact the development process and the achievement of the final goal? We believe this requirement constrains competition due to US-based employee rates.
5. We do not consider this as a competitive constraint given this requirement is being placed on all potential vendors. Having a US based team leading the Dev process will improve our chance to obtain a waver (if need), when we approach a portion of our intended customer base. The question we put forth here will be asked of us when we pursue those opportunities. Our goal here is to minimize supply chain risk and address the concerns of our future customer(s).
NOTE: This section does not apply to legal US Citizens / US Properties.
Notwithstanding, any developer / development in or from the Sanctioned list is an automatic disqualifier: https://www.treasury.gov/ofac/downloads/sdnnew25.pdf
Any developer / development in or from the Priority Watch list is an automatice disqualifier:
https://ustr.gov/sites/default/files/2024%20Special%20301%20Report.pdf
Any developer / development in or from the US Adversary list is an automatice disqualifier:
https://www.ecfr.gov/current/title-15/subtitle-B/chapter-VII/subchapter-E/part-791/subpart-A/section-791.4
6. Will the certificate ISO 27001 and audit report ISO 27001 cover your requirements in this compliances?
6. While the differences between ISO and SOC are not major, SOC2 is preferred. SOC2 demonstrates protection of customer data as opposed to ISO 27001 who's focus is on you protecting you and improving the way you protect yourself. Both have merit, both are security focused; ISO certification would not be a disqualifier under this section. We would then consider your security pedigree and providence. Many cycles of ISO certification would establish a history of good security practices, as does annual or biennial favorable SOC2 reports. Part of our goal here is to minimize supply chain risk.
7. What Proof of Concept will include?
7. The PoC will focus more on the Business functional (AI) aspects of the software.
8. Through direct interaction with those people on you reference list. But we reserve to right to look beyond your reference list. We will practice appropriate due care and due diligence.
8. How will a reference check be conducted?