CORHQ-26-Q-0073 Updated.pdf

SOLICITATION/AWARD

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NO. 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. CONTACT INFORMATION 8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. N/A

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODE17a. CONTRACTOR/

OFFEROR

CODE

FACILITY

CODE

CODE

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

RFQ RFP

Price only

SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QTY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. N/A 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

29. AWARD OF CONTRACT: REF.

YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. FEDERAL DEPOSIT INSURANCE CORPORATION (SIGNATURE OF CO)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

FDIC 3700/55 (3-08)

10. SOCIO-ECONOMIC STATUS

NO

NAICS:

ETHNICITY:

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

OFFER

13a. SUB-CONTRACTING

PERMITTED/APPROVED

YES

SDB

MWOB

SERVICE-DISABLED VETERAN-

OWNED SMALL BUSINESS

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

YES NO

YES NO

27a. SOLICITATION INCLUDES ATTACHMENTS 27b. AWARD INCLUDES ATTACHMENTS

RFI RFP

Best Value

CORHQ-26-Q-0073

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QTY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

40. PAID BY

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELPHONE NUMBER OF AUTHORZED GOVERNMENT REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

PARTIAL FINAL

37. CHECK NUMBER

38. S/R ACCOUNT NO. 39. S/R VOUCHER NUMBER

36. PAYMENT

COMPLETE PARTIAL FINAL

FDIC 3700/55 (3-08)

Section B - Supplies or Services and Prices/Costs

CLIN # Description Quantity Unit Unit Price Total Price

0001 RFI - New Budget Formulation System

Tool

1 EA

No attachments were added for this section.

Section B - Supplies or Services and Prices/Costs PAGE 3 OF 19

Section C - Description/Specifications/Work Statement

Attachments for this section start after this page.

Section C - Description/Specifications/Work Statement PAGE 4 OF 19

FDIC

Budget Formulation Tool Request for Information

1.0 Purpose

The Federal Deposit Insurance Corporation (FDIC) is conducting market research to explore FedRAMP certified software applications supporting budget formulation activities.

The purpose of this Request for Information (RFI) is to identify potential budget formulation tools, gather information to compare tool functionalities, and understand the pricing structures associated with these tools.

2.0 Budget Formulation Tool Requirements

The Budget Formulation Tool must meet the following requirements:

• The vendor and system must adhere to all FDIC Terms and Conditions.

• The system must be FedRAMP certified at “Low” or higher authorization and must be currently used by other federal agencies.

• The system must have a secure platform to store budgetary and staffing data and adhere federal laws, guidelines and executive mandates.

• The system must have the capability to provide multiple environments, with ability to transfer system objects and data between the environments. The system must be a web-based application and must have the ability to provision at least 60 user accounts with role-based access control to include Administrator, Power User, Standard User (budget analyst), and read-only access. The system must also include an audit log. Single-sign-on capability is desirable.

• The system must allow data exchange, such as CSV data import and export.

Compatibility for API with other systems is desirable.

• The system must be able to retain up to ten years of actual financial transaction data and personnel information, summarized by at least 25 unique data elements.

• The system must include a User Interface to submit budget and staffing adjustments.

• The system must have the ability for administrators to enter calculation logic necessary to aggregate inputs and forecast salary and non-salary budgets using various drivers.

• The system must be configurable to allow for calculation and reporting with static and dynamic variables.

• The system must have the ability to save and compare multiple budget scenarios.

Section C - Description/Specifications/Work Statement PAGE 5 OF 19

• The system must include the ability to create standardized, professional reports with fixed data elements and user prompts for parameter selections to filter the report data. Reports must be available in both PDF and MS Excel formats.

• The system must include Ad hoc analyses tool for users (e.g. through Excel-enabled pivoting).

3.0 RFI Response Requirements

• Questions about this RFI are due no later than 12 Noon ET February 27, 2026.

• Responses to this RFI are due no later than 9 am ET March 24, 2027.

• All questions and responses should be emailed to the Contracting Officer: Ellisha

Smith (ellismith@FDIC.gov). All submissions will receive a confirmation email within 72 hours. If you do not receive a confirmation email, please follow up with the Contracting Officer.

• Emails related to this RFI should include a subject line titled “(insert Company Name) - FDIC Budget Formulation Tool RFI Response.”

• RFI responses include a written response and a system demo.

o The written response will be limited to 5 pages measuring 8.5 by 11 inches, in either PDF or Word format. File size should not exceed 5MB.

o The system demo will be scheduled within one month of the RFI submission close date.

• Proprietary information, if any, should be minimized to the extent possible and must be clearly marked.

• RFI responses should include the following:

Written Responses

• Provide company name, local contact mailing address, phone number, e-mail address of designated point of contact, and DUNS number.

• Provide the name and FedRAMP ID of the budget formulation application.

• Provide a list of federal clients currently using the budget formulation application, including the federal agency name and client POC contact details.

• Briefly describe how the tool meets the requirements listed in Section 2.0.

• Identify any unique advantages of the application.

• Describe system implementation activities required for the application, including approximate timeframes.

• Describe the standard pricing model and contract structure for the application.

Section C - Description/Specifications/Work Statement PAGE 6 OF 19

System Demo

• The 60-minute virtual system demo will include a product demonstration and allow time for questions. The session may be recorded.

• The vendor should demonstrate how the tool can be used in the federal budget environment, including how data can be ingested, transformed, stored, and made available to administrators, power users, and regular users, including via ad hoc analysis.

• The vendor should demonstrate how security roles can be used for segregation of activities.

• The vendor should show that budget and staffing data can be securely stored, and that staffing data can be used to calculate budget requirements.

• The vendor should be prepared to respond to the following questions:

o What type of budgeting does this tool support? (annual operating, investment, multi-years, etc.)?

o Does the tool include the ability to forecast with scenarios o How customizable are the budget dimensions?

o How are business rules defined and changed?

o How does the tool reflect hierarchies in the organizational data?

o What products can the tool interface with for data exchange? How does integration work?

o How are versions and approvals tracked?

o In what formats can reports (or data) be exported?

o What makes this tool unique?

o Demonstrate power user ad hoc reporting capability (quick report development may be requested) o Please describe the standard implementation activities and timeline.

o How does the pricing structure work?

Section C - Description/Specifications/Work Statement PAGE 7 OF 19

Section H - Special Contract Requirements

No attachments were added for this section.

Clauses Incorporated By Reference

Clause # Title Date

No reference clauses were found for this section.

Full Text Clauses

7.4.2-01 - Security and Privacy Compliance for IT Services - September 2024

(a) Security and Privacy Compliance. The Contractor is responsible for Information Technology (IT) security for

Contractor personnel and subcontractor personnel granted access to: sensitive information as defined in FDIC

Directive 1360.09 (and referenced throughout this contract as ‘sensitive’ or ‘FDIC-sensitive information’); the FDIC network; systems connected to the FDIC network; and systems developed, maintained, implemented or operated by the Contractor for FDIC. All IT products and services provided by the Contractor that collect, process, maintain, or store FDIC-sensitive information shall comply with all FDIC information security and privacy directives, policies and requirements unless Contractor obtains a written waiver from FDIC Information Security/Privacy staff.

(b) Laws and Standards. All IT products and services provided by the Contractor that collect, process, maintain, or store FDIC-sensitive information must comply with Federal laws and standards addressing information security and privacy. These include but are not limited to:

(1) The Privacy Act of 1974 (5 U.S.C. § 552a) as amended (if incorporated in the contract);

(2) Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources

(Transmittal Memorandum No. 4) including Appendices;

(3) E-Government Act of 2002 (P. L. 107-347) including Title II, Section 208 - Privacy Provisions and Title III -

Federal Information Security Modernization Act of 2014 (FISMA), and related OMB guidance; and

(4) National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) and

Special Publications.

(c) FDIC Policy and Guidance. All IT products developed by and IT development services provided by the

Contractor, specifically for FDIC, shall address information security and privacy requirements throughout their design, development, implementation, maintenance, operation, and termination as provided in FDIC system development life cycle policy and guidance. This includes completing or providing the necessary information for the

FDIC to complete privacy impact assessments, security assessments, risk assessments, security plans, contingency plans, and other security and privacy artifacts as required.

(d) Subcontracts. Contractor must ensure this clause is included in all first-tier subcontracts and lower-tier levels of subcontracts to which the conditions and requirements described in this clause would apply.

Section H - Special Contract Requirements PAGE 8 OF 19

7.4.2-02 - Off-site Processing and Storing of FDIC Information - August 2018

(a) Control and Protection of FDIC Information. The Contractor shall implement effective, administrative, technical, and physical safeguards to ensure that all FDIC information in its possession or under its control is adequately protected from loss, misuse, and unauthorized access or modification. The creation, collection, use, processing, storing, maintenance, dissemination, disclosure, and disposal of FDIC information shall comply with all applicable federal and state laws and FDIC directives, rules and regulations regarding protection of information. The

Contractor shall not use any FDIC information except to the extent necessary to carry out its obligations under the contract. The Contractor shall not disclose FDIC information to any third party unless disclosure is authorized in the contract, the Contractor obtains the prior written consent of the Contracting Officer, or to the extent expressly required by applicable law, in which case the Contractor shall notify the Contracting Officer at least ten (10) business day before such disclosure, to allow the FDIC to object or concur. The Contractor, subcontractor, or any entity under the Contractor’s control shall not access, disseminate, maintain, store, use or disclose FDIC information outside the United States, unless specifically directed by the contract or otherwise authorized by the

Contracting Officer.

(b) Return, Destruction and Retention of FDIC Information. All FDIC information remains the property of the FDIC.

Upon completion or termination of the contract, or at any time upon request of the Contracting Officer, Contractor shall promptly return to the Oversight Manager all FDIC information in its possession and/or securely dispose of it as required in the contract, Statement of Work, or as directed by the Oversight Manager. Information shall be returned securely in a format directed by the Oversight Manager. Retention of FDIC information by the Contractor beyond the conclusion of the contract is only permissible in accordance with clause 7.6.3-02, Contractor Return, Destruction and Retention of FDIC Information.

(c) Inspections/Assessments/Audits/Reviews/Examinations. To confirm Contractor’s compliance with this contract, as well as any applicable laws, regulations and industry standards, Contractor shall grant FDIC information security and privacy staff, the FDIC Office of the Inspector General, the U.S. Government Accountability Office (GAO), or an

FDIC-selected third party acting on the FDIC’s behalf, permission to perform inspections, assessments, audits, reviews or examinations of all controls in Contractor’s physical and/or technical environment in relation to all FDIC information being handled and/or services being provided to FDIC pursuant to this contract. The Contractor shall fully cooperate by providing access to knowledgeable personnel, physical premises, documentation, infrastructure and application software that collects, processes, transmits, or stores FDIC information pursuant to this contract.

These inspections, assessments, audits, reviews, and examinations may be conducted either by phone, electronically or in-person. Nothing in this clause shall be viewed as limiting the FDIC or the federal government’s audit and inspection rights delineated in other clauses of this contract or by statute.

(d) Security and Privacy Incident Handling. The Contractor shall monitor its facility, premises and information systems for security and privacy incidents and provide the capability to respond to and resolve them effectively and in a timely manner, including allowing for inspection, investigation, forensic analysis, and any other action necessary to ensure compliance with OMB M-17-12 and FDIC’s Breach Response Plan, and to assist in responding to a breach. FDIC’s Breach Response Plan is available at the FDIC website:

https://www.fdic.gov/buying/goods/acquisition/index.html. The Contractor and subcontractors (at any tier) shall report a suspected or confirmed breach in any medium or form, as soon as possible and without unreasonable delay, consistent with FDIC’s Breach Response Plan. All security and privacy incidents that involve FDIC information must be immediately reported to FDIC’s Computer Security Incident Response Team (CSIRT)/Security

Operations Center (SOC) at the telephone/email address provided in paragraph (e) below. The Contractor and

Section H - Special Contract Requirements PAGE 9 OF 19 subcontractors (at any tier) shall cooperate and exchange information with agency officials in order to effectively report and manage a suspected or confirmed breach. The Contractor shall maintain capabilities to, at a minimum, determine what FDIC information was or could have been accessed and by whom, construct a timeline of user activity, determine methods and techniques used to access the information, and identify the initial attack vector.

(e) The Contractor shall appoint and provide points of contact (names, telephone numbers, e-mail addresses) for the officials who have overall accountability for incident response and protection of FDIC information and with whom the Contracting Officer, Oversight Manager, and other applicable FDIC staff may communicate throughout the duration of the contract about information security and privacy issues. These individuals or designees shall, at a minimum:

1. Be available to assist the FDIC as needed in resolving an incident;

2. Notify the FDIC of an incident immediately after the Contractor becomes aware of it; and

3. Notify FDIC’s Computer Security Incident Response Team (CSIRT) via email at fdic-csirt@fdic.gov or telephone at 1-877-FDIC-999 (877-334-2999), as well as to the Oversight Manager (OM) of an incident.

The Contractor shall take all necessary steps to effectively contain identified incidents and coordinate and cooperate with the FDIC in investigating and remediating the incident.

The Contractor shall, at its own costs and at a minimum, provide individuals affected by a breach involving personally identifiable information (PII) under its control with notice of the breach and access to two (2) years of complimentary credit monitoring and identity protection services to protect such affected individuals against risks posed by the breach.

(f) Subcontracts. Contractor must ensure this clause is included in all first-tier subcontracts and lower-tier levels of subcontracts to which the conditions and requirements described in this clause would apply.

7.4.2-05 - Basic Safeguarding of Covered Contractor Information Systems - March 2021

(a) Definitions. As used in this clause:

“Covered contractor information system” means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

“Federal contract information” means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public Web sites) or simple transactional information, such as necessary to process payments.

“Information” means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on

National Security Systems Instruction (CNSSI) 4009).

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (44 U.S.C. 3502).

Section H - Special Contract Requirements PAGE 10 OF 19

“Safeguarding” means measures or controls that are prescribed to protect information systems.

(b) Safeguarding requirements and procedures.

(1) The Contractor shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls:

(i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

(ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

(iii) Verify and control/limit connections to and use of external information systems.

(iv) Control information posted or processed on publicly accessible information systems.

(v) Identify information system users, processes acting on behalf of users, or devices.

(vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

(vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

(viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

(x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

(xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

(xii) Identify, report, and correct information and information system flaws in a timely manner.

(xiii) Provide protection from malicious code at appropriate locations within organizational information systems.

(xiv) Update malicious code protection mechanisms when new releases are available.

(xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

(c) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract in which the subcontractor may have Federal contract information residing in or transiting through its information system.

Section H - Special Contract Requirements PAGE 11 OF 19

Section J - List of Attachments

The table below lists all of the attachments for Section J which start on the following page

Order of Appearance Name

Attachments C-1 Request for Information

Attachments J-1 Questions and Answers

Attachments J-2 Assessment and Authorization Requirements – Moderate Baseline

Attachments for this section start after this page.

Section J - List of Attachments PAGE 12 OF 19

Questions and Answers for REQ#22542

This requirement is for licenses only. There will be no services.

1.Can the government provide additional insight into why FDIC is interested in a new tool? Or any additional background information on the goals of this RFI?

The FDIC is conducting market research to better understand available budget formulation products. We would like to explore functionalities and capabilities of different tools.

2. Does a Cover page and cover letter count against the 5 pages or is it exempt.

The cover page does not count against the 5 page limit. A Cover Letter is not necessary (but would count against the 5 pages). To assist we have increased the page limit to 7 pages.

3. May we submit our Customer & POC list as a separate attachment? OneStream has 1,700+ customers worldwide with more than 80 federal customers. This would obviously put us over the 5 page threshold, let me know if it'd be helpful to provide all.

Yes. The Customer and POC list can be a separate attachment which will not count against the 5 pages. However, in the list please include only the federal customers using your budget product.

4.In terms of Demo logistics, can we expect to hear back from FDIC after submissions are sent to schedule time?

Yes.

5.The RFI specifies a requirement for a FedRAMP-certified system currently used by other federal agencies. Would FDIC consider a solution that has received an Authority to Operate (ATO) at another federal agency and is operating within a federal enclave, but is not FedRAMP-authorized as a SaaS offering?

The vendor must be able to adhere to the FDIC’s security-related terms and conditions. In addition, the solution must be Fed-RAMP certified.

6.Would FDIC consider deployment of a budgeting system within an FDIC-managed hosting environment (e.g., FDIC tenant or internal infrastructure), subject to FDIC security review and authorization?

Section J - List of Attachments PAGE 13 OF 19

The FDIC would find FDIC Cloud management or Software as a Service hosting method acceptable however, the vendor must be able to adhere to the FDIC’s security-related terms and conditions (See attached updated RFI). In addition, the solution must be Fed-RAMP certified.

7. Can FDIC provide a high-level overview of its current budget formulation environment (e.g., Excel-based process, internally developed tool, or commercial solution) and anticipated data migration scope?

The FDIC currently uses a cloud-based commercial tool that has been configured to support the FDIC’s budget process. It includes the ability to combine historical expenses, current budgets, staffing, and salary information, with Graphical User Interface-based user inputs to formulate future year budgets. The tool has configurable calculation logic and standardized and ad hoc reporting functions.

8. Following this RFI, does FDIC anticipate issuing a competitive solicitation in FY26, and if so, what is the estimated timeline for procurement and implementation?

The FDIC will be better positioned to consider this question after reviewing the RFI responses.

9.Is the intent of this market research for a new COTS to replace Oracle EPM?

The intent of the RFI is to develop an up-to-date understanding of budget formulation solutions available on the market.

10. Can the Government provide reference documentation that defines the FDIC terms and conditions pertaining specifically to Budget Formulation solutions?

Yes. Please see the clauses in the updated RFI.

11. Will the system demo be invite-only for vendors that submit an RFI response?

Yes.

12. For the 60-minute demo, are there specific functional areas FDIC would like emphasized (e.g., scenario modeling, staffing-to-budget linkage, business rule configuration, reporting)?

We would like a general overview of the functionality of the system, with a focus on high-level business functions, such as data modeling, staffing, budget formulation, reporting, and automation, etc.

13. Should the demo focus primarily on out-of-the-box capabilities, or would FDIC prefer to see configurable/custom features?

Section J - List of Attachments PAGE 14 OF 19

Please include configurable features which are commonly used. As part of the demo, please be prepared to discuss the typical time taken for system implementation, including standard configuration activities.

14. Does FDIC prefer a real client example (sanitized) or a mock FDIC-specific use case for demonstration purposes?

The demo does not need to be FDIC-specific, but a (mock or real-life) federal example is preferred (e.g. do not include profit scenario modeling).

15. Is FDIC more interested in SaaS subscription models or license plus services models?

The FDIC plans to review the RFI responses to help determine whether a particular model better suits the Corporation’s needs.

16. Is FDIC intending to replace an existing tool, or build capability where none currently exists?

FDIC has an existing budget tool.

17. What is the anticipated acquisition vehicle (e.g., GSA MAS, BPA, standalone procurement)?

The plan is to post this requirement on SAM.gov but this could change based on guidance from FDIC leadership.

18. What is the anticipated timeline from RFI to potential RFP issuance?

The FDIC will be better positioned to consider this question after reviewing the RFI responses.

19. What are the top three pain points FDIC is seeking to resolve with this tool?

The FDIC is seeking a tool that can create efficiency formulate budgets and staffing authorizations, provide transparency for multiple users simultaneously, and perform scenario modeling. The solution must also be able to comply with FDIC’s legal and security terms and conditions.

20. Is FDIC prioritizing configurability, speed of deployment, cost control, analytics depth, or integration flexibility?

The FDIC will weigh tradeoffs among these criteria after it evaluates RFI responses.

21. Is a government-hosted deployment model being considered or preferred?

Section J - List of Attachments PAGE 15 OF 19

The FDIC will evaluate different deployment models upon review of RFI responses.

22. Are there existing systems this tool will be expected to interface with? If so:

Currently, there are not any API’s, however at some point it could be useful.

• What is the maturity level of those systems?

If there was API the systems would mature Enterprise Resource Platforms like Corporate Financials and HR Systems, but again this is not currently in place or required.

• Are APIs currently available?

No, API interfaces are not required but would be beneficial if available.

23. Would the tool be expected to migrate data from legacy systems?

The tool is not expected to migrate data from a legacy system. However, the FDIC would need the ability to load prior year data to the system.

24. Is there a desire for predictive analytics or advanced forecasting capabilities?

Analytics and forecasting capabilities are beneficial but not required.

25. Would the tool be expected to manage its own budget formulation workflows?

We don’t expect the current Commercial Off The Shelf tool to support FDIC’s budget process but the tool should be able to be configured to the FDIC’s budget formulation process.

26. Is there an expectation of embedded analytics or robust ad hoc reporting tools?

Yes. Robust ad hoc reporting tools are needed for system admins and power users.

Section J - List of Attachments PAGE 16 OF 19

NONPUBLIC//FDIC BUSINESS

Assessment and Authorization Requirements – Moderate Baseline Authorization to Operate The Contractor shall not create, collect, use, process, store, maintain, disseminate, disclose, and dispose of FDIC data within an Information Technology (IT) system without an Authorization to Operate (ATO) signed by the FDIC Authorizing Official (AO) granted via the Assessment & Authorization (A&A) process. The FDIC process for obtaining and maintaining ATO is in accordance with NIST SP 800-37 Risk Management Framework for Information Systems and Organizations. The Contractor shall implement security and privacy controls at the moderate baseline and adhere to current FDIC policies, procedures, and guidance for the A&A process as defined below.

Complete the FDIC Assessment & Authorization Process.

a. A&A Documentation. The Contractor, in accordance with applicable National Institute of Standards and Technology (NIST) Special Publication (SP)s , shall develop the A&A documentation. The A&A documentation consists of the following: System Security Plan, Contingency Plan, Contingency Plan Test Results, Incident Response Plan, Incident Response Plan Test Results, Configuration Management Plan (if applicable), and Security Assessment Report. Additional documents that may be required include Plan of Action and Milestones (POA&M) and/or Interconnection Security Agreement (ISA). The extent of the documentation required may depend on the Contractor’s ability to leverage a Federal Government ATO or FedRAMP package to comply with FDIC requirements.

b. Independent Assessment. Contractor shall have an independent assessor perform an assessment of security and privacy controls at the moderate baseline as outlined in NIST SP 800-53A Assessing Security and Privacy Controls in Information Systems and Organizations to determine the extent to which the selected controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting security and privacy requirements for the system and the FDIC. An independent assessor is defined by NIST SP 800-37 Risk Management Framework for Information Systems and Organizations. The independent assessor requirement may be satisfied by: (1) an internal audit or assessment group that possesses the required skills and technical expertise to develop effective assessment plans and to conduct assessments, as appropriate. This group is separate and independent from the part of the organization that has responsibility for developing or maintaining the system; or (2) acquiring the services of an external (outside) third-party independent assessor. Should the independent assessment find deficiencies, the Contractor must create Plan of Action & Milestones (POA&M) to track and manage associated remediation activities to closure. In the case of unacceptable assessment results or if the Contractor does not remediate control deficiencies in a timely manner as established in the POA&Ms, FDIC may treat the failure as an event of default.

c. Privacy Compliance Documentation. As part of the A&A process, the Contractor may be required to support the FDIC in the completion of a Privacy Threshold Analysis (PTA). The creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal of Personally Identifiable Information (PII) by an IT system triggers the requirement to complete a PTA. Upon review of the PTA, Section J - List of Attachments PAGE 17 OF 19 the FDIC Privacy Program determines whether a Privacy Impact Assessment (PIA) and/or Privacy Act System of Records Notice (SORN), or modifications thereto, are required. The Contractor shall provide all support necessary to assist the FDIC in completing the PIA in a timely manner and shall ensure that project management plans and schedules include time for the completion of the PTA, PIA, and SORN (to the extent required) as milestones. Support in this context includes responding timely to requests for information from the FDIC about the creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal of PII on the Contractor’s system, and providing timely review of relevant compliance documents for factual accuracy. Information on the FDIC’s privacy compliance process, including PTAs, PIAs, and SORNs, is accessible at www.fdic.gov/privacy.

d. Continuous Monitoring/Ongoing Annual Assessment. The Contractor shall develop an Information Security and Privacy Continuous Monitoring Plan to have the security and privacy controls assessed on an ongoing annual basis in accordance with OMB Circular A-130, NIST SP 800-37 and NIST SP 800-137. Ongoing annual assessment and evidence of the control effectiveness is part of the continuous monitoring activities of the FDIC. Adherence to the terms and conditions specified by the AO as part of the authorization decision are also monitored. Ongoing annual control assessment continues as the information generated as part of continuous monitoring is correlated, analyzed, and reported to the FDIC via the Oversight Manager. Should the independent assessment find deficiencies, the Contractor must create or update Plan of Action & Milestones (POA&M) to track and manage associated remediation activities to closure. In the case of unacceptable assessment results or if the Contractor does not remediate control deficiencies in a timely manner as established in the POA&Ms, FDIC may treat the failure as an event of default. As part of Continuous Monitoring, the Contractor shall conduct Contingency Plan and Incident Response Testing on an annual basis and provide those test results to the FDIC. In addition, the Contractor shall keep the system security package updated and provide the latest system security package to the FDIC on annual basis.

e. Authorization to Operate (ATO). Upon completion of the A&A documentation and independent assessment, the Contractor shall submit a complete A&A package with a validation by the independent assessor to the Oversight Manager for acceptance by the FDIC Authorizing Official (AO), or designee, at least thirty (30) days prior to the use of the system. The FDIC is the final authority on the compliance of the A&A package and may limit the number of resubmissions of a modified A&A package. The FDIC’s issuance of the ATO does not alleviate the Contractor’s responsibility to ensure the controls are implemented and operating effectively. The A&A package must include the following:

Deliverables (30 Days Prior to System Use)

Security and Privacy System Security Plan

Security and Privacy Assessment reports

Plan of Action and Milestones

Section J - List of Attachments PAGE 18 OF 19 http://www.fdic.gov/privacy

Deliverables (30 Days Prior to System Use)

Information Security and Privacy Continuous Monitoring Plan

Supporting assessment evidence or other documentation, as required.

Section J - List of Attachments PAGE 19 OF 19

DOA/ASB

3501 Fairfax Drive, E-4003 Arlington, VA 22226 ellismith@fdic.gov

(703) 562-6255 ellismith@fdic.gov

DOFAPInvoice@fdic.gov