Competitive Solicitation_GG000000-26-00063_vF.pdf

DEPARTMENT OF COMMERCE

SHARED SERVICES PROCUREMENT OFFICE

REQUEST FOR QUOTATION

Cloud-Based GRC / Cyber Risk Compliance Automation Platform (FISMA High SaaS)

REQUEST FOR QUOTATION:

Cloud-Based GRC / Cyber Risk Compliance Automation Platform (FISMA High SaaS)

FOR

Office of Inspector General (OIG)

Table of Contents

1.0 General Instructions

2.0 Communications and Questions

3.0 Quotation Organization

3.1 Section Technical Contents

3.2 Section Price .................................................................................... Error! Bookmark not defined.

4.0 Evaluation Factors

5.0 Clauses Applicable To This Solicitation

Clauses Incorporated by Reference

6.0 Applicable Attachments

1.0 General Instructions

This Request for Quotation (RFQ) will result in a Firm-Fixed-Price Purchase Order issued in accordance with Simplified Acquisition Procedures . The Government intends to use streamline procedures applicable to commercial services and Simplified Acquisition Procedures. Offers shall be submitted in electronic format to:

Agency Contact: Alicia Brister, abrister@doc.gov

Contracting Officer: Jameka Anderson, janderson1@doc.gov

Quotations Due Date: September 28, 2026, at 11:00 AM EST

Quotations are valid for 120 calendar days unless otherwise stipulated by the Offeror.

Hard copies will not be accepted.

In response to this RFQ, the Offeror shall prepare a detailed quotation for meeting all stated requirements and comply with the following limitations and characteristics:

• Do not include marketing materials

• Margins (Top, Bottom, Right and Left) no smaller than 1" (headers and footers are allowed in the margins)

• Submission shall be provided in electronic format only

• Arial size 11 font or Times New Roman 12 font shall be used

• Offers shall be submitted in a format readable by Microsoft (MS) Word 2007, MS Excel 2007, (or later) or in text searchable PDF format, as applicable.

• Quotations shall be limited to a total of 03 Pages for the Technical Quotation and 02 Pages for the Price Quotation. Quotations shall be subdivided into sections/electronic files as follows: Section 1 Technical Quotation and Section 2 Price Quotation.

2.0 Communications and Questions

Communications shall be conducted electronically by e-mail to the Agency Contact and Contracting Officer as stated in Section 1.0 General Instructions.

The due date for communications and questions concerning this RFQ is September 21, 2026, 11:00 AM EST. Questions received after the cut-off date will NOT be considered.

Any information given to one Offeror concerning this requirement will be furnished at the same time to other prospective Offerors, if that information is necessary in submitting offers, or if lack of it would be prejudicial to the other prospective Offerors. The Government may elect not to respond to questions mailto:abrister@doc.gov mailto:janderson1@doc.gov received after the deadline. Responses to questions that materially affect the solicitation will be made available to all prospective quoters through SAM.gov.

3.0 Quotation Organization

Quotation materials shall be organized as follows: Quotation shall identify the appropriate Technical (Part Numbers), Labor Categories (if applicable) and include the Total Price.

To be acceptable, the quotation must meet all the constraints set forth in the Statement of Work Submit electronic file(s) via email to ABrister@doc.gov and JAnderson1@doc.gov.

3.1 Technical Contents

Conformance of the proposed items/services to the technical requirements set forth in the Statement of Work It shall indicate the firm’s capabilities and the means used to satisfy the requirements stated in the attached Statement of Work. The Offeror is encouraged to propose any innovative solutions that meet the performance and technical requirements for this procurement.

3.2 Price

The Offeror shall provide a price that reflects their proposed solution to the Government’s requirements. The price to perform the work or deliver the specified product, shall be for a period of performance and/or delivery requirements as identified in the Statement of Work. The Offeror’s pricing shall be in accordance with its current Proposed Open-Market Pricing.

4.0 Evaluation Factors

The Government will issue a Firm-Fixed-Price Purchase Order resulting from this RFQ to the responsible Offeror using the Best Value Tradeoff source selection process.

The following factors will be used to evaluate quotations.

(1) Technical

The Quote will be evaluated on:

The Offeror’s approach and capability to meet the requirements of the Statement of Work will be evaluated.

• Demonstrated understanding of the requirements while providing products and/or services that meet the specific technical requirements.

• Identify the proposed commercial SaaS solution and all modules necessary to satisfy the requirement;

• Address each Mandatory requirement identified in the SOW and identify where supporting information can be found in the quotation;

mailto:ABrister@doc.gov mailto:JAnderson1@doc.gov

• Provide the applicable FedRAMP Marketplace package identification demonstrating that the proposed solution and required modules are within an active FedRAMP High authorization boundary;

• Describe the proposed implementation/deployment approach and demonstrate the ability to achieve full operational capability within the timeframe specified in the SOW;

• Describe the approach to Microsoft 365/Azure and JCAM integration, as applicable;

• Provide the customer references required by the SOW; and

• Identify any assumptions, exceptions, or dependencies affecting performance.

Failure to satisfy a Mandatory requirement may render the quotation technically unacceptable.

(2) Price.

Submit total offered pricing in accordance with the items identified in the Statement of Work and current Open Market Proposed Pricing.

Award may be made without exchanges with quoters. Accordingly, quoters are encouraged to submit their best technical and price quotation in their initial submission.

5.0 Provisions and Clauses Applicable To This Solicitation

Provisions and Clauses Incorporated by Reference

52.212-1 Instructions to Offerors—Commercial Products and Commercial Services (SEP 2023) 52.204-7 System for Award Management (NOV 2024) 1352.213-70 Evaluation Utilizing Simplified Acquisition Procedures (APR 2010) 1352.239-71 Electronic and Information Technology (APR 2010) 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services (NOV 2023) 1352.201-70 Contracting Officer's Authority (APR 2010) 1352.209-73 Compliance with the Laws (APR 2010) 1352.209-74 Organizational Conflict of Interest (APR 2010) 1352.213-70 Evaluation Utilizing Simplified Acquisition Procedures (APR 2010) 1352.239-70 Software License Addendum (APR 2010) 1352.246-70 Place of Acceptance (APR 2010) 1352.239-72 Security Requirements for Information Technology (APR 2010) 1352.246-70 Place of Acceptance (APR 2010) 1352.270-70 Period of Performance (APR 2010)

All open market pricing, and FAR/RFO terms and conditions apply to this solicitation.

6.0 Applicable Attachments

a. Statement of Work

Statement of Work

1. General Information/ Background and Purpose The Department of Commerce, Office of Inspector General (OIG) requires a cloud-based Governance, Risk, and Compliance (GRC) automation platform to support the full Risk Management Framework (RMF) lifecycle, FISMA documentation, audit support, and continuous monitoring reporting. The requiring office operates with a limited security staff of approximately three (3) full-time personnel and requires a solution with a high degree of automation and AI assistance to sustain these functions without a corresponding increase in staffing.

The Risk Management Framework (RMF) provides a common information security framework for the Federal Government. It is based on publications by the National Institute of Standards and Technology (NIST) and is integral to implementation of the Federal Information Security Modernization Act (FISMA).

The RMF, explained in NIST SP 800-37 Rev. 2, provides a structured approach to integrate risk management and information security into the system lifecycle through preparation, categorization, control selection, control implementation, control assessment, authorization, and continuous monitoring.

The requiring office is Department of Commerce, Office of Inspector General, a federal law enforcement oversight component operating a security team of approximately three (3) full-time staff, responsible for RMF authorization and continuous monitoring of up to five (5) information systems within a FISMA High categorization boundary.

This SOW covers acquisition of a commercial, cloud-based Governance, Risk, and Compliance (GRC) automation platform — not RMF assessment labor services — to automate FISMA documentation, AI-assisted control drafting, and continuous monitoring reporting for the requiring office's systems.

2. Period of Performance Base period: 12 months from award

Offerors shall structure pricing using the following CLIN framework:

CLIN Period Scope

0001 Base Year Software licensing/subscription, hosting/SaaS fees, and all professional deployment/implementation services (installation, configuration, onboarding, training).

Offerors shall itemize CLIN 0001 to separately identify (a) software licensing/subscription cost and (b) professional deployment/implementation services cost, All costs associated with the base period, including but not limited to: software licensing/subscription fees, hosting/SaaS fees, and all professional deployment and implementation services (installation, configuration, onboarding, training, and any other one-time setup costs) necessary to bring the solution into full operational use.

3. Scope The scope of this acquisition includes:

● A FedRAMP High-authorized, commercially available cloud GRC/AI compliance automation platform, licensed for use on up to five (5) information systems.

● Automated generation of FISMA documentation, including System Security Plans (SSPs), Security Assessment Reports (SARs), and control implementation narratives, with human-reviewable AI-assisted drafting.

● Automated continuous monitoring evidence collection, control validation, and Plan of Action and Milestones (POA&M) generation, supporting reporting to the Joint Cybersecurity Authorization Management (JCAM) system.

● Secure, FIPS-validated connectivity between the requiring office's Microsoft 365/Azure environment and the GRC SaaS environment.

● A fixed-scope professional deployment/implementation engagement bringing the platform to full operational capability within the timeline specified in Section 3.5.3.

3.1 References

The contractor shall be familiar with the following federal policies, standards, and guidelines, or later versions as applicable:

Reference Description / Title

FISMA Federal Information Security Modernization Act (2014)

FIPS 199 Standards for Security Categorization of Federal Information and Information Systems

FIPS 200 Minimum Security Requirements for Federal Information and Information Systems

NIST SP 800-30 Rev 1 Guide for Conducting Risk Assessments

NIST SP 800-37 Rev 2 Risk Management Framework for Information Systems and Organizations

NIST SP 800-53 Rev 5 Security and Privacy Controls for Federal Information Systems and Organizations

Reference Description / Title

NIST SP 800-53A Assessing Security and Privacy Controls in Federal Information Systems and Organizations

NIST SP 800-137 Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations

OMB A-130 Managing Information as a Strategic Resource

40 U.S.C. 11331 Responsibilities for Federal Information Systems Standards

P.L. 93-579 Privacy Act, December 1974

3.2 Requirements/Tasks

The contractor shall deliver a solution meeting the requirements below. Requirements marked “Mandatory” are minimum capabilities the delivered solution shall meet; failure to meet any Mandatory requirement constitutes non-conformance under Section 4.4. Requirements marked “Desired” are considered in evaluation but do not independently determine acceptability.

3.2.1 Automation and AI-Assisted Compliance Documentation

Req. ID Requirement Type

REQ-AUT-01 Automated ingestion of system inventory and asset data from existing scanning/configuration management tools without manual entry.

Mandatory

REQ-AUT-02 Automated generation of System Security Plan (SSP), Security Assessment Report (SAR), and control implementation narrative content directly from ingested system data.

Mandatory

REQ-AUT-03 AI-assisted drafting through a human-in-the-loop, directly reviewable interface requiring explicit human approval of each AI-generated statement prior to submission. Fully autonomous (agentic) generation/submission without a per-statement human review step does not meet this requirement.

Mandatory

REQ-AUT-04 Automated continuous monitoring evidence collection and control validation.

Mandatory

REQ-AUT-05 Automated Plan of Action and Milestones (POA&M) generation from scan/assessment findings.

Mandatory

3.2.2 FedRAMP High Authorization

Req. ID Requirement Type

REQ-FIS-01 The solution, including all proposed modules necessary to meet these requirements, shall hold an active FedRAMP High authorization at time of quote submission. “FedRAMP Ready”, “In Process”, or FedRAMP Moderate does not meet this requirement.

Mandatory

REQ-FIS-02 Offeror shall identify the FedRAMP Marketplace package ID confirming the authorization boundary includes all proposed modules.

3.2.3 Deployment and Professional Services

REQ-DEP-01 The contractor shall complete a defined, fixed-scope implementation engagement, from contract award to full operational capability (including connectivity setup, platform configuration, system onboarding, JCAM integration and testing, training, and pilot validation), not to exceed twelve (12) weeks.

Mandatory

REQ-DEP-02 The implementation engagement shall be performed by the contractor's own personnel or a documented subcontractor/partner with demonstrated experience implementing this platform in a federal FISMA High environment.

Mandatory

REQ-DEP-03 The contractor shall provide at least two (2) federal customer references for prior implementations of comparable scope.

Mandatory

REQ-DEP-04 The contractor should provide a phase-by-phase implementation schedule supporting the timeline in REQ-DEP-01, identifying any dependencies outside the contractor's control (such as JCAM onboarding).

Desired

3.5.4 Secure Data Transmission (Microsoft 365 / Azure Integration)

REQ-SEC-01 All data transmitted between the requiring office's systems and the GRC SaaS environment shall be encrypted using FIPS 140-2/140-3 validated cryptographic modules, TLS 1.2 or higher.

REQ-SEC-02 The contractor shall provide a private, non-public-internet B2B connectivity option (e.g., Azure Private Link, ExpressRoute, or equivalent) as an alternative to public-internet-only API access.

Mandatory

REQ-SEC-03 The solution shall integrate with the requiring office's Azure Active Directory (Entra ID) and Microsoft Graph API using a least-privilege, scoped OAuth application registration, with no standing or shared administrative credentials.

3.5.5 Licensing Scope

REQ-LIC-01 The quoted software license shall permit use for up to five (5) information systems within the base period price, with no additional per-system licensing fee for systems five (5) or fewer. The contractor shall state the incremental cost, if any, for each additional system beyond five (5).

Mandatory

REQ-LIC-02 Option year pricing shall reflect the same five (5)-system licensing scope as the base period unless the Government exercises an option to expand system count.

4.0 DELIVERABLES, INSPECTION, AND ACCEPTANCE

4.1 Scope of Inspection

All deliverables will be inspected for content, completeness, accuracy, and conformance with this SOW/RFQ and the specifics of the implementation.

4.1 Scope of Inspection