Responses to CSO Questions (19 May 25).pdf

FA877025SC002

CSO - Oracle Governance, Risk, and Compliance (GRC) Application Monitoring Tool

Question and Answers

1) Addendum references this opportunity is a Small Business Set Aside.

a) This is an error. This is a full and open competition.

2) What is your SDLC cycle: DEV>Test>PROD; or DEV>Test>Training>PROD, etc.

a) DEV>Test>GIT>Pre Prod>PROD

3) What is your current process to prevent risks in provisioning/ deprovisioning access to users in EBS

a) Monitoring access controls

b) Audit trail enabling

4) How do you perform user access reviews (UAR)

a) DEAMS performs a variety of user access reviews, including monthly access provisioning validation, quarterly continued access appropriateness, and annual access review (also perform monthly user activity monitoring reviews for privileged users). These reviews are conducted using system-generated reports (extraction of FND Tables) and Excel, and are both manual and automated.

Automations include RPA (extracting and loading data into spreadsheets) and PowerBI. However, the analyses of data are largely manual. Access reviews are reviewed and approved by Government personnel. Any exceptions are identified and resolved in a timely manner (e.g. end-dating a user’s access).

5) Besides EBS, what other business applications, databases, tools and infrastructure are important for us to address with our Solutions?

a) Workflow approval, documentation repository, customizable reports

6) How many Configuration Controls (CCG) do you currently have in EBS?

a) ~26

7) How many Preventative Controls (PCG) do you currently have in EBS?

a) None

8) How many Transaction Controls (TCG) do you currently have in EBS?

a) None in place

9) How many Application Access Governance Controls (AACG) do you currently have in EBS?

a) None

10) Can you, if at all possible, provide an example list of these current Controls?

a) XLA-Journal Lines Definitions

b) XLA-Application Acctng Definitions

c) AP-PAYABLES-SYSTEM-SETUP

d) SummaryAccounts

e) DescriptiveFlexfieldSegments

f) DefineSecurityRules

g) OpenAndClosePeriods

h) CrossValidationRules

i) PO-Buyers

j) JournalAuthorizationLimits

k) SYSTEM-ADMIN-Menus

l) JournalReversalCriteria

m) XLA-Journal Entry Descriptions

n) SubledgerAccountingMethods

o) XLA-Acctng Attribute Assignments

p) AR-System-Options_AR_SYS_PARAMS_ALL

q) Currencies

r) AR ApprovalLimits

s) AssignSecurityRules

t) DefineBudgetaryControlGroup

u) PO-Purchasing Options

v) PayablesOptions

w) RollupGroups

x) AP Payables Setup Options

y) GL-SUSPENSE-ACCOUNTS

z) PO-Approval Assignments

11) Are there any specific technical components that you are looking for in Workflows?

a) PCG like functionality of approving form / field level changes. For example, profile changes initiate a workflow for an approval.

12) What type of Reports are you looking for, can you give us some examples of Reports you would like to see?

a) Monitoring reviews of configuration changes (before and after), who made the change, when they made change, change approval (tag), change approval status

13) What do you mean by the Term Report Tagging?

a) The ability to label reports / changes to a specific event (change approval, tickets, etc.)

14) What is the Air Force´s vision for the role of AI in EBS and other business applications?

The Air Force's vision for the role of AI in Enterprise Business Systems (EBS) and other business applications is centered around achieving increased efficiency, effectiveness, and agility. While specific public documents outlining a comprehensive, overarching vision are not readily available (much of this is internal strategic planning), we can deduce the vision based on current initiatives and broader DoD trends:

a) Automating Routine Tasks: AI is seen as crucial for automating repetitive, manual tasks currently performed by Airmen, freeing them up for more complex and strategic work. This includes areas like data entry, report generation, basic analysis, and certain aspects of logistics and supply chain management.

b) Data-Driven Decision Making: The Air Force aims to leverage AI to analyze vast amounts of data generated across EBS and other systems. This allows for better informed decisions at all levels, from resource allocation and predictive maintenance to personnel management and strategic planning.

c) Improving Accuracy and Speed: AI can significantly improve the accuracy and speed of business processes. This is particularly relevant in areas like financial management, contracting, and human resources, where errors can be costly and time-consuming to rectify.

d) Enhancing Cybersecurity: AI can play a vital role in strengthening cybersecurity defenses by detecting and responding to threats in real-time.

This includes identifying anomalous behavior, predicting potential vulnerabilities, and automating security responses.

e) Streamlining Acquisition Processes: The Air Force seeks to use AI to streamline the often complex and lengthy acquisition process. This could involve automating parts of the process, identifying potential bottlenecks, and improving cost estimation and risk assessment.

f) Personalized Learning and Development: AI can personalize training and development programs for Airmen based on their individual needs and career goals. This can lead to more effective training and improved workforce readiness.

g) Predictive Maintenance and Logistics: AI can predict equipment failures and optimize maintenance schedules, reducing downtime and improving operational readiness. It can also optimize supply chain management by forecasting demand and improving inventory control.

h) Challenges and Considerations:

i) The Air Force also recognizes the challenges associated with implementing AI in business systems, including:

j) Data Quality and Integration: AI algorithms rely on high-quality data. Ensuring data accuracy and consistency across different systems is essential.

k) Ethical Considerations: The Air Force is committed to responsible AI development and deployment, addressing issues like bias, fairness, and transparency.

l) Workforce Development: Training and developing a workforce with the skills necessary to manage and utilize AI systems is crucial.

m) Security and Trust: Ensuring the security and trustworthiness of AI systems is paramount, particularly given the sensitive nature of military data.

In summary, the Air Force's vision for AI in EBS and other business applications is to leverage its power to enhance efficiency, improve decision-making, and streamline processes, ultimately contributing to a more agile and effective force. This is an evolving area, and we can expect to see continued development and refinement of this vision as AI technology matures.

15) How does the Air Force plan to integrate AI into critical business systems including Oracle E-Business Suite?

The Air Force's plans for integrating AI into critical business systems, including Oracle E-Business Suite (EBS), are likely multi-phased and evolving. While specific details are not always publicly available due to security and strategic considerations, we can infer the general approach based on industry trends and DoD initiatives:

a) Phased Implementation: A likely approach is a phased rollout, starting with pilot projects in specific areas like logistics, finance, or human resources. These pilots would demonstrate the value of AI and inform broader implementation strategies.

b) Focusing on Specific Use Cases: Rather than trying to implement AI across the entire EBS at once, the Air Force is likely prioritizing specific use cases with high potential for return on investment. This could include areas like:

c) Predictive Maintenance: Using AI to predict equipment failures and optimize maintenance schedules.

d) Supply Chain Optimization: Improving inventory management and forecasting demand.

e) Automated Contract Management: Streamlining contract creation, review, and approval processes.

f) Fraud Detection: Identifying and preventing fraudulent activities within financial systems.

g) Personalized Training: Tailoring training programs to individual Airmen's needs.

h) Leveraging Existing AI Platforms and Tools: The Air Force is likely exploring the use of existing AI platforms and tools, such as cloud-based AI services, to accelerate implementation and reduce development costs.

i) Developing Custom AI Solutions: In some cases, the Air Force may need to develop custom AI solutions tailored to specific EBS modules or business processes. This would involve working with AI specialists and software developers.

j) Integration with Other Systems: Integrating AI capabilities within EBS with other Air Force systems is crucial for maximizing its impact. This requires careful planning and coordination to ensure data interoperability and seamless information flow.

k) Data Preparation and Cleansing: A critical step in integrating AI is ensuring the quality and consistency of data within EBS. This involves data cleansing, standardization, and integration efforts.

l) Change Management: Implementing AI in critical business systems requires careful change management to ensure user adoption and minimize disruption to existing workflows. Training and communication are key aspects of this process.

m) Security Considerations: Security is paramount when integrating AI into systems containing sensitive data. The Air Force will need to implement robust security measures to protect AI systems from cyber threats and ensure data integrity.

n) Specific to Oracle EBS:

o) Integrating AI into Oracle EBS can involve several approaches:

p) Leveraging Oracle's AI Capabilities: Oracle offers AI and machine learning capabilities within its cloud offerings and some EBS modules. The Air Force may leverage these existing tools.

q) Integrating Third-Party AI Solutions: Integrating third-party AI solutions with EBS through APIs or other integration methods is another possibility.

r) Custom Development within EBS: Developing custom AI applications within the EBS environment is also an option, though it can be more complex.

The Air Force's approach to AI integration with EBS is likely a combination of these strategies, tailored to specific needs and priorities. It's a continuous process of evaluation, adaptation, and refinement, driven by the evolving landscape of AI technology and the Air Force's evolving business requirements.

16) Has the Air Force developed a strategy or policy for AI, and if so, what are the key objectives and timelines?

The US Air Force has indeed developed strategies and policies for AI. While the exact details and classified aspects are not publicly available, the core objectives and general timelines are accessible.

a) Key Objectives:

b) Maintaining a Competitive Advantage: This is paramount. The aim is to leverage AI to outperform adversaries in areas like decision-making, autonomous systems, and information dominance.

c) Accelerating Development and Deployment: The Air Force recognizes the need to rapidly develop, test, and field AI capabilities to keep pace with technological advancements. This includes streamlining acquisition processes and fostering innovation.

d) Enhancing Situational Awareness and Decision-Making: AI is seen as crucial for processing vast amounts of data from various sources (sensors, intelligence, etc.) to provide a clearer understanding of the battlespace and enable faster, more informed decisions.

e) Enabling Autonomous Systems: This includes developing AI for autonomous aircraft, drones, and other systems that can operate with increasing levels of independence, freeing up human operators for more complex tasks.

f) Improving Logistics and Support: AI can optimize maintenance schedules, predict equipment failures, and streamline supply chains, leading to increased efficiency and cost savings.

g) Developing Ethical and Responsible AI: The Air Force emphasizes the importance of developing and using AI in a responsible and ethical manner, addressing concerns about bias, transparency, and accountability.

h) Workforce Development: Recognizing the importance of human-machine teaming, the Air Force is investing in training and education to prepare its personnel to work effectively with AI systems.

17) What role does AI play in the Air Force´s long-term strategic planning, and what are the key areas of focus

AI plays a crucial and increasingly central role in the Air Force's long-term strategic planning. It's viewed as a transformative technology that will reshape how the Air Force operates in the future. Here are some key areas of focus:

a) Predictive Maintenance and Logistics: AI algorithms can analyze data from aircraft sensors and maintenance records to predict potential failures before they occur. This allows for proactive maintenance, reducing downtime and improving aircraft availability. AI can also optimize supply chains and resource allocation.

b) Advanced Training and Simulation: AI-powered simulations can create more realistic and challenging training environments for pilots and other personnel.

This can accelerate learning and improve readiness for complex scenarios.

c) Cybersecurity: AI can be used to detect and respond to cyber threats in real-time, enhancing the Air Force's ability to defend its networks and systems.

d) Intelligence, Surveillance, and Reconnaissance (ISR): AI can analyze imagery, signals, and other data collected by ISR platforms to identify targets, assess threats, and provide actionable intelligence.

e) Autonomous Systems Development: This encompasses a wide range of efforts to develop autonomous aircraft, drones, and other systems that can operate with varying levels of human supervision. AI is the core enabling technology for autonomy.

f) Human-Machine Teaming: The Air Force recognizes that AI is not meant to replace humans but to augment their capabilities. A key focus is on developing effective human-machine interfaces and workflows that optimize collaboration between humans and AI systems.

These areas reflect the Air Force's understanding that AI is not just a single technology but a collection of capabilities that must be integrated across various platforms and operations to achieve its strategic objectives. The long-term vision is for AI to become deeply embedded in every aspect of the Air Force, from planning and execution to logistics and support.

18) How many Oracle EBS production instances does USAF have and are considering for this RFI?

a) 1

19) In order to generate an appropriate scoping/pricing guide, how many individuals in the organization would require access to the Application Monitoring Tool in a non-user/viewer capacity?

Less than 25

20) Regarding the optional cloud transition, on what timeframe is such a transition being considered? Is there an opportunity to conduct the cloud transition as part of the initial phase of work?

Dependent on the solution chosen, and the DEAMS situation at the time of implementation

21) What is the data security level for this system? (IL4, IL5, or beyond?)

IL4

22) What quantities of existing data will need to be transferred to the new system, and how in what format is this data stored currently?

a. Would not expect to transfer data, unless new system requires it. Would expect to maintain historic and move forward with new solution.

Are there additional details on the current DEAMS server architecture and compatibility requirements for the new solution?

Need a product that will support reporting off Sparc Solaris Super Cluster, Windows and Linux. Production is located on premise at DISA and Development is located on OCI.

23. When does the existing Oracle tool reach “end-of-life?” Will there be a requirement to simultaneously support both Application Monitoring Tools for a time before cutting over to the new system?

GRC end of life is May 2025

24. Is there an opportunity to include Generative AI or Agentic AI capabilities in support of audit, reporting, and approvals functionality in the solution?

Yes

25. Software Functionality 1 -- What types of configurations (e.g., hardware, software, network settings) need to be baselined?

Software Configurations related to setup configurations, profile options, and master data

26. Software Functionality 2 -- What specific data points (e.g., user, timestamp, change details) need to be tracked for each configuration change? How granular should the audit trail be (e.g., every change or only specific types)?

Software configurations/Master Data need to track detailed changes, unlike oracle storing simply the creation date/created by and last_updated_by and last_updated_by, there needs to be a complete listing of updates.

27. Software Functionality 3, 4 and 5 - How should configurations changes between baseline, environment, and master data be presented (e.g., visual differences, tables)? Could you provide an example report of each?

Should be able to generate reports between our dev/test/production environments that show differences.

The users/reporters want to access the key configuration setups mentioned in multiple instances in DEAMS; The system shall be configured to provide software configuration reports (i.e., current status of the system) across multiple instances of DEAMS

28. Software Functionality 8 - What are the security requirements for accessing and storing reports (e.g., encryption, access controls)?

There needs to be access controls so output is accessible only to authorized resources.

29. Software Functionality 9 - Are there examples of current tagging practices you want to replicate or improve?

No, this is a new requirements in order to help facilitate reporting

The users want to associate the key configuration reports to a risk, control, audit, ticket, and/or tag; Provide a solution where common themes or tags can be used easily associate risks, controls, and audits; and allow users to be able to search these common themes or tags

The users want to be able to easily search for associate risks, controls, audits, tickets, and/or tags; Provide a solution where common themes or tags can be used easily associate risks, controls, and audits; and allow users to be able to search these common themes or tags

30. Software Functionality 11 - How complex are the approval workflows (e.g., single approver, multi-step, conditional)?

Fairly simple workflows, when requests are made to modify configurations, a workflow will be initiated with a 1 to 2 approvers.

31. Software Functionality 12 - What does "analyze patching" entail (e.g., patch compliance, missing patches, patch impact analysis)?

Standard Oracle Patch Analysis requires a technical knowledge to understand the implications of the patching. Patch analysis should allow for non technical resources to review output detailing the impacted processes, responsibilities, concurrent programs in standard oracle and custom RICEW objects.

32. Software Functionality 13 - Are there required metrics/KPIs that would be relevant for the Dashboard?

Monitor Configuration Changes (by application, by user, additional filters)

Monitor Master Data Changes (by application, by user, additional filters)

33. We do not have a commercial solution exactly matching the requirements, but we can enhance our solution. Does this work? Depends on the amount of customization required, and the area the customization is required. Some requirements are less urgent.

34. We can enhance our common application framework and add all 13 functionalities.

Since all these functionalities that you have listed is available in GRC Application Monitoring, all the needed information must be stored within your Oracle database or server and we should be able to build such features in Oracle APEX framework, adding plug-ins to produce documentation in various formats or utilize Microsoft SSRS or Jasper Reports. Would this work as a solution? Depends on the amount of customization required, and the area the customization is required. Some requirements are less urgent.

35. It is hard to figure out the fixed price based on the 13 points listed for features and scope can also change. Is it Okay to submit a proposal to have some fixed price and some estimated hours by resources needed ? Yes

36. Does the scope include deploying and supporting solution at 170 world-wide installations or just to provide a solution and implement in your development/QA environment? There is 1 production environment, appoximately 19 test/development environments.

37. Do you have a standard spreadsheet for proposal for us to fill-in the prices? No.

The government is leaving it up to the contractor to provide what they believe is best.

38. Do we need to provide fixed-price for all 170 deployments or for just one deployment and chargeable as you deploy it? There is 1 production environment, appoximately 19 test/development environments.

39. The solicitation references the end-of-life status of the current Oracle GRC Application Monitoring Tool. Could the Government please confirm the specific end-of-life date for the existing Oracle GRC solution, and whether there is a targeted timeline or required date by which the replacement must be implemented to avoid operational or support risks? GRC end of life is May 25. The replacement should be as soon as feasibly possible.

40. Does the Government anticipate the proposed solution to include any form of user-based licensing (e.g., named user, viewer access), or is a non-licensed access model preferred for compliance/audit reporting? The government is willing to review both options.

41. Does the Government expect the proposed replacement solution to integrate directly with Oracle E-Business Suite (EBS)? If so, is there a preferred or required method of integration (e.g., API, direct database access, logs, etc.)? Expected integration would be API's.

42. Could you please clarify whether the 5-page limit for the white paper includes the cover page, table of contents and any closing or thank-you/CTA page, or if the expectation is 5 full pages of technical content excluding those? It is 5 full pages of technical content

43. Can the Government provide details about the current contract (if applicable), including the incumbent contractor name, contract number, and expiration date? N/A

44. According to the problem statement, the Governance, Risk, and Compliance (GRC) application in Oracle E-Business Suite is being considered for replacement because it has reached its "end-of-life." Apart from this, are there any other factors or use cases (such as cost, performance, or insufficient functionality) driving the replacement of GRC? No

45. Is there any plan or roadmap for modernizing Oracle E-Business Suite applications (e.g., migrating to Oracle Fusion Cloud Applications)? Should there be any considerations or synchronization between the GRC modernization and the ERP application modernization efforts? There is no current plan to move to fusion, there is a current plan to move to ERP CS.

46. Are there any products already under consideration for the GRC modernization? Yes

47. "Per the government's problem statement: ""This topic is meant for innovative solutions to be adapted in innovative ways to meet DoD stakeholders’ needs in a short timeframe and at a low cost."" Will the government please define ""short timeframe"" in which the need must be addressed?" As this is a CSO, the government wants to award by August 2025. The Short Timeframe is in regards to how rapidly the government wants to proceed.

48. Does the Air Force DEAMS program currently have enterprise license agreements in place for ServiceNow? Not to our knowledge

49. Are proposed CSO solutions required to be FedRAMP compliant? Preferred, if not required

50. Which contract vehicles is the government considering for this procurement? This will be a standalone contract. No vehicle is used.

51. What is the award timeframe for this procurement? Aug-2025

52. Could the Government confirm that the aforementioned CSO is only for technology?

Our initial take was that this was technology focused; however, the introduction cites ‘innovative commercial items, technologies, and services.’ The government is looking for a way to solve this problem. Although technology focused, we will review all white papers for feasibility.

53. What is the expected start date for the replacement program, and what is the target implementation timeline to go live/deploy to production? The schedule will depend on the solution, but given GRC end of live May 2025, as soon as realistically possible is preferred.

54. What are the key challenges and expected outcomes for this RFP? A solution which provides the FMFO with the require auditing functionality.

55. Please elaborate on what business functions or teams are responsible for these initiatives? How is the organization structured from the objectives outlined in the RFP? The FMFO is responsible for the functional aspects of the tool, providing reliable audit information as required. The PMO is responsible for the implementation and day to day support.

56. Which department would assume the ownership of the ServiceNow IRM product from an ongoing maintenance perspective? DEAMS PMO

57. In addition to the audit requirements, do you envisage that the proposed solution should be able to manage processes around Risk, Compliance and Third-Party Risk Management? Risk, Compliance are both processes that would be managed by this solution. While Third Party risk is not a requirement, it would be an added bonus.

58. The CSO Problem Statement document states that some of the software functionalities of the solution shall be the "Ability to create baselines of configuration changes" and "Audit Functionality to track/report configuration changes against a baseline" and "between environments". In this regard, please elaborate on the following:

a. Is it correct to assume that the term "configuration" here refers to "configuration of security baselines"? Configurations refer to Oracle EBS Configurations,

b. What are the configuration management tools currently being used by US Air Force?

Currently manually managed.

c. Can you please mention if a SIEM / SOC is in place? Siem is installed, SOC unknown.

59. The CSO Problem Statement document states that some of the software functionalities of the solution shall be the "Ability to analysis Patching". In this regard, please elaborate on the following:

a. Is the expected solution expected to consolidate reports of the patches or inconsistencies detected by other patch management tools? This is a nice to have requirement, it should allow functional users to review implications of patch applications. For example, modifications to existing responsibilities, menus, setups etc. Also to identify functions which may need to be tested.

60. Is Vulnerability Management and Security Incident Management also in scope. No

61. Are you looking to leverage Exceptions management to manage Vulnerability Related issues? No

62. Please elaborate and clarify on any additional integrations, other than the Oracle Business Suite, would be in scope for this RFP? Oracle EBS Suite is the main integration point.

63. Do you have a centralized Risk Oversight committee to oversee and manage the standardized/centralized risk methodologies? The FMO

64. Please elaborate on how you collect evidence for compliance and audit management.

Series of sql statements (converting to concurrent programs) executed on a regular basis to review any changes to monitored configurations or master data.

65. Are you looking to leverage Regulatory Change Management as part of ServiceNow IRM? This is out of scope.

66. If yes, do you have any existing subscriptions to regulatory content providers? N/a

67. Do you have your organization structure defined to perform risk and control assessments? Yes. DoD issue guidance.

69. Currently, are control indicators defined for evaluating the health of individual controls? Yes.

70. How many internal policies are you looking to migrate into ServiceNow IRM? The RFI is to identify available solutions/tools as no product has been selected.

71. What are the control frameworks that are currently used? Federal regulations (NIST, GAO, etc.)

72. Are you looking for Gen AI capabilities with IRM for Policy and Compliance? The RFI is to identify available solutions/tools as no product has been selected.

73. Do you plan to manage Policy Exceptions within the proposed solution? Potentially.

The RFI is to identify available solutions/tools as no product has been selected.

74. How do organization users access published policies today, is that via SharePoint or is there a company portal? SharePoint and Confluence.

75. Is the US Air Force interested in a UCF subscription that automatically brings in regulatory content and crosswalks standards to different regulatory requirements like NIST- CSF/NIST 800-53, etc. Potentially.

76. Do you currently have any subscriptions to authority document content providers? No.

77. In case if the proposed solution is expected to handle risk management, can you please articulate which of the risk domains (e.g. Financial Risk, Security Risk, etc.) the implementation is expected to cover. Looking for a GRC solution for Air Force’s core financial management system. All risk domains.

78. Please specify the baseline risk frameworks that are currently followed, which would be required to be configured. All Federal framework required.

79. How do you score risk and classify risk today? Do you use qualitative or quantitative approach for this purpose? High, Moderate, Low. Both qualitative and quantitative are used.

80. Do you have documented relationships between risks and their mitigating controls?

Yes.

81. Currently, are risk indicators defined for evaluating the level of risks? Yes, we evaluate risks based on impact (i.e. financial, reputational, and operational) and likelihood of occurrence (frequency and probability) to determine inherent risk. The inherent risk is then evaluated against the internal controls we have in place to determine control effectiveness and residual risk.

82. Do you have a risk hierarchy in place? Yes, we have both program and sub tier level risks. Program level risks are more high level for senior leadership decision making whereas sub tier risks are more at the process level.

83. Do you have a risk taxonomy in place? Yes, our taxonomy maps the risks to applicable internal controls which mitigate the risks and maps to NIST/FISCAM requirements.

85. What kind of Risk Metrics are you looking to track? What kind of differences are there between operational risk metrics versus Executive-Level risk metrics? Yes. We track inherent risk, residual risk, and control effectiveness risk scoring metrics from a SOC prospective.

86. Would external auditors require access to Audit Management? Outside of scope

87. Are you looking to manage audit resources (auditors’ availability, timesheets, etc.) as part of Audit Management? Outside of scope

88. How many estimated vendors would be managed via ServiceNow's TPRM solution?

The RFI is to identify available solutions/tools as no product has been selected.

89. Are you looking to perform due diligence and on-going vendor assessments within the tool? Outside of scope

90. How many different vendor assessment questionnaires would be in scope for TPRM?

The RFI is to identify available solutions/tools as no product has been selected.

91. Are you looking to manage ongoing third-party vendor reviews as part of the on-going maintenance? Outside of scope

92. How do your vendors respond to risk assessment questionnaires today? Do you plan to enable your vendors to access vendor portal (ServiceNow instance) to respond to vendor risk questionnaires? Outside of scope

93. Are you looking for integrations with third party security rating service providers such as BitSight, RapidRatings, RiskRecon, BlackKite, etc.? The RFI is to identify available solutions/tools as no product has been selected.

94. Do you already have vendor tiering in place? Outside of scope

95. Are you looking to manage third-party contracts within ServiceNow? The RFI is to identify available solutions/tools as no product has been selected.

96. If configuration is required for any specific reports that are currently being used for Compliance Management, please share samples if possible. Monitoring reviews of configuration changes (before and after), who made the change, when they made change, change approval (tag), change approval status

97. What custom reports and dashboards are you looking to export or manage within ServiceNow? The RFI is to identify available solutions/tools as no product has been selected.

98. Who would be the primary consumer of executive reports across IRM - CISO, CIO etc.?

ServiceNow has not been identified as a current solution. However, primary consumers are the PMO Materiel Leader, Program Managers, and FMO Director and Audit Compliance Lead

99. What level of report and dashboards are you looking to generate for business as usual and executive management consumption? Refer to #97