Sources Sought - OIG (FSA and FISMA).pdf

Solicitation Number: DOJ-PSS-2710 Notice Type: Sources Sought Synopsis

Department of Justice

Office of the Inspector General

I. Introduction

This Sources Sought Notice (SSN) is being released pursuant to the Federal Acquisition Regulations (FAR) Part 10 Market Research. The information collected through the process is considered market research, as described by FAR 2.101 and in accordance with FAR 10.001. This is NOT a Request for Proposal (RFP), and nothing shall be construed herein or through the Sources Sought process to commit or obligate the Government to further action. In addition, vendors responding to this request for information shall bear all risks and expenses of any resources used to provide the requested information. The submission of capability information in response to this SSN is purely voluntary.

The Department of Justice (DOJ), Office of the Inspector General (OIG) is issuing this SSN to identify potential qualified and responsible vendors who possess the experience and resources capable of providing professional services to assist in meeting its responsibilities under the Chief Financial Officers (CFO) Act of 1990, as amended by the Government Management Reform Act of 1994, and the Federal Information Security Management Act (FISMA). The Government intends to issue separate task orders for these requirements. The applicable Special Item Number (SIN) on the U.S. General Services Administration (GSA) Federal Supply Schedule (FSS) for these services is 541211.

Vendors providing advisory services that impair independence (e.g., consulting services related to internal control assessments, audit remediation assistance, etc.) to any one of the DOJ reporting components could impair organizational independence for the financial statement audit call order and, thus, preclude the vendor from being considered for that call order.

II. Annual Financial Statement Audits

Scope

The objective is to obtain annual independent financial statement audits of the DOJ Consolidated and two of its reporting components: Assets Forfeiture Fund and Seized Asset Deposit Fund (AFF/SADF) and Federal Prison Industries, Inc. (FPI).

Separate financial statement audits are performed for the AFF/SADF and FPI as required by the Civil Asset Forfeiture Reform Act of 2000 and the Government Corporation Control Act of 1945, as amended, respectively (referred to as standalone reporting components). All other components are audited as part of the DOJ Consolidated group audit and do not receive standalone audit opinions (referred to as non-standalone reporting components).

DOJ Consolidated Audit and Non-Standalone Reporting Components:

• Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF)

• Federal Bureau of Prisons (BOP)

• Drug Enforcement Administration (DEA)

• Federal Bureau of Investigation (FBI)

• Offices, Boards and Divisions (OBDs)1

• Office of Justice Programs (OJP)

• U.S. Marshals Service (USMS)

Assets Forfeiture Fund and Seized Asset Deposit Fund

Federal Prison Industries, Inc.

Personnel Security Clearance/Background Investigation Requirements

All Contractor/Subcontractor staff that work on the financial statement audits shall meet the background investigation requirements shown in the table below and meet the requirements detailed in Section IV of this SSN.

Component Contractor Position Minimum Security

Clearance/Background Investigation Requirements

DOJ Consolidated

IS Staff Partner & Manager

Staff Performing procedures at FBI* Tier 5

All Others Tier 3

FBI All Positions Tier 5

AFF, ATF, BOP, DEA,

FPI, OBDs, OJP, USMS

Staff performing procedures at FBI** Tier 5

IS Staff Tier 4

All Others Tier 3

* Activities could include testwork related to elimination entries and fiduciary, and group auditor responsibilities.

** Activities could include testwork related to seized evidence.

In addition to the above, at least one auditor working on the FBI audit team must be able to obtain a Sensitive Compartmented Information clearance.

Financial Systems

The Department uses a fully integrated, Unified Financial Management System (UFMS) which is based on the CGI Federal Inc. Momentum software, a Commercial-Off-the-Shelf (COTS) product.

The version of UFMS-Secret (UFMS-S) used by the FBI is a distinct and separate classified instance of Momentum while the rest of the Department uses a sensitive-but-unclassified version of UFMS (UFMS-SBU). The FPI uses a separate financial management system, SAP.

1 The OBDs are comprised of 28 separate component organizations.

Accounting Records

Each reporting component has a separate finance staff, separate accounting records and some have accounting and personnel records located in field offices.

Contractor Information System Security Requirements

All Contractor IT equipment (including, but not limited to, Contractor laptops) utilized under a call order must be configured for the data, information, and system security requirements in accordance with DOJ standard operating procedures and Federal laws, regulations, and standards.

The use of any Subcontractor IT equipment (including, but not limited to, Subcontractor laptops) is prohibited. Additionally, all Contractor IT equipment utilized must meet or exceed the Government minimum requirements for security. The Contractor’s controls shall be comparable to those controls specified in Section II: Information System Security and Privacy Requirements of DOJ Order 0904:

Cybersecurity Program.

Transmissions of data between Department controlled facilities and any Contractor/Subcontractor controlled facilities, if permitted, are subject to the data encryption standard requirements of the relevant DOJ Information Technology Security (DOJ Order 0904: Cybersecurity Program) and OCIO Document Library. Any remote non-government access to data, if permitted, shall be subject to the same standards. Due to the sensitivity of the DOJ‘s data, the Contractor’s audit documentation must remain within the boundary of DOJ’s environment throughout the audit and for the duration of the Contractor’s record retention policy. DOJ may provide reasonable IT resources, subject to compliance with DOJ’s IT standards, in support of Contractor applications required to perform under a call order.

All DOJ data for the FBI audit must be processed and stored on-site at the FBI headquarters on classified networked computers. All work associated with DOJ data must be completed within the FBI’s secure facility. Any Contractor developed documents for the FBI audit (e.g., meeting agendas, audit programs, summary memos, test work memos) may be stored on a Contractor furnished laptop computer that remains on-site at the FBI Headquarters. Contractor laptops must be approved by the FBI prior to being placed into service on the audit and the FBI must verify the hard drive has been purged before removal from the FBI headquarters.

III. Annual FISMA Audit

Scope

The objective is to obtain seven independent FISMA audits annually - six DOJ components and one for the Court Services and Offender Supervision Agency (CSOSA) for the District of Columbia.

Justice Management Division (JMD), FBI, and CSOSA are audited annually, and an additional four components are rotated in annually to satisfy two large DOJ components and two smaller Components/OBDs. For example, a typical FY would include:

• JMD, FBI, CSOSA (Each reviewed annually.)

• Two Large DOJ Components (e.g., USMS and BOP, etc.)

• Two Small DOJ Components (e.g., EOIR and Criminal Division, etc.)

Each annual FISMA audit will include:

• Audit the implementation of information security controls, programs, and practices as prescribed by the OMB Reporting Metrics, which are due for the FBI’s Intelligence Community, the Department, and CSOSA, by the end of July annually.

• Evaluate an IT system for each DOJ component and CSOSA and perform a system security control audit consisting of a vulnerability assessment scan.

• Evaluate the components oversight performance relating to implemented Personally Identifiable Information (PII) controls.

Contractor Information System Security Requirements

All DOJ FISMA work will be performed on laptop computers issued by the Department’s Office of the Chief Information Officer. All DOJ data for the FISMA audits must remain on DOJ networks at all times. DOJ data will be maintained by the contractor on DOJ networks until the retention policy expiration. At that time, the DOJ data will be purged by the contractor.

Personnel Security Clearance/Background Investigation Requirements

All Contractor/Subcontractor staff that work on the FISMA audits shall meet the background investigation requirements shown in the table below and meet the requirements detailed in Section IV of this SSN.

Component Minimum Security Clearance/Background

Investigation Requirements

JMD, FBI, NSD Tier 5

CSOSA Tier 4

All Others Tier 4

IV. Security Requirements

Work performed under any subsequent awarded BPA will involve any one or more of the following:

access to DOJ Information, which may include access to classified information (National Security Information (NSI) and Sensitive Compartmented Information) as well as access to unclassified information (e.g., Limited Official Use); access to DOJ Information Technology systems; and unescorted access to DOJ space and facilities.

Contractor Personnel

A. Residency Requirement.

1. Contractor employees, both U.S. citizens and non-U.S. citizens, must meet the Department’s residency requirement if they will require access to DOJ information, IT systems, or unescorted access to facilities. For three years (not necessarily consecutive years) out of the last five years immediately prior to employment under the Department contract the contractor employee must have: (i) resided in the U.S.; (ii) worked for the U.S. in a foreign country as either an employee or contractor in a federal civilian or military capacity; or, (iii) been a dependent of a federal civilian or military employee or contractor working for the U.S. in a foreign country. At the Department’s sole discretion, the residency requirement may be waived by the Department Security Officer (DSO) for contractor employees on a case-by-case basis where justified by extenuating circumstances.

2. The residency requirement does not apply to contractor employees that will work on these call orders whose national security clearance has been processed by DCSA in accordance with the NISP.

B. Citizenship.

1. The DOJ requires that contractor employees be U.S. citizens and nationals, or lawful permanent residents seeking U.S. citizenship

2. Contractor employees requiring access to classified information will be processed by DCSA in accordance with the NISP.

C. Dual Citizenship.

1. U.S. citizens who hold dual citizenship with a foreign country are considered U.S. citizens within the meaning of this clause, and may be considered for, but are not entitled to, contract employment as U.S. citizens consistent with this clause. The means by which the contractor employee obtained or exercises his or her dual citizenship status will be a consideration in the adjudication, and/or waiver approval processes discussed in this clause, and the Contract employee will be asked to sign a Loyalty Statement.

2. Contractor employees requiring access to classified information will be processed by DCSA in accordance with the NISP.

D. Access to DOJ Information Technology Systems. Non-U.S citizens are not authorized to access

DOJ information technology (IT) systems or assist in the development, operation, management, or maintenance of DOJ IT systems, including providing IT system support, unless a waiver has been granted by the Head of the DOJ component or designee, with the prior concurrence of both the DSO and the DOJ Chief Information Officer, allowing computer access by the non-U.S.

citizen. Such a waiver will be granted only in exceptional and unique circumstances on a case-by-case basis. It should be noted that the Justice Consolidated Office Network (JCON) is a sensitive DOJ IT system and any contractor employee who will need access to JCON must be a U.S. citizen or have received a waiver. In order for a waiver to be considered for approval: (1) There must be a compelling reason for using this individual as opposed to a U.S. citizen; (2) The type of personnel security vetting that has been conducted on the individual, and vetting results, that would mitigate risk; and (3) The waiver must be in the best interest of the federal government.

E. Access to Unclassified DOJ Information and Unescorted Access to DOJ Facilities or Space.

Non-U.S. citizens are not authorized to access DOJ information and/or unescorted access to

DOJ facilities or space, unless a waiver has been granted by the DSO, allowing access by the non-U.S. citizen. Such a waiver will be granted on a case-by-case basis where justified at the discretion of the DSO.

V. Instructions for Submission of Responses

Interested firms who consider themselves qualified to perform the above-listed services are invited to submit a response to this SSN by November 9, 2026, Washington DC, time. All responses under this SSN must be emailed to Allison.J.Polizzi@usdoj.gov under the subject titled “Sources Sought for Financial and Performance Management.” Total pages of the submission for the financial statement audit shall not exceed 3 pages, and total pages of the submission for the FISMA audit shall not exceed 3 pages. Both submissions shall use Avenir Next LT Pro 11-point font. All margins shall be at least ¾ inch. Please provide:

1. Vendor Information. The vendor summary includes vendor name, address, UEI, point of contact information, email, phone, and website address, GSA schedule contract number that includes the vendor’s catalogue of products.

2. Capability Statement(s). A capability statement(s) can be submitted for financial statement and/or FISMA audits. Summarize the potential capacity to support the requirement(s).

The capability statement(s) shall confirm:

• The vendor has a current active Top Secret Facility Clearance.

• The vendor is independent, as defined in Government Auditing Standards, with respect to the Department of Justice. If the vendor is not currently independent, discuss any planned safeguards to achieve organizational independence.

If subcontracting or teaming is anticipated in order to deliver technical capability, organizations should address the administrative and management structure of such arrangements.

Subcontractors and teaming partners also fall under the conflict or interest.

Telephone inquiries will not be accepted or acknowledged, and no feedback or evaluations will be provided to companies regarding their submissions.

Note: No proprietary, classified, confidential, or sensitive information should be included in your response. The Government reserves the right to use any non-proprietary technical information in any resultant solicitation(s).

mailto:Allison.J.Polizzi@usdoj.gov