Only use public or sanitized documents. Primes must remove names, identifiers, and any controlled attachments before sharing. Complete required NDAs and procurement integrity training before drafting starts, and decline any material that appears unsanitized or restricted.

For each drafted question, include the RFP section or page number, quoted language limited to the minimal necessary text, and a short note explaining why clarification is needed. Keep copied text minimal and replace identifiable elements with neutral placeholders such as [CUSTOMER SYSTEM] or [CONTRACTOR NAME].

Ask for facts or definitions, not interpretation or advice. Use concise, objective wording. Avoid listing your internal assumptions, analysis, pricing implications, or proposed solutions inside the question text. Frame the question so the agency can answer with a single factual clarification.

Drafts must be routed to the prime for review and submission. Offshore staff may not submit questions, attend prebid meetings, or otherwise communicate with the agency on behalf of the bidder.

Use a naming and versioning convention for drafts, for example: CQ_Draft_v01_YYYYMMDD and maintain a change log that records author, reviewer, and timestamp. Attach a one-line rationale per question in a confidential notes column for the prime only. Keep the question text itself neutral. Flag any question that touches possible controlled information and escalate to the compliance or contracts lead before sending to the prime.

Confirm source document is sanitized and authorized for offshore review. Include source reference and minimal quoted text. Remove or replace identifiers with neutral placeholders. Keep wording neutral, factual, and concise. Add a private rationale note for the prime and mark any sensitive flags. Save draft in versioned, access-controlled workspace.

Assign a unique, stable ID to every requirement you extract from the RFP or SOW so you can reference it later. The prime normally provides guidance on what counts as sanitized or public input before you begin.

Mark whether the item is mandatory, scored, or optional. Note pass-fail criteria when present.

Record the exact proposal section or page where a requirement is addressed, for example, "Technical Approach, Sec 2.1, Paragraph 3".

Paste the minimal, sanitized text you will use to demonstrate compliance. Keep original references to the public source.

Add the team owner responsible for the content and a firm delivery date.

Use status values such as Open, Drafted, Verified, or Escalated. Keep short notes about clarifications needed.

Do not submit clarification questions to the agency. Draft questions only when asked by the prime, but do not send them yourself. You may draft questions for the prime to review and submit, but you must not originate contact with the agency in any form. You cannot attend pre-bid meetings, join oral presentations, or otherwise contact the agency directly.

Pre-bid communication violations are a common cause of bid disqualification. Even inadvertent contact can create legal or contractual exposure for the prime and the subcontractor, and may lead to disqualification from the procurement process.

1. Stop and do not reply. Do not acknowledge the message or provide any information. 2) Preserve the message and any attachments intact. Do not forward, download to uncontrolled systems, or copy sensitive content. 3) Record what happened, including date, time, sender identity, message text, and how the message was received. 4) Notify your prime immediately, using the prime contact and escalation path you were given. If in doubt, escalate to the proposal or capture manager and the security or compliance officer. The prime will advise next steps, and may need to log the contact and manage formal reporting or nondisclosure steps.

Route all agency communications through the prime. Use only approved, role based folders, and the secure channels the prime provides. Do not use agency contact details found in public documents to initiate contact. Complete required NDAs and procurement integrity training before handling pre-bid tasks, and accept only sanitized inputs from the prime when handling content offshore.

Scenario: An agency email asks for clarification about a pricing assumption and copies the offshore team. Recommended actions: do not reply. Save the email and attachments unchanged. Immediately notify the prime, include the full email header and timestamp, and await the prime's instruction on whether they will respond or route a sanitized question through formal channels. Document the notification and any follow-up direction from the prime for auditability.

Never initiate agency contact. Draft but do not submit clarification questions. Preserve and report any incoming agency messages immediately. Follow the prime's secure processes and training to avoid accidental violations. If uncertainty remains about whether a specific action is allowed, stop and ask the prime before proceeding.

Internal customer relationship management systems, financial systems, human resources systems, and client portals are routinely off limits to offshore contributors. Other restricted locations include proposal workspaces that contain unredacted past performance, evaluator notes, or contract drafts, and any system marked for domestic handling only.

Procurement integrity rules bar unauthorized data sharing and contact during the pre-bid phase, so limiting system access protects the solicitation process and the prime’s eligibility to win the work. Contract clauses and data residency rules can create legal prohibitions on moving certain content offshore. Primes enforce limits to meet those contractual and legal obligations.

Never attempt to log in to or browse a prime system unless you have a named, written authorization from the prime. Ask for the authorization to state what systems and data are allowed. Use only approved, isolated workspaces and limited-access folders provided by the prime. Work inside role-based permissions and never copy restricted files outside the controlled environment. Confirm sanitization before using any document. Do not work from files that include unredacted names, evaluator identifiers, or internal notes. If you see sensitive fields, stop and report. Complete required NDAs and procurement integrity training before receiving any pre-bid materials, and follow any data-handling checklists the prime provides. If accidental access occurs, preserve evidence of the event, stop using the data, and immediately escalate to the prime’s compliance or security officer so they can document and remediate the exposure.

Scenario: The prime needs an RSP to extract scoring criteria from the Capture Workbook. The prime places a sanitized workbook in a limited-access folder and grants viewer access for that specific file. Steps to follow: 1) Verify the folder and file names match what the prime told you, 2) confirm the authorization in writing and note any limitations, 3) open and work only inside the provided file, do not download or move content off the folder, 4) log the work performed and share outputs back through the secure channel the prime specified. These controls match common prime practices for isolated workspaces and role-based permissions.

Quick checklist: Stop if asked to use an internal system you do not recognize. Ask for written authorization naming the exact system and allowed tasks. Confirm documents are sanitized before you work with them. Use only prime-approved folders and credentials. Report accidental or unclear access immediately.

If you are assigned a task that appears to require CRM or HR system access, what three questions will you ask the prime before proceeding? Use those questions to form your written authorization request and to protect both the prime and your team.

Primes commonly use segregated virtual workspaces or sandboxes so offshore contributors only see approved material. Access is scoped by role, for example: extraction analyst, compliance mapper, or editor. The prime documents which roles may view, edit, or download specific folders.

Files shared offshore are placed in restricted folders with explicit permissions, often read-only or time-limited. Secure file transfer or enterprise file services replace email attachments. Where sensitive content exists, primes keep the original onshore and provide only sanitized copies for offshore work.

Expect multi-factor authentication, unique user accounts, and session timeouts on any prime systems you access. Temporary credentials or just-in-time access reduce exposure windows. Logging records who accessed which file and when, so activities are auditable.

Permissions follow the least privilege principle. If a task only needs to view a contract excerpt, edit privileges are not granted. Primes typically run periodic access reviews during the pre-bid period to remove unnecessary rights and to confirm only authorized users retain access.

Access logs, file activity records, and automated alerts help detect accidental exposure. Expect periodic spot checks from the prime security or compliance officer and retain evidence of completed tasks in the sanctioned workspace rather than personal drives.

Watermarking, view-only PDFs, disabled copy/paste, and redaction controls are common. Where allowed, documents may be labeled public or sanitized so you can easily distinguish permissible material from restricted material.

Primes prepare sanitized inputs and controlled workspaces before assigning offshore tasks, and they confirm legal restrictions, data residency clauses, and subcontracting rules up front. They typically use isolated folders, role based permissions, and formal nondisclosure and procurement integrity training for offshore contributors to create a compliant environment. Your role is to accept only cleaned, nonsensitive materials and operate on them with full traceability.

Verify source and sanitization: Confirm the prime marked the files as sanitized, and that names, identifiers, and restricted attachments were removed or redacted. Primes routinely handle sanitization before offshore sharing.

Accept only permitted work: Limit your tasks to public or sanitized RFP analysis, compliance matrices, scoring inputs, draft clarification questions, and other nonsensitive activities that the prime allowed offshore.

No direct agency contact: Draft clarification questions or Q&A content only, and never submit questions or contact the agency in any form; the prime must perform external communications.

Use controlled systems: Work inside the secure folders and tools the prime specifies. Do not attempt to access internal CRMs, financial, HR, or other restricted prime systems without explicit authorization.

Confirm assignment details in writing. Each task should state the permitted deliverables, the data source, and any domestic-only exclusions.

Flag suspected sensitive content immediately. If you encounter PII, evaluator identities, unredacted past performance, or internal agency documents, stop work and escalate to the prime's contracts or security officer for handling.

• Confirm you have a signed NDA and completed procurement integrity training, if required. Primes often require these steps before offshore work begins.
  - Verify each file is labeled sanitized or public, and record who sanitized it.
  - Accept only the tasks the prime specified as offshore-eligible.
  - Never submit questions, attend agency meetings, or access restricted systems.
  - Log every deliverable, the source, and the date for audit purposes.

Pull out every requirement, clause, and deliverable statement. For each extracted item capture the reference (section and page), a short paraphrase, and any ambiguity or missing data that needs clarification. Keep extracts in plain text and remove names or unique identifiers before sharing offshore, per the prime’s sanitization rules.

Turn the statement of work into discrete tasks and work packages. Add estimated inputs needed, potential cost drivers, and dependencies. Mark any ‘domestic only’ or restricted tasks so they are excluded from offshore work streams.

Map evaluation criteria and subfactors to the SOW and proposal sections. Identify high‑weight criteria and propose win themes or evidence that addresses each scoring factor. Note which criteria require onshore handling or restricted data.

Build a row for every mandatory requirement. Recommended columns: Requirement ID, verbatim text, source reference, proposal section owner, compliance approach (yes, partial, no), evidence or attachment pointer, risk flag, and last updated timestamp. Keep all source documents sanitized according to prime controls before linking to the matrix.

Draft clear, legally neutral clarification questions that the prime will review and submit. For each draft include the requirement reference, rationale for asking, proposed wording, and any suggested attachments. Do not contact the agency or submit questions directly.

Maintain the integrated workbook entries: compliance mapping, SOW tasks, pricing assumptions (sanitized), risk register, and version history. Use role based access and limited folders as required by the prime’s controls.