842470142 Sources Sought Notice.docx

SOURCES SOUGHT NOTICE

Tracking Number: PS

The Defense Information Systems Agency (DISA) is seeking sources for a Statement on Standards for Attestation Engagement (SSAE) 18 examination of DISA’s J-9 Hybrid Computing Services, J-9 Stratus Infrastructure as a Service (IaaS), Acquisition Directorate (ACQ) Department of Defense Automated Time, Attendance, and Production System (DATAAPS) program, and ACQ DoD Enterprise Identity, Credential, and Access Management (E-ICAM) Solution.

CONTRACTING OFFICE ADDRESS:

DISA, Defense Information Technology Contracting Organization (DITCO) 2300 East Drive, Bldg 3600 Scott AFB, IL, 62225-5406

INTRODUCTION:

This is a SOURCES SOUGHT TECHNICAL DESCRIPTION to determine the availability and technical capability of large and small businesses (including the following subsets: Small Disadvantaged Businesses, HUBZone Firms, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and Woman Owned Small Business) to provide the following required services:

DISA is seeking potential sources for consulting and audit support services to conduct: (1) A SSAE 18 examination of DISA’s J-9 Hybrid Computing Services, to report on whether general controls established and implemented by DISA are fairly presented, suitably designed, and operate effectively; (2) A SSAE 18 examination of the ACQ DATAAPS program, to report on whether general and application controls established and implemented by DISA are fairly presented, suitably designed, and operate effectively; (3) A SSAE 18 examination on the J-9 Stratus IaaS to report on whether general and application controls established and implemented by DISA are fairly presented, suitably designed, and operate effectively; and (4) A SSAE 18 examination of the ACQ DoD E-ICAM Solution, to report on whether general and application controls established and implemented by DISA are fairly presented, suitably designed, and operate effectively.

DISA’s J-9 Hybrid Computing Services, J-9 Stratus IaaS, ACQ ATAAPS, and ACQ DoD E-ICAM Solution engagements cover a collection of services with a scope covering more than 400 financial system controls, more than 100 financial systems, more than 10 different operating systems including no less than two different mainframe environments, and several different databases. Additionally, ACQ DoD E-ICAM Solution consists of a Development, Test, and Production environment built within the Microsoft Azure IL4 cloud hosted environment with built-in high availability/Continuity of Operations (COOP) natively available in cloud solutions. The production environment is scoped to all 3.8 million DoD Common Access Card (CAC) holders supporting onboarded DoD applications (Financial Management [FM] and non-FM).

The contractor will produce four System and Organization Controls (SOC) 1 Type II reports. In conjunction with the reports, the contractor will provide, in writing, a description of any weaknesses discovered and recommendations on remedies. The contract type for this effort will be firm fixed price with a cost reimbursement Contract Line Item Number for contactor travel.

The Anticipated Period of Performance: September 10, 2025 – September 09, 2030.

The Anticipated Places of Performance are DISA CONUS (multiple sites): Ft Meade, Maryland; Mechanicsburg, Pennsylvania; Ogden, Utah; Montgomery, Alabama; Columbus, Ohio; Oklahoma City, Oklahoma; and San Antonio, Texas.

DISCLAIMER:

THIS SOURCES SOUGHT IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS ANNOUNCEMENT. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS ANNOUNCEMENT. ANY INFORMATION SUBMITTED BY RESPONDENTS TO THIS TECHNICAL DESCRIPTION IS STRICTLY VOLUNTARY.

CONTRACT/PROGRAM BACKGROUND:

Contract/Order Number: GS-00F-290CA / HC1028-20-F-0895 Order Type: Firm fixed price and cost reimbursable contract line item number for travel Incumbent and their size: Ernst and Young, LLP (other than small business) Method of previous acquisition: Fair opportunity on General Services Administration (GSA) Information Technology (IT) Schedule 70 Period of Performance: Sept 10, 2020 – Sept 09, 2025

The incumbent contractor performs the SSAE 18 examinations in accordance with standards established by the American Institute of Certified Public Accountants and (Government Accountability Office (GAO)) Generally Accepted Government Auditing Standards (GAGAS). They are using the GAO Federal Information System Controls Audit Manual (FISCAM), the GAO Financial Audit Manual, and SSAE 18 standards to develop the methodology and detailed attestation steps for the SSAE 18 examination as well as testing at least nine (9) months of data for the SSAE 18 examination.

REQUIRED CAPABILITIES:

A SSAE 18 examination is performed when an application is identified by the Office of the Under Secretary of Defense as being Internal Control Over Financial Reporting (ICOFR) relevant. DISA DATAAPS is an ICOFR relevant application. DISA J-9 Hybrid Computing Services, J-9 Stratus IaaS and ACQ DoD E-ICAM Solution are subservice organizations for many ICOFR relevant applications and perform a SSAE 18 engagement as a subservice organization. A subservice organization SSAE 18 engagement is designed to provide the DISA customer and their auditors with information about DISA’s internal control environment to meet complimentary subservice organization controls inherited in the customers’ own SSAE 18 examinations.

In performing the SSAE 18 examination, the contractor shall report upon its examination of DISA’s J-9Hybrid Computing Services, J-9s Stratus IaaS, ACQ DATAAPS and ACQ DoD E-ICAM Solution descriptions of their systems that DISA provides to its user entities.

In addition, the contractor’s examination will also report on the control activities related to the control objectives stated in the description were suitably designed to provide reasonable assurance that the control objectives would be achieved if the controls operated effectively throughout the specified period, and the controls operated effectively to provide reasonable assurance that the control objectives stated in the description were achieved throughout the specified period if complementary subservice organization and user entity controls assumed in the design of the service organization’s controls operated effectively throughout the specified period. A report on management’s description of its system and the suitability of the design and operating effectiveness of controls is commonly referred to as a SOC 1 type II report.

The examination and reporting must comply with GAGAS.

Describe your capability to provide SSAE 18 services by submitting the following.

1. Company shall be an independent and licensed Certified Public Accounting firm and perform SSAE 18 examinations in accordance with standards established by the AICPA and GAGAS. Provide a copy of current CPA documentation.

2. Company shall describe the number of SSAE 18 examinations conducted within the DoD, how many examined services were provided by a subservice organization and how many from the activity of a program office; wherein the respondent was the signor on the opinion report and the methodology used in conduct of the examinations was in accordance with GAGAS.

3. Company shall have the capability to assess multiple unique technology operating environments and currently employs staff that has experience in auditing these technologies. Provide a summary of capabilities in reviewing multiple technology environments.

4. Company shall be an established and creditable firm with technical IT expertise and substantial experience in data center audits. Provide the latest copy of the firm’s peer review report.

5. Company shall provide a statement that the firm is not currently doing work for the DoD Component that would impair its independence.

6. Company shall describe and/or provide an example of their experience with creating/writing an attestation plan, test plan, audit program, summary/detailed workpapers, and Notice of Findings and Recommendations (NFRs).

SPECIAL REQUIREMENTS

The company shall ensure that all persons working on this effort, both auditors and managers, are U.S. citizens and have at least an ADP-II noncritical-sensitive classification, in accordance with DoD 5200.2-R. Provide certification or statement of capability documenting your company meets at least an ADP-II noncritical-sensitive classification, in accordance with DoD 5200.2-R.

The work to be performed under this contract is up to the Secret level. Therefore, the company must have a final Secret Facility Clearance (FCL) from the Defense Security Service (DSS) Facility Clearance Branch (FCB). Provide a copy of your current Facility Clearance level.

The company must ensure they have adequate staff available with no less than Secret Level Clearances that have actively participated in SSAE 18 examinations of subservice organization processes and have actively participated in activity of a program office at the time of contract award. Provide resumes for a mix of labor categories of assigned qualified audit staff with Secret Level Clearances to meet the requirements of the PWS tasks.

SOURCES SOUGHT:

The anticipated North American Industry Classification System Code (NAICS) for this requirement is 541211, with the corresponding size standard of $26.5M. This Sources Sought Synopsis is requesting responses to the following criteria from large and small businesses that can provide the required services under the NAICS Code.

In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company’s ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting.

To assist DISA in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JVs) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice.

SUBMISSION DETAILS:

Responses should include:

1) Business name and address;

2) Name of company representative and their business title;

3) Type of Small Business;

4) Cage Code;

5) Prime contract vehicles; to include ENCORE III, SETI, NIH CIO-SP4, NASA SEWP V, General Service Administration (GSA): OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.)

Vendors who wish to respond to this should send responses via email no later than 4:00 PM Eastern Time (ET) on 20 November 2024 to olivia.m.koch3.civ@mail.mil and KO ivany.m.ortiz.civ@mail.mil. Interested businesses should submit a brief capabilities statement package (no more than five pages) demonstrating ability to meet the required capabilities and special requirements listed in this Technical Description and the attached PWS.

Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. Please be advised that all submissions become Government property and will not be returned. All government and contractor personal reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as described 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.