Responses_to_Questions__2.pdf

Responses to Questions #2 (RFQ 91003118R0010)

# Question from Vendor FSA’s Response 11 Can FSA provide any specifications for what the risk management software needs to do?

Specific requirements were provided in the RFQ.

12 Attachment A (D)(i) and (D)(iii) may not apply to SaaS given that the selected vendor is not installing any software on FSAs environment. Can this be confirmed?

Even though the vendor may not install any software in FSA environment, it still needs to provide pricing information for the activities listed in the RFQ. Vendor needs to account for all cost associated with providing the services within the given period of performance.

13 Attachment A (H)(vii) “restoration of modified data”:

Are we correct in assuming you expect the system to record correcting transactions and maintain the historical data entry for audit trail purposes rather than deleting or overwriting historical data which was entered?

Yes.

14 Can FSA advise how many business units exist within FSA that maintain their own risk registers?

FSA anticipates 15-20 individual risk registers; however, this number could increase based on the business needs of the organization.

15 How many layers of risk aggregation happen from the lowest business unit to the highest entity in the governance structure?

Currently, FSA is identifying four layers of risk aggregation.

16 Section C, iv (Page 23): Configuration – “The software must have drag and drop capabilities to allow administrators to easily make changes to the application, as needed.” What changes to the application are required?

FSA may want to modify the configuration of the software at some point to meet changing business needs and/or enhancements to the ERM program.

17 Section C, x (Page 23): 3rd Party Audits – “The software must be capable of third party audits on an ad-hoc basis.” What type of “3rd Party Audits” are being envisioned here?

The software should be able to produce reports that could be used by 3rd party auditors including the OIG and GAO to access FSA's ERM program.

18 Section D, i (Page 23): Software Development – “…and any additional activities required to make the software operational.” What do they mean by “additional activities… to make software operational”?

Additional activities required to make the software operational may include firewall configurations, applicable DNS certificates, etc.

19 Section H, I (Page 25): Software Administrator – “The software administrator must be capable of making updates to the software tables containing lists of values; access, view and print audit logs; and add and remove users from the software and defined user groups.” What data must “audit logs” contain?

Audit logs should contain, at a minimum, a list of changes to the data within the system, who made those changes, and when those changes were made.

20 Section H, vi (Page 27): Reporting Capabilities – “The software must allow users the ability to create, view, and print risk reports by aggregated risk scores and residual risk scores.” How does FSA define “aggregated risk scores and residual risk scores”?

FSA defines aggregation as the weighting of risk scores across multiple potential dimensions. For example, aggregation can be by risk type, residual risk scores, business unit or others, as appropriate.

21 How does FSA conduct risk management process today? Is it manual/paper based?

FSA currently uses MS Office products in creating its tools, templates and training materials.

22 Reference: C. Key Attributes of Software; iii. Mobile Device Capable Question: Can FSA describe a scenario in which FSA would need to utilize the tool on mobile devices? Is it for a specific purpose or just overall usage?

Senior leaders within FSA may want to access their individual risk information from their government issued mobile phone; however, this capability would be provided to all users.

23 Reference: H. Risk Management Software Functionality; vi. Risk Reporting; Risk Grouping Question: Are there a defined set of categories and subcategories? And is FSA looking to roll up metrics from the subcategories to the overall categories?

FSA has a list of risk categories and subcategories that will be provided to the vendor upon award. FSA is looking to aggregate risk information by both subcategories and categories.

24 Reference: H. Risk Management Software Functionality; iv. Risk Monitoring, Quantitative and Quantifiable Risks.

Question: There was mention of conducting quantifying analysis on qualifiable risks. Is there a certain framework that is currently used for quantifying risks such as FAIR?

FSA is not currently using a particular framework to quantify risks.

25 With respect to the 90 day implementation timeline, when will FSA have all workflow, data and framework/process decisions available for the selected vendor?

FSA will have workflow, data and framework/process decisions available for the selected vendor within 5 business days upon contract award.

26 With respect to the 90 day implementation timeline, when will FSA have all subject matter experts, project participants and decision makers available with full capacity for project work?

FSA will have all project participants and decision makers available within 5 business days upon contract award.

27 With respect to the 90 day implementation timeline, when will FSA have all staff and a facility available for a first working meeting with selected vendor?

FSA will have all staff and a facility available within 5 business days upon contract award. Specific date/time will be dependent on schedules of participants.