SSN 832469874 -SSAE 18_ DoD E-ICAM.docx

SOURCES SOUGHT NOTICE

Tracking Number: 832469874

The Defense Information Systems Agency (DISA) is seeking sources for Auditing Support Services for a Statement on Standards for Attestation Engagements Number 18 (SSAE 18) Examination Report for DISA’s Department of Defense (DoD) Enterprise Identity, Credential, and Access Management (E-ICAM) solution.

CONTRACTING OFFICE ADDRESS:

DISA/DITCO-Scott/PS8311 2300 East Drive, Bldg 3600 Scott AFB, IL 62225-5406

INTRODUCTION:

This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of small businesses and large businesses (including the following subsets: Small Disadvantaged Businesses, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and Woman-Owned Small Businesses) to provide the required products and/or services.

The Program Executive Office (PEO) Cyber (ID)/ Joint Enablers Division (ID2)/ Identity, Credential, and Access Management (ICAM) Branch (ID22) is seeking information from potential sources for audit support services to conduct a SSAE 18 Examination of the DISA’s DoD E-ICAM solution.

The DoD E-ICAM solution is an enterprise-wide capability to centrally monitor, manage, secure, and audit identity, access, and authorization across DoD Components. The DoD E-ICAM solution is composed of three main components: An Identity Provider (IdP), Automated Account Provisioning (AAP), and a Master User Record (MUR). DoD E-ICAM encompasses the full range of activities related to creating digital identities and maintaining associated attributes, issuing credentials for person/non-person entities, authenticating using the credentials, and making access management control decisions based on authenticated identities and associated attributes. DoD E-ICAM creates a secure and trusted environment where any user can access all authorized resources (including applications and data) to have a successful mission, while also letting DoD know who is on the network at any given time. The challenge faced by the DoD is to integrate and monitor data ingress and egress seamlessly between diverse vendor capabilities, to meet broad enterprise requirements, including the ability to audit who has access to what (and when) across diverse organizational boundaries. In July 2020, the DISA’s solution was formally approved as the DoD’s Enterprise ICAM capability in a memo issued by the Deputy Secretary of Defense.

This project consists of instantiating a Development, Test, and Production environment built within the Microsoft Azure IL4 cloud hosted environment with built-in high availability/Continuity of Operations (COOP) natively available in cloud solutions. The production environment is scoped to all 3.8 million DoD Common Access Card (CAC) holders supporting onboarded DoD applications (Financial Management [FM] and non-FM).

The anticipated Period of Performance is a one-year base period, plus four (4) one-year options.

The anticipated Place of Performance: Development and programmatic work shall be conducted primarily at the contractor’s site. It is expected that the Contractor will spend 20% of this time at DISA Headquarters, Fort Meade, MD in meetings and discussing the schedules and other programmatic details with DISA program personnel.

DISCLAIMER:

THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS NOTICE. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS NOTICE. ANY INFORMATION SUBMITTED BY RESPONDENTS IS STRICTLY VOLUNTARY.

CONTRACT/PROGRAM BACKGROUND: N/A

REQUIRED CAPABILITIES:

1) Describe and provide an example of your company’s experience with performing SSAE 18 examinations in accordance with standards established by the American Institute of Certified Public Accountants (AICPA) and Generally Accepted Government Auditing Standards (GAGAS), where your company audited DoD systems’ Service Organizations Controls (SOCs). Has your company performed at least three (3) SSAE 18 examinations on DoD SOCs? If yes, state how many have been performed.

2) Describe and provide an example of your company’s experience utilizing the Government Accountability Office (GAO) Federal Information System Controls Audit Manual, the GAO Financial Audit Manual (FAM) to include FAM450, for Controls’ testing methodology and planning. Has your company created at least three (3) test plans, executed tests, and reported on results for controls testing related to SSAE 18 examinations on DoD systems? If yes, state how many have been created, executed, and reported.

3) Describe and provide an example of your company’s experience with creating/writing SOC 1 Type II Report. Has your company completed at least three (3) SOC 1 Type II reports for DoD systems? If yes, state how many have been completed.

4) Describe and provide an example of your company’s experience with creating/writing Notice of Findings and Recommendations (NFRs) for SSAE 18s utilizing the Office of the Under Secretary of Defense’s (OUSD’s)-mandated format. Has your company completed at least three (3) NFR reports for DoD systems? If yes, state how many have been completed.

SPECIAL REQUIREMENTS:

In your response, confirm that you can meet the following requirements.

a. Your Company must have Secret Facility Clearance. Please provide your current Facility Clearance level.

b. Personnel must have final security clearance.

c. Your Company is an independent and licensed Certified Public Accounting firm.

SOURCES SOUGHT: The North American Industry Classification System Code (NAICS) for this requirement is 541211 with the corresponding size standard of $26.5M.

In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company’s ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting.

To assist DISA in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JVs) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice.

SUBMISSION DETAILS:

Responses should include:

1) Business name and address.

2) Name of company representative and their business title.

3) Small Business Socio-economic status (if small).

4) CAGE Code.

5) Prime contract vehicles; to include ENCORE III, SETI, NIH CIO-SP4, NASA SEWP V, General Service Administration (GSA): OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.)

Businesses who wish to respond must send a response via email NLT 4:00 PM Eastern Daylight Time (EDT) on August 21, 2024 to Rebecca.A.Roth5.civ@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions above (no more than five pages) demonstrating the ability to perform the services listed under Required Capabilities.

Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. All submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.

Page 2 of 4 Pages

Page 1 of 5 Pages