RFI Notice.docx

SBU - CONTRACTING ACQUISITIONS

Purpose

This is a Request for Information (RFI) as outlined in FAR Subpart 8.4. The purpose of this RFI is to accomplish market research pursuant to Federal Acquisition Regulation (FAR) Part 10, and to identify vendors capable of performing the functions described herein. The purpose of this document may also serve to establish a Blanket Purchase Agreement (BPA) with one vendor to provide IT-related performance auditing services to the Office of Inspector General (OIG) for the Department of State (Department) and the United States Agency for Global Media (USAGM) [formerly the Broadcasting Board of Governors]. The effort in support of the resultant Blanket Purchase Agreement (BPA) will be to assist the OIG in determining the effectiveness of the Department’s and USAGM’s information security programs and practices. In turn, this information will be used to assist OIG in complying with the requirements of the Federal Information Security Modernization Act of 2014 (FISMA).

Mission

The Department is the lead institution for the conduct of American diplomacy; its mission is based on the Secretary of State’s role as the President’s principal foreign policy advisor.

The Department’s overall vision is to, on behalf of the American people, promote and demonstrate democratic values and advance a free, peaceful, and prosperous world. Its mission is to protect and promote U.S. security, prosperity, and democratic values and shape an international environment in which all Americans can thrive.

For additional details, see https://www.state.gov/about/ .

IT-Related Roles and Responsibilities

In 2003, the Department divided the Department’s cyber security roles.[footnoteRef:2] In general, the decision split the responsibility for Cyber Security between the Bureau of Diplomatic Technology (DT) (known as the Bureau of Information Resource Management prior to June 2024) and the Bureau of Diplomatic Security (DS). This determination continues to reflect the IT-related roles and responsibilities in the Department. For example, DT is responsible for Cyber Security Program Management, Risk Management, Cyber Security Reporting, and Lifecycle Management. DS and DT share responsibilities for Cyber Security Budgeting, Policy Frameworks, Training, Network and Technical Assurance, Critical Infrastructure Protection, and Incident Reporting. [2: ]

According to the Department’s policy, the CIO is the Department’s senior IT professional. Information System Security Officers are responsible for ensuring that the systems for which they are responsible are configured, operated, maintained, and disposed of in accordance with security guidelines; overseeing configuration and administration of auditing and for ensuring that audit trails are reviewed periodically and archived in accordance with security guidelines; working to ensure all security-related functions and activities are performed; helping to identify, evaluate, and minimize risks to all IT systems; and ensuring that IT systems are configured and maintained securely.

DS is chartered to provide security across the Department. The main office tasked with providing cyber security services for unclassified and classified systems is the Cyber and Technology Security Directorate (DS/CTS). DS/CTS is responsible for controlling and limiting access to information systems.

Information Systems

The Department’s global computer systems include an unclassified network, OpenNet, linked to the public internet, and an internal classified network, ClassNet, which has no internet connections. OpenNet handles the Department’s major traffic and functionality requirements and ClassNet handles classified traffic. These two general support systems are used by virtually every bureau and embassy. There are numerous connections to these systems across all levels of the Department. Additionally, several bureaus and posts have, in an effort to further secure themselves within the OpenNet working environment, put up firewalls and maintain their own IT support staff.

According to the Department IT portfolio management platform, as of July 2024, the Department had approximately 475 major IT systems.

U.S. Agency for Global Media

Mission

USAGM informs, engages, and connects people around the world in support of freedom and democracy through its international media programs. USAGM reaches a worldwide audience of over 410 million in 63 languages via radio, television, and Internet. All USAGM broadcast services adhere to the broadcasting standards and principles of the International Broadcasting Act of 1994,[footnoteRef:3] as amended, and support the USAGM mission. [3: ]

History of Organization

USAGM, originally the Broadcasting Board of Governors, became an independent federal entity on October 1, 1999, as a result of the Foreign Affairs Reform and Restructuring Act of 1998.[footnoteRef:4] USAGM administers non-military international broadcasting funded by the U.S. government in accordance with the U.S. International Broadcasting Act of 1994, as amended. [4: ]

For additional details, see https://www.usagm.gov/who-we-are/.

IT Environment at USAGM

USAGM’s cyber security efforts are led by the CIO. The CIO is responsible for promoting effective IT management practices and for the security and maintenance of USAGM’s IT operations. Additionally, the CIO is responsible for life cycle management and risk management of all IT systems. USAGM’s system owners monitor significant changes to information systems to ensure risk assessments and the information system environments remain up to date. USAGM’s System Development Life Cycle is documented in an internally-prepared document. USAGM’s Computer Information Response Teams are responsible for gathering and reporting on IT security incidents.

As of July 2024, USAGM reported having 55 IT systems.

International Boundary and Water Commission, United States and Mexico, U.S. Section

Mission

The International Boundary and Water Commission, United States and Mexico, is responsible for applying the boundary and water treaties between the United States and Mexico and settling differences that may arise out of these treaties. The International Boundary and Water Commission, United States and Mexico, is an international body composed of two sections – the U.S. Section and the Mexican Section, which are administered independently of each other.

USIBWC is an independent commission of the government. USIBWC’s mission is “to provide binational solutions to issues that arise during the application of United States – Mexico treaties regarding boundary demarcation, national ownership of waters, sanitation, water quality, and flood control in the border region.”

For additional details, see https://www.ibwc.gov/home.html.

History of Organization

The International Boundary and Water Commission traces its roots to the 1848 Treaty of Guadalupe Hidalgo and the Gadsden Treaty of 1853, which established temporary joint commissions to survey, map, and demarcate the new United States – Mexico boundary. The United States and Mexico established the International Boundary Commission in 1889. The Water Treaty of February 3, 1944, expanded the duties and responsibilities of this Commission and renamed it the International Boundary and Water Commission. The Commission was charged with carrying out the provisions of the 1944 Treaty and subsequently the Treaty of November 23, 1970, which resolved all pending boundary differences.

Under the 1944 Treaty, neither the United States nor the Mexican Section was to assume jurisdiction or control over works within the limits of the country of the other. The works constructed, acquired, or used in fulfillment of the provisions of the Treaty and located wholly within the territorial limits of either country were to remain under the exclusive jurisdiction and control of the Section of the Commission in whose country the works may be situated. Wherever there are provisions for joint action or joint agreement of the two Governments, those matters are handled by or through the Department and the Ministry of Foreign Relations of Mexico.

For additional details, see https://www.ibwc.gov/About_Us/history.html.

IT Environment at USIBWC

USIBWC’s cyber security efforts are led by the CIO; however, as of July 2023, that position was vacant. The CIO is responsible for promoting effective IT management practices and for the security and maintenance of USIBWC’s IT operations. Additionally, the CIO is responsible for life cycle management and risk management of all IT systems as well as continuously monitoring significant changes to information systems to ensure risk assessments and the information system environments remain up to date. USIBWC relies on the use of IT contractors to supplement its federal staff for the develop and implementation of many IT mission essential functions.

USIBWC maintains two supervisory control and data acquisition (SCADA) systems. These SCADA systems are used to control dispersed assets through centralized data acquisition. According to information received from remote stations, automated or operator driven supervisory commands are controlled by remote station control devices, which are often referred to as “field devices.” Field devices control local operations, such as opening and closing valves, collecting data from sensor systems, and monitoring the local environment for alarm conditions.

As of July 2024, USIBWC reported having 5 IT systems.

AUDITING STANDARDS

All audits performed under this BPA shall be in accordance with the Government Accountability Office’s (GAO) Government Auditing Standards: 2024 Revision (GAS), or any updates thereto.

In addition, all financial statement audits performed shall be in accordance with:

· OMB Bulletin 24-02, “Audit Requirements for Federal Financial Statements,” as amended.

· Department of the Treasury (Treasury), Treasury Financial Manual (TFM).

· GAO/Council of the Inspectors General on Integrity and Efficiency (CIGIE), Financial Audit Manual (FAM), and any updates thereto.

· GAO, Federal Information System Controls Audit Manual (FISCAM).

Additionally, the SOC 1 examinations shall be performed according to American Institute of Certified Public Accountants (AICPA) attestation standards. Specifically, AT-C §105, “Concepts Common to All Attestation Engagements,” AT-C § 205, “Assertion-Based Examination Engagements,” and AT-C § 320, “Reporting on an Examination of Controls at a Service Organization Relevant to User Entities’ Internal Control over Financial Reporting.”

All FISMA audits performed shall also be in accordance with:

· OMB Memorandum M-24-04, “Fiscal Year 2024 Guidance on Federal Information Security and Privacy Management Requirements,” as amended.

· OMB, Department of Homeland Security, and the Council of the Inspectors General on Integrity and Efficiency, “FY 2023-24 Inspector General Federal Information Security Modernization Act of 2014 (FISMA) Reporting Metrics, Version 1.1,” as amended.

The contractor shall meet all applicable audit requirements in all audits performed under this BPA, including any that might arise during the term of each project from revisions in audit requirements or guidance for federal government audits or OIG FISMA responsibilities.

SPECIFIC TASKS

As part of this BPA, BPA Task Orders may be submitted to the contractor for the annual audits of the:

· Department’s financial statements,

· Department’s information security programs and processes,

· other agency financial statements and information security programs and processes (such as USAGM and USIBWC), Also, as a part of this BPA, BPA task orders may be submitted to the contractor for annual SOC 1 Type 2 examinations as well as attestation engagements or performance audits on other issues. These additional projects could be mandated or discretionary. For instance, a BPA Task Order may be issued against this BPA for the contractor to perform a performance audit to fulfill requirements from the Payment Integrity Information Act, as amended.[footnoteRef:5] OIG could also issue a BPA Task Order against the BPA to perform a discretionary audit, for example, an audit of a specific internal control deficiency noted during the annual FISMA audit. [5: ]

Audit of the Department’s Annual Financial Statements

Objectives

The objective is to obtain an independent, full scope audit of the Department’s annual financial statements[footnoteRef:6] as of the end of the fiscal year to meet OMB’s mandated due date (generally November 15) and to comply with all related reporting requirements included in OMB Bulletin 24-02, as amended. Specifically, the contractor would need to: [6: ]

· Determine and report on whether the financial statements and related notes present fairly, in all material respects, the entity’s financial position, net costs, changes in net position, and budgetary resources, in conformity with the accounting principles generally accepted in the United States of America.

· Evaluate and report on internal control over reliability of financial reporting and compliance with laws, regulations, contracts, and grant agreements that could have a material effect on the annual financial statements.

· Review information system controls in the Department’s significant financial applications.

· Perform tests of compliance with laws, regulations, contracts, and grant agreements that could have a material effect on the annual financial statements, including laws governing the use of budget authority, and laws, regulations, and policies identified by OMB in Bulletin 24-02 as amended.

· Perform tests of the entity’s compliance with Section 803(a) requirements of the Federal Financial Management Improvement Act of 1996 (FFMIA).[footnoteRef:7] [7: ]

· Provide support to the audit of the U.S. government consolidated financial statements as required by OMB 24-02, as amended, including, but not limited to, gaining an understanding and obtaining copies of adjusting journal entries that Treasury recorded during its prior year consolidation, performing procedures requested by GAO in its Communication Letter Related to the Audit of the FY 202X Consolidated Financial Statements of the U.S. Government, and performing procedures over reclassification of AFR balances to the government-wide crosswalk.

· Apply agreed-upon procedures (AUP) provided by the Office of Personnel Management (OPM) OIG to assess the reasonableness of retirement, health benefits, and life insurance withholdings and contributions and enrollment information submitted via the Semiannual Headcount Report to OPM, as required by OMB Bulletin 24-02, as amended.

· Apply U.S. Agency for International Development (USAID) developed AUPs to test material accounts in relation to Department allocation transfers from USAID, as required by OMB Bulletin 24-02, as amended.

· Develop AUPs for USAID and Health and Human Services (HHS) to apply when testing material accounts where the Department provides allocation transfers to the two agencies, as required by OMB Bulletin 24-02, as amended.

· Perform AUPs, in coordination with OIG and as agreed upon, on behalf of other agency OIGs from which the Department receives child funds (that is, the Department is the child agency).

Audit of Other Financial Statements

The objective would be to obtain an independent full scope audit of an organization’s annual financial statements[footnoteRef:8] as of the end of the fiscal year to meet OMB’s established deadlines (USAGM) or agreed-upon deadlines (USIBWC) and to comply with all related reporting requirements included in OMB Bulletin 24-02, as amended. Specifically, the auditor would need to: [8: ]

· Determine and report on whether the financial statements and related notes present fairly, in all material respects, the financial position, net costs, changes in net position, and budgetary resources, in conformity with the accounting principles generally accepted in the United States of America.

· Evaluate and report on internal control over financial reporting and compliance with laws, regulations, contracts, and grant agreements that could have a material effect on the annual financial statements.

· Review information system controls in significant financial applications.

· Perform tests of compliance with laws, regulations, contracts, and grant agreements that could have a direct and material effect on the annual financial statements, including laws governing the use of budget authority and laws, regulations, and policies identified in OMB Bulletin 24-02, as amended.

SOC 1 Type 2 Examinations for the Department

As of 2024, the objective of the examinations requested by the Department is to determine the suitability of the design and operating effectiveness of controls related to processing overseas non-payroll transactions and LE staff payroll for other federal agencies.

Audits of the Department, USAGM, and USIBWC IT Security Programs

Objective

The objective of these audits is to determine the effectiveness of the information security program and practices at the Department, USAGM, and USIBWC as required by FISMA. The contractor will use appropriate federal regulations, guidance, or industry standards as criteria during the audit, including requirements found in FISMA; OMB Circular A-130, Appendix I, “Responsibilities for Protecting and Managing Federal Information Resources;” National Institute of Standards and Technology publications; and internal agency guidance.

Specifically, for a representative subset of the Department’s and USAGM’s IT systems (including ones owned by the agency or operated by a contractor) and all USIBWC systems, the contractor will be required to assess the effectiveness of each agency’s information security program based on a maturity model spectrum for the functional areas identified in annual guidance. The maturity model’s foundational levels ensure that agencies develop sound policies and procedures. The advance levels capture the extent that agencies institutionalize those policies and procedures. The audits must include:

· An assessment of the agencies’ progress in meeting FISMA requirements and a follow-up of agency efforts to correct previously identified weaknesses.

· Testing required to fully address performance indicators established each year by OMB and the Department of Homeland Security (audit must address the guidance issued for the year in which the audit is being performed).

· Sufficient independent analysis to complete the OIG portion of the OMB-required FISMA reporting template (CyberScope).

Other Attestation Engagements and Performance Audits

As OIG requests in each BPA task order, the contractor shall perform attestation engagements, performance audits and Management Studies or Assessments that assist OIG in carrying out its responsibilities under the Inspector General Act.17 As specified in each individual BPA Task Order, the contractor shall perform assigned tasks, meet requested time schedules, and deliver requested work products. The objectives of each attestation engagement, performance audit or management study will be unique to the engagement requested and will be detailed in the BPA Task Order.

Examples of Other Audits Performed for OIG by Contractors

· Audit of Department of State FY 2023 Compliance With Payment Integrity Requirements (AUD-FM-24-17, May 2024), https://www.stateoig.gov/report/aud-fm-24-17.

· Audit of the Department of State’s Use of “Not Otherwise Classified” Budget Object Codes (AUD-FM-22-21, February 2022), https://www.stateoig.gov/report/aud-fm-22-21.

STAFFING

Qualifications of Audit Firm and Staff

The firm shall be certified or licensed by the regulatory authority of a state or other political subdivision of the United States and must meet applicable State Board of Accountancy requirements. The firm shall also participate in an external quality control review program, as required by GAS.

The partners and principal managers responsible for financial statement audits under this solicitation must have at least 5 years of experience performing and overseeing federal government financial statement audits. In addition, the senior auditors performing the work on this contract shall have at least 1 year of experience in performing financial statement audits.

The partners and principal managers responsible for IT audits under this solicitation must have at least 5 years of experience performing and overseeing FISMA audits. In addition, the Managing IT auditors performing the work on this contract shall have at least 3 years of experience in performing FISMA audits.

All personnel assigned by the firm to audits under this solicitation shall meet the Ethics, Independence, and Professional Judgment (GAS Chapter 3) and Competence and Continuing Professional Education (GAS Chapter 4) requirements for government auditing as specified by GAS. To ensure independence of mind and appearance, staff members assigned to audits shall submit documentation certifying that they have evaluated threats to independence using the GAS “conceptual framework approach to independence” both individually and in the aggregate because threats can have a cumulative effect on an auditor’s independence.

Independence

Should the Government decide to issue a solicitation, all matters relating to the audit work, the contracted audit organization and the individual auditors performing work under this solicitation must be independent, both in mind and appearance, as required by GAS. The contractor will maintain independence as required by professional auditing standards. If the contractor is unable to sufficiently document its independence from the Department, USAGM, or USIBWC, OIG will not use the contractor’s services to perform any work under this contract.

The contractor agrees to notify the COR and GM immediately if, after award, the contractor identifies a potential conflict of interest or anticipates performing tasks that could impact independence. The contractor will provide details of the potential conflict of interest to the COR and GM in writing. The COR and GM will evaluate the impact of any issues to ongoing or planned future work. OIG reserves the right to terminate the contract for the convenience of the Government should it deem the contractor’s activities could impact independence.

IT SECURITY REQUIREMENTS

The contractor must always use OIG-provided equipment and systems/applications, including OIG email, to conduct official OIG business. The use of corporate or personal equipment, systems/applications, to include email, or other file storage sites to store or process OIG or Department data is strictly prohibited per OIG policy. The use of contractor-owned information systems and hardware devices, including corporate email servers, is restricted to billing and contractual communication and documentation.

Each employee assigned by the contractor to conduct work for this requirement must sign the OIG Information Systems Rules of Behavior and complete the following training (which the OIG IT Helpdesk will provide in-house or online) as part of the onboarding process:

1. Cybersecurity Awareness

2. Enhanced Contractor Cybersecurity

3. Annual Counterintelligence and Insider Threat Awareness Training for Cleared Americans

4. Mandatory Training for Classifiers and Users of National Security Information

The contractor must immediately report suspected and confirmed security incidents to the OIG Computer Incident Response Team. The contractor must mark, store, and always appropriately transmit personally identifiable information at all times.

RESPONSES

Responses should be limited to 10 pages or less and be submitted as a Microsoft Word Document or Portable Document Format (PDF). Submissions should include responses to the following categories: Company Profile, Recent/Relevant Experience and Questions for Industry:

1. Responses to this RFI must be concise and total no more 10 pages. The cover page, cover letter, and table of contents are not included in the total page count. The submissions must be in sufficient detail and clarity to provide DOS with the information it needs.

1. Font should be Times New Roman, 12 point.

1. Sales brochures, videos, and other marketing information materials will not be reviewed.

1. Cost or price information is not solicited and will not be reviewed.

1. No phone calls related to this RFI will be accepted. All correspondence shall be via email addressed to postellbj@state.gov.

Company Profile, to include:

· General Business Information, completing the following table:

Company Name:

Company Point-of-Contact

Email:

Phone:

DUNS Number:

CAGE Code, if applicable:

Recent/Relevant Experience, to include:

· Address the requirements contained in this Notice.

· Provide recent/relevant experience, capabilities, contracts, and customer information as you deem appropriate.

· For past performance cited, include a POC at the Government Agency or business at which work was performed.

Questions for Industry, to include:

In order to foster the maximum amount of competition, the Government would like to solicit industry feedback on how to better develop its requirement. To do so, the Government welcomes responses to the following questions:

· What additional information would your company find most helpful in order to develop and submit a technical and price proposal for this requirement for a best value award?

Companies are welcome to provide any brief concluding remarks, as deemed appropriate.

At this time, the Government will not entertain telephone calls or questions for this RFI. The Government may choose to reach out directly to vendors after reviewing and evaluating the submissions.

Please be advised that all submissions become Government property and will not be returned.

SBU - CONTRACTING ACQUISITIONS

SBU - CONTRACTING ACQUISITIONS