P02_ECSP Audit Support_RFI_Questions_final.pdf

# RFI/PWS

Reference

Question Answer

1 General What is the current technology stack of the Office of Information Technology (OIT) Audit Portal?

Specifically: SharePoint version (on-premises, hybrid, or SharePoint Online), SQL Server version, and the current inventory of custom Power Apps.

The current technology stack of the OIT Audit Portal is Canvas Apps, Power Automate Flows, and Power Business Intelligence (BI) reports built from Dataverse and SharePoint Online.

2 General Is there an existing Power Business Intelligence (BI) Premium or Pro workspace provisioned for Information Security Programs and Logistics (ISPL)- Enterprise Cybersecurity Program (ECSP), or is the contractor expected to establish the Power BI environment?

The existing Power BI is Premium (Build, Dev, Test & Production).

3 5.5 Are the approximately 35 custom SharePoint applications (PWS 5.5 item 8) documented with technical specifications, and will the incumbent contractor provide transition documentation during the optional 60-day transition period?

Yes, they are documented. If exercised, the incumbent will provide documentation during the transition period.

4 General What is the approximate annual volume of audit findings and Notice of Findings & Recommendations (NFRs) processed through the Audit Portal?

Approximately 500 findings (10 NFR Categories).

5 5.2.4, 6.1.9 The PWS references a Governance, Risk, and Compliance (GRC) tool (PWS 5.2.4 item 2, PWS 6.1.9 item 8). Is this ServiceNow GRC, RSA Archer, or another platform? Is the required integration read-only or bidirectional?

It is transitioning from eMASS to ServiceNOW.

There are a few modules migrating to that platform.

6 5.4 For the ML/predictive analytics requirement (PWS 5.4 item 10), is there an existing model baseline, or is this greenfield development?

There is an existing model baseline.

7 General The PWS references the OIT Audit Portal extensively as the system of record for audit lifecycle data. Can the Government describe the portal’s current technology stack (platform, hosting environment, data integration layer) and whether it’s a Commercial Off the Shelf product, a custom-developed solution, or a hybrid?

The current technology stack of the OIT Audit Portal is Canvas Apps, Power Automate Flows, and Power BI reports built from Dataverse and SharePoint Online.

It is a hybrid solution.

8 General The PWS references a GRC tool and an Enterprise-RISK Registry as data sources. Can the Government identify which GRC tool is currently in use (e.g., ServiceNow GRC, Archer, Xacta) and describe the current integration points between the GRC tool and the OIT Audit Portal?

See response to Question #5.

9 General Can the Government confirm whether VA OIT currently has Power BI Premium capacity licenses that would support the certified dataset and row-level security requirements, or whether the contractor is expected to propose a licensing approach?

The Government has Power BI Premium (Build, Dev, Test & Production).

10 5.6 The PWS includes an optional transition task (5.6), suggesting an incumbent contractor. Can the Government share whether transition documentation, data models, or portal configuration artifacts will be provided, and whether the incumbent’s Power Apps will be

The Government anticipates that transition activities will be conducted in accordance with Section 5.6 of the PWS.

The outgoing contractor will be responsible for developing and executing a Transition- Out Plan, which includes the handed over with documented source code?

delivery of final deliverables, artifacts, and documentation necessary to support continuity of operations.

To the extent available and permissible, relevant transition documentation and materials will be provided during transition. However, the Government does not guarantee the availability, completeness, or format of any specific artifacts (e.g., data models, configurations, or application source code).

Offerors should propose an approach that does not rely on the availability of incumbent-developed artifacts and demonstrates the ability to effectively transition with limited or varying levels of documentation.

11 General The PWS references approximately 20 scheduled audit engagements per month. Can the Government provide a breakdown by audit type (Federal Information Security Management Act (FISMA), Federal Information System Controls Audit Manual (FISCAM), Internal Revenue Service (IRS), IT Security Inspection) and the average number of concurrent audits at any given time?

FISMA: 20+ sites/systems

FISCAM : 20+ sites/systems

IRS: 4-5 sites/systems

The PWS has been updated to reference approximately 45 scheduled audit engagements.

12 General Will the Government provide access to existing audit tools and data

The Government will provide access.

repositories, or is contractor-hosted tooling expected?

13 General Are there preferred BI platforms (e.g., Power BI, Tableau) mandated by VA?

Power BI

14 General What is the expected volume of audit artifacts and frequency of audit cycles?

Audit Cycles are annual Artifacts: 12k+

15 5.2.4/5.3 Per VA Notice 25-16, the OIT GRC tool replaced EMASS as the authoritative Authorization to Operate (ATO) repository. Will the Contractor have read/write access or read-only access to the GRC tool?

This affects how we scope the data modeling and portal integration workload and whether a dedicated GRC analyst role is required.

This is to be determined and is a work in progress, as it is currently in transition.

16 General Given the nuances of audit-related data and processes and the importance of understanding the architecture of the current OITAP, would the Government include key personnel requirements within the PWS (and requiring resumes to be submitted for evaluation as part of a future RFP/RFQ) to reduce the risk of impacts to VA during an active audit period? The following key personnel are recommended:

Lead Developer: Oversees the software development lifecycle for OITAP; must have experience with audit-related tools and Microsoft Power Platform; must be experienced

Key personnel requirements will not be provided nor resumes requested.

with audit management processes and data; Microsoft-certified Power Platform Solution Architect

Lead Data Analyst: Oversees the development and sustainment of dashboards and reports using OITAP other data (e.g., VASI, ServiceNow);

must have experience with audit-related data and Microsoft Power BI;

Microsoft-certified Power BI Analyst Associate.

17 General The PWS makes multiple references to “SQL Server” – while using SQL Server to store audit related data was considered in 2022, it was ultimately decided to transition from SharePoint lists to Microsoft Dataverse instead, due to Dataverse’s close integration with Microsoft Power Platform.

Would the Government revise the PWS to replace SQL Server with Dataverse?

At this time, the Government cannot commit to revising the PWS to replace SQL Server with Microsoft Dataverse, as future requirements may change depending on the final design and capabilities of the new Audit Module. The selection of data storage and integration platforms is still under evaluation and will be determined once the new module’s requirements are finalized.

18 General With the high-level visibility of dashboards and reports generated through these PWS tasks, and the decisions that will be made because of the data presented, there is little room for error.

Linting identifies potential issues in code that could impact the data being presented. Would the Government consider adding a requirement to the PWS (and future RFQ/RFP) for offerors to demonstrate capability linting Power Query code used for

Linting Power Query code will not be made a requirement in the PWS.

Power BI reports along with automated testing within Power BI Semantic Models to reduce the Government with potential errors?

19 General What is the current average monthly/annual volume of audit findings, NFRs, Material Weaknesses, and evidence requests that the Contractor must process and track?

Annual volume of 500+ and historically, the majority of this volume, approximately 7 to 8 months’ worth, occurs in the early part of the year, with a higher concentration up front and lower volumes in the latter portion of the year.

20 General How many ad-hoc data calls, trend reports, or stakeholder requests are typically received per month outside of the scheduled ~20 audit engagements?

At the start of audit season the Office of Inspector General (OIG) requests prelims and those can vary from 20-30, but all would be in the initial stage of the fiscal year.

21 5.4 For the ~50 data visualizations/dashboards per Period of Performance (PoP) in Section 5.4, how many are expected to be new vs.

refreshed/maintained existing dashboards?

Currently, the approximately 50 data visualizations/dashboards referenced in Section 5.4 are primarily existing dashboards that require ongoing maintenance or refresh.

However, please note that following the full transition to the new tool, it is anticipated that all dashboards may need to be rebuilt.

22 General Will the Government provide existing access to the current OIT Audit Portal (including backend databases, Power BI workspaces, and data sources), or will the Contractor need to build/enhance components from scratch?

The Government will provide access to the current OIT Audit Portal.

23 General What is the current state of the OIT Audit Portal (e.g., number of existing Power BI datasets, custom apps, governance framework maturity, and integration with GRC/Enterprise Risk Registry tools)?

There are 15 apps, 20 dashboards and reports, and 10 datasets.

24 General Are there any restrictions or pre-approved TRM tools for machine learning components (e.g., specific approved versions of pandas, scikit-learn, XGBoost, TensorFlow/Keras, or MLflow)?

Please refer to the VA Technical Reference Model (TRM) Catalog at https://www.oit.va.gov/service s/trm/ for the most up-to-date list of approved software products and versions. If the tools are not already TRM-approved, the Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

25 General What is the current version and configuration of the ISPL-ECSP SharePoint environment (SharePoint Online only, or hybrid)? How many sites/sub-sites are actively maintained?

SharePoint Online – multiple production sites (approximately six).

26 5.5 For the ~35 custom applications and ~12 custom Power Apps mentioned in Section 5.5, will the Government provide source code, documentation, and access for review/maintenance, or will the Contractor be responsible for reverse-engineering?

The Government will provide source code, documentation, and access for review/maintenance.

27 General Which authoritative data sources (e.g., GRC tool, Enterprise Risk Registry, VASI, MPI) must the

Currently, the GRC tool is the primary source identified for integration; however, please https://www.oit.va.gov/services/trm/ https://www.oit.va.gov/services/trm/

Contractor integrate with, and will VA provide APIs, credentials, or direct database access?

note that access to the GRC tool is a work in progress, as VA is in transition. Details related to APIs, credentials, or direct database access will be provided as they become available and finalized during the implementation phase.

28 5.2.4 and 5.4 What are the expectations for automated data intake processes in Section 5.2.4 and 5.4 (e.g., frequency of audit data feeds, preferred automation method using Power Automate or other tools)?

The Government’s preferred automation method is Power Automate; however, Offerors may propose the tool or automation solution they consider most effective for the required tasks.

29 6.1.11 Does the Government anticipate the use of Generative Artificial Intelligence (AI) or AI Builder features under this effort? If so, will VA provide approved AI tools/models, or must the Contractor propose compliant solutions meeting all requirements in Section 6.1.11?

Section 6.1.11 is included should the contractor propose to utilize AI as part of its solution. It is not a requirement under this effort.

VA does not require contractors to use only pre‑approved AI tools or models. Instead, the agency expects contractors to propose compliant solutions that meet the requirements set out in VA’s guidance, including the referenced 6.1.11 clause.

30 5.3.1 For helpdesk support in Section 5.3.1 (Tier 1–3, estimated 15 tickets/month), what are the current SLAs for response and resolution times?

Resolution within one hour is the current SLA.

31 5.6 If the optional Transition Services task (Section 5.6) is exercised, will

See response to question #10.

there be an incumbent Contractor, and will VA provide a detailed incumbent staffing list, knowledge base, and artifacts?

32 General Are there any specific VA governance processes (e.g., Change Control Board cadence, Veteran Focuses Integration Proccess (VIP)/Product Line Management (PLM) requirements, or Process Asset Library process tailoring) that significantly impact the Contractor’s day-to-day workflow?

No.

33 General Will the Government provide any sample data, mock audit findings, or access to a sandbox environment during the proposal phase to better size the BI/SharePoint effort?

No.

34 General Are there any known constraints on the number of simultaneous Power BI users, concurrent SharePoint site edits, or data refresh schedules?

No known constraints, however, PowerApps and Dataverse does have a cap.

The current DataVerse license count is 600, based on our latest purchase and budget.

While the license number has been higher in previous years and could be adjusted as needed, 600 represents the current active allocation.

35 General Will contractor personnel be required to hold active security clearances (e.g., Public Trust, Secret, or Top Secret) at the time of proposal submission, or will the Government sponsor clearance processing for the selected contractor? Clarity on this requirement will enable more accurate staffing plans.

The Government will sponsor clearance processing for the selected Contractor.

36 General Will the Contractor be provided access to VA’s GRC tools, Security Information and Event Management platforms, and vulnerability management systems (e.g., Archer, Splunk, Tenable) to support audit evidence collection, or will the contractor be expected to provide independent tooling?

The Government will provide access to VA’s GRC tools, Security Information and Event Management platforms, and vulnerability management systems.

37 General Does the VA anticipate annual, semi-annual, or continuous audit cycles under this contract? Understanding the cadence will directly inform Full-time equivalent (FTE) estimates and staffing flexibility requirements.

While formal audits are conducted on an annual basis, the VA manages audit findings and related activities continuously throughout the fiscal year. As such, Offerors should structure their staffing approach and FTE estimates to support ongoing audit management and resolution.

38 General What is the anticipated split between on-site presence at VA facilities and remote work? If on-site presence is required, at which VA locations will contractor personnel primarily operate?

There is no on-site work anticipated for this effort.

39 General Will the VA provide existing System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), prior audit reports, and ATO packages as a starting baseline for the contractor’s assessment, or will the contractor be expected to develop these artifacts from a greenfield state? Access to existing documentation significantly impacts the level of effort and FTE requirements for the engagement.

The contractor will not be expected to develop or manage these documents directly. The scope is focused on the development and management of reporting aspects and tools for analysts, rather than hands-on management of baseline security documentation. As such, access to existing SSPs, POA&Ms, prior audit reports, or ATO packages is not required for contractor performance under this requirement.

40 General Does the estimate of 20 audit engagements per month stay consistent across all periods, and how are these audits distributed across the base and option years? Are these primarily new system audits or re-audits? Can the Government provide the types of systems being audited (e.g., low, moderate, high impact) and the expected number of audits per year?

The estimate of approximately 20 audit engagements per month represents a rough average – this is bulked between 75% of the calendar year.

Both new system audits and re-audits are conducted each year. The systems are determined by OIG and can be any system regardless of category.

41 General Can the Government provide details on the current OIT Audit Portal, including the number of Power Apps, data sources, integrations, and existing workflows?

Please see response to Question #7 and Question #23.

42 General Will the contractor inherit existing PowerBI dashboards and datasets? If so, how many exist today, and what is their current documentation and maintenance status?

Yes, the contractor will inherit between 20-30 dashboards and data sets that exist today.

43 General What is the expected timeline for issuing GFE and granting PIV-based access to required systems, and are there any known delays that could impact the start of work?

The typical timeline for issuing GFE and granting PIV (Personal Identity Verification) access ranges from 2 to 6 weeks after contract award, contingent upon timely submission and processing of all required onboarding documentation by the contractor’s personnel.

This process includes background checks, fingerprinting, obtaining PIV badges, and account provisioning for required systems.

While the VA strives to expedite onboarding, delays can occasionally occur due to factors such as high onboarding volume, incomplete or inaccurate documentation, or supply chain issues affecting GFE.

Contractors are encouraged to submit all required onboarding materials as promptly and completely as possible to minimize potential delays.

Any known or anticipated delays will be communicated by the Government as soon as possible.

44 General How many helpdesk tickets are processed per day? What is the average resolution time per ticket?

What ticketing system is used to manage workflow?

The helpdesk typically processes 10-20 tickets per day. The average resolution time per ticket is within an hour. Workflow is managed using a built-in ticketing system within the Office of Information Technology Automation Platform.

45 General How many distinct information systems or system boundaries are anticipated to be within the scope of audit support activities under this contract?

For this requirement, audit support activities are not structured around providing direct support to individual information systems or system boundaries. Instead, the focus is on supporting enterprise audit reporting and related activities at a broader programmatic level. As such, there is no predetermined or relevant number of information systems or boundaries specifically associated with this requirement.

46 General Will contractor personnel require physical access to VA facilities, or is this anticipated to be primarily a remote/virtual performance effort?

This is anticipated to be a remote effort.

47 General What is the anticipated period of performance (base period duration and number of option years)?

Please refer to PWS Section 4.1.

48 General Will the Government provide access to existing security documentation (SSPs, POA&Ms, prior SARs) at contract onset, or will baseline documentation development be part of the scope?

Please see response to Question #39 and Question #45.

49 General Is it anticipated that this effort will be issued as a single award task order or as a multi-award vehicle?

VA anticipates to issue a single award Task Order.

50 General What is the current technology stack supporting the OIT Audit Portal (SharePoint version, Power Platform components, and SQL Server version)?

See response to Question #1.

51 General Will the Government provide the contractor access to the existing Governance, Risk, and Compliance (GRC) tool for data integration?

See response to Question #36.

52 General What is the approximate annual volume of audit findings and evidence requests?

See response to Question #19.

53 General Will the contractor inherit any existing Power BI datasets or report templates?

Yes. See response to Question #42.

54 General What is the current state of automation across the audit lifecycle?

The current state of automation across the audit lifecycle includes automated email communications, partial automation of data intake from OIG documentation (for evidence and findings), and automated folder structure and evidence security management.

55 General Portal Technology: What is the underlying technology stack for the "OIT Audit Portal" (e.g., SharePoint, ServiceNow, or a custom SQL/.NET application)?

See response to Question #1.

56 General Can VA provide historical averages for the number of concurrent audits (FISMA, Government Accountability Office (GAO), IRS Pub 1075, etc.)

and approximate annual findings/POA&Ms managed by ECSP to better size staffing?

Annually, around 30 sites/systems are being audited. Regarding findings, there are approximately 500 on an annual basis. POA&Ms are not singled out and if found as part of a finding they are included in that number.

57 General Data Sources: For the BI Artifact development (PWS §5.4), will the contractor have direct API access to relevant VA tools (e.g., Archer, Yes, the contractor will have direct API access to relevant VA tools (GRC tool to be determined).

Nessus/ACAS) or will data be provided via flat-file exports?

58 General Clearance Levels: Does the VA anticipate a requirement for Tier 4 (High-Risk Public Trust) or Tier 3 (Secret) clearances for all personnel, or only for specific "Key Personnel"?

Tier 2 is the required investigation level for all personnel, as outlined in the PWS task table under Section 6.2.1.

59 General Place of Performance: While the RFI lists "Contractor’s Facility," will the VA provide remote access (GFE/VPN) for all 7.0 estimated FTEs, or is on-site presence required for specific portal maintenance tasks?

Please see PWS Section 6.6 pertaining to GFE/VPN.

The Government does not anticipate on-site work.

60 General Audit Volume: What is the historical average of concurrent audits (OIG, GAO, and internal) supported by the ECSP annually?

See response to Question #56

61 General Does VA envision a major re-architecture of the OIT Audit Portal during this PoP (e.g., migration to a low-code or cloud-native platform), or is the primary expectation incremental enhancement and stabilization on the existing platform?

No, the VA does not envision a major re-architecture of the OIT Audit Portal during this PoP. The primary expectation is incremental enhancement and stabilization on the existing platform.

62 General Will the contractor implement new interfaces to VA’s Master Person Index (MPI), VA Systems Inventory (VASI), electronic Contract Management System (eCMS), or other Authoritative Data Source (ADS) systems for BI artifacts, or primarily leverage existing data feeds maintained by other OIT organizations?

No, the Contractor will primarily leverage existing data feeds maintained by other OIT organizations.

63 General Can VA clarify which PWS task areas (5.1–5.6) require Tier 4 / Top Secret clearances? This allows Offerors to accurately scope cleared FTE allocation and pricing.

Please see PWS Section 6.2.1 which details Position/Task Risk Designation Level(s).

See response to Question #58.

64 General Is VA currently using any internal, VA-approved Large Language Models (LLM) platforms for analytics or documentation support within ISPL-ECSP, or should the contractor assume all AI/LLM capabilities must be proposed, accredited, and documented from scratch?

At this time, the VA is not currently using any internal VA-approved LLM Models platforms for analytics or documentation support within ISPL-ECSP. The Contractor shall assume all AI/LLM capabilities must be proposed, accredited, and documented from scratch, in accordance with VA security, privacy, and accreditation requirements.

65 General Do the VAAR set-aside requirements in accordance with VAAR 852.219- 73 also apply if the prime is not a Service-Disable Veteran-Owned Small Business (SDVOSB)/Veteran- Owned Small Business (VOSB)?

No, VAAR 852.219-73 only applies when the prime contractor is an SDVOSB/VOSB receiving a VA set-aside or preference. If the prime is not an SDVOSB/VOSB, the clause does not apply.

66 General If the proposed engagement teaming partnership includes a SDVOSB/VOSB, does the 50% allocation of work apply to the SDVOSB/VOSB subcontractor?

If the contract is set aside for SDVOSBs/VOSBs, the 50% work allocation requirement applies, in that not more than 50% of the amount paid by the government to the prime for contract performance will be paid to firms that are not certified SDVOSBs listed in the SBA certification database.

67 General What is the current staffing size for ISPL-ECSP, including government staff and other contractors?

The current staffing size is 20.

This number may increase if previously assigned FTEs are reinstated or if additional staffing needs are identified and filled in the future.

68 General In addition to FISCAM and FISMA audits, does ISPL also support management's assessment of internal controls over financial reporting for A-123 compliance? If so, who performs the management's assessment?

For this requirement, ISPL does not support systems or management’s assessment of internal controls over financial reporting for A-123 compliance in the manner described. The contract scope does not include support for A-123 compliance activities as performed by management.

69 General What is the anticipated volume of monthly/quarterly briefings that the ISPL-ECSP is responsible for supporting?

1-2 monthly briefings (the dashboards are used in 3-4 briefings per week).

70 General Does ISPL have any existing communication strategies and plans for stakeholders, or is this to be newly developed by the contractor?

ISPL has existing communication strategies and plans for stakeholders.

71 General Does ISPL-ECSP currently provide any audit related training to stakeholders, and if so, how many sessions?

ISPL-ECSP provides 15-20 trainings per month (FTE roles). Only 2-4 trainings total during each start of new audit year that require Contractor Support.

72 General Does ISPL-ECSP currently use a GRC tool for the OIT Audit Portal or is this entirely run on SharePoint?

It is currently run on SharePoint.

73 General Does ISPL-ECSP already have active licenses for the necessary tools (e.g., Power Platform) for the contractor to work on development of the BI

Yes, ISPL-ECSP already has the active licenses for the necessary tools.

artifacts, or will this procurement happen post contractor onboarding?