Amendment__2_and_Additional_Responses_to_Questions_(RFQ_91003118R0010).pdf

Amendment #2 and Additional Responses to Questions (RFQ 91003118R0010)

1. Extension of RFQ submission deadline

• The deadline for offerors to submit quotes in response to the RFQ is extended from 12:00

PM, June 28, 2018 (ET) to 4:00 PM, July 2, 2018 (ET).

• Offerors must acknowledge receipt of Amendment #2 with the quote submission, either in the body of the email or directly on the quote.

• Offerors have the opportunity to withdraw and resubmit their quote by the deadline.

2. Responses to questions

# Question from Vendor FSA’s Response

28 With respect to the 50 concurrent users. Our system offers a great deal of flexibility for user provisioning in order to reduce unnecessary license costs. This includes portal style access for those involved in responding to questions, assessing risks, or risk responses. Please provide additional details regarding the total number of system users with demographic breakdown of their use of the system.

User roles and anticipated system privileges are listed on page 24 of the RFQ. Most users will be in the metro DC area. The total number of licensed users required is 50.

29 Attachment A (H)(viii) “Software Alerts” refers to Microsoft Outlook. Please clarify as follows: Is the requirement to integrate with the email service accessed via Outlook, as opposed to a specific integration within the interface of Microsoft Outlook?

Alerts are needed for notification purposes.

FSA uses MS Outlook as its email system;

however, the software solution shall provide the alert/notification capability via the appropriate mechanism.

30 Attachment A (I) “Future Modules Not Required”:

While we understand that these capabilities are not required in your initial implementation, our system does accommodate these requirements for your future state. Do you anticipate adding these capabilities via an additional purchase order with an additional fee associated with the expanded use?

If FSA determines that the additional capabilities are needed in the future, FSA anticipates there will be an additional fee associated with the acquisition. However, because the modules may or may not be purchased, the additional fee associated with the modules shall not be included in the submitted quote.

31 On Page 28 section I. Future Modules - The evaluation method identified in the RFQ is low price technically acceptable. Per FAR 15.101-2 (1), proposals must meet or exceed certain acceptability standards. As currently described this section does not provide an objective threshold. The inclusion of terms such as "advantageous" and "while not essential" necessitate a trade-offs based approach which is now allowed to be considered in an LPTA award. We request this section be removed or

See revision to section “I. Future Modules, Not Required for Initial Implementation” in paragraph 3 below.

the evaluation type by changed to best value with tradeoffs.

32 On page 26, the RFQ notes that the software must be capable of performing quantitative analysis to support risk-based decision making.

Please define any specific types of analysis required to meet this standard. These could include Monte Carlo simulations, cost of risk quantification, historical risk modeling, etc.

FSA has not yet determined the specific type of quantitative analysis it will be conducting. FSA asks potential vendors to identify their respective software capabilities in this area for future use within the organization. The quantitative analysis tool(s) shall be similar, equivalent, or better than Monte Carlo simulations, cost of risk quantification, and historical risk modeling.

33 Please describe the quantitative analysis of risk that is being done currently in FSA.

Currently FSA is not conducting quantitative analysis. This is an activity scheduled for the near future.

34 Are there any requirements for the cloud web hosting (FedRAMP)?

Along with the requirements previously outlined in the RFQ, see revisions to section “C. Key Attributes of Software” and “D.

Software Services” in paragraph 3 below.

3. Revisions to “Attachment A: Enterprise Risk Management Software Requirements & Functionality”

The following sections of Attachment A in RFQ # 91003118R0010 are replaced with the following:

• Section C. Key Attributes of Software, ii. Software Security Attributes:

Software Security Attributes: The software shall be hosted in either a FedRAMP approved cloud with at least a moderate rating or within FSA’s Next Generation Data Center (NGDC). Regardless of the location, the software shall comply with FISCAM and NIST Security Requirements 800-53, 800-53A; meet encryption standard NIST 140-2; be compatible with Two Factor Authentication and Federal Personal Identity Verification (PIV) standards; possess access controls allowing for the maintenance and protection of personally identifiable information (PII); possess and allow role-based security permissions;

meet FSA’s Authority to Operate Standards and once deployed obtain the Authority to Operate; encrypt all data at rest and during data transit; possess the ability to create both privileged and non-privileged users accounts and controls.

• Section D. Software Services, i. Software Deployment

Software Deployment: The contractor shall follow NIST guidelines to develop the system security plan in collaboration with FSA. The contractor shall assist FSA in deploying the software within FSA’s Information Technology Enterprise environment. This includes installation and configuration of the risk management software; ensuring individuals can connect to the software; ensuring the solution can obtain the necessary Authorization to Operate; and any additional activities required to make the software operational.

• Section I. Future Modules, Not Required for Initial Implementation

FSA’s Enterprise Risk Management Program involves a wide range of FSA operational units working together. While not essential for initial implementation, FSA requires that the software possess capabilities same or equal to the modules below or have the ability to add additional modules that could be acquired in the future. However, FSA may or may not purchase these functionalities and therefore shall not be priced with the offeror’s quote.

Specific modules include:

• Internal Audit Module: FSA’s Enterprise Risk Management Office has an Internal Review Group (IRG) responsible for providing an independent view of the risks across FSA as a part of the overall Enterprise Risk Management Program. The IRG provides insight into the effectiveness of the risk mitigating activities to address risk across FSA. The IRG also performs internal reviews that are similar to internal audits. FSA requires a software module that allows work streams and products produced by the Internal Review Group to be input and tracked, as well as aligned with ERM information.

• Audit Tracking & Management Module: FSA’s Audit Advisory Group provides audit guidance to both FSA business units and external auditors to ensure that the most accurate, consistent, complete, and strategically effective responses are developed.

This team is responsible for compiling risk information across the FSA enterprise and ensures that it is reflected into inquiries, write-ups, recommendations, and general responses. FSA requires a software module that would allow for the tracking and monitoring of the Audit Advisory Group work streams and audit documents, including of corrective actions,.

• Internal Control (A-123A) Module: FSA’s Enterprise Risk Management Office works with FSA’s Internal Controls Team to coordinate work products and results to ensure significant areas of risk are appropriately documented and results are consistent.

Specifically, for risks identified on FSA’s Risk Profile (created by Enterprise Risk Management Office) that are determined by the Office of Management and Budget Circular A-123 that require formal internal controls, the Internal Control Team must identify relevant controls in place and links them to specific risks. FSA requires a software module that would allow for the linking of risks with their respective internal controls.