Requirements Response Sheet.xlsx
XLSX spreadsheet 20 KB Posted
- Solicitation number
- FCSIC2020-01
- Issued by
-
Farm Credit Administration
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Requirements Response Sheet
| Vendors, please complete this requirement sheet along with your porposal | ||||
| Requirement number | Topic | Requirement description | Indicate how the requirement is met, as either: 1) within the baseline product capabilities, 2) system configuration (no coding), or 3) system customization (coding) | Optional comments, but if customization is required, please provide a description of the extent of customization needed. |
| 1.1 | Cloud software | Application must provide a 100% Cloud Software as a Service (SaaS) solution, in one secure and centralized system. The tool manages and stores all work processes, workflows, supporting documentation, and evidence (e.g., all FCSIC supporting documentation and evidence resides in the tool, and is not in stored in other systems, shared folders, or networks). | ||
| 1.2 | FedRAMP authorization to operate (ATO) | At a minimum, certified FedRAMP Moderate security. The vendor should also provide a Service Auditor Report on an annual basis related to the solution being provided. | ||
| 1.3 | Role-based security | Provide role-based security at a granular level (e.g., sections of a document or process). | ||
| 1.4 | Scalability | Workflow coordination, tracking, reporting, and publishing features suitable for finance and accounting. Collaborative platform allows multiple users to access and edit the same file simultaneously, with version controls and status tracking. | ||
| 1.5 | Integration | Documents and "modules" within the application should be fully integrated to avoid duplicate data entry and data integrity issues. | ||
| 1.6 | Dynamic object linkages and data integrity | Must provide dynamic linking of objects, content, and data to the individual data element/cell level that can secure content across multiple places and reports for efficiency and data integrity. Data within a file can be linked to other places in the file, as well as to other files inside the Tool. | ||
| 1.7 | Workflow responsibilities/restrictions | Roles and rules-based workflow must be embedded and available within the application throughout each process. The tool must route items automatically based on role and conditions. The tool shall manage the workflow tracking of audits, preliminary reports, draft reports, final reports, findings, recommendations, and responses to audit reports, management decisions, action plans, and audit follow-up documents, while maintaining the relationships between them. Customizable administrative and user roles, including workflow responsibilities/restrictions, file sharing, and access controls. FCSIC administrators can define and configure roles and assign individuals to those roles. | ||
| 1.8 | Workflow tracking | Sections within a file can be assigned to different users. Users and edits can be tracked and reported. Capable of direct tasking and commenting, time tracking, and calendar updates. | ||
| 1.9 | Segregation of data and periodic access based on roles | Capability to provide and deny access to segments of the system based on roles. | ||
| 1.10 | Document management and attachments | Ability to attach files in a variety of file formats such as PDF, Word, Excel, .txt, with no limitations in the number of files or file sizes. Ability to edit files within the application without the need to detach, save, edit, and reattach documents. | ||
| 1.11 | Version control | The application must have version control that captures the timing of, and individual(s) who make changes to documents. The application should permit one active version to be worked on by multiple users at one time, to eliminate the inefficiencies of managing multiple versions of a document. | ||
| 1.12 | Revision of documents | Application must be able to prevent the revision of comments or responses after submittal. | ||
| 1.13 | Dashboard interface | Provides role specific, editable dashboards. Users must be able to customize and configure individual dashboards as applicable and needed. | ||
| 1.14 | Import existing data | Ability to import existing data from SQL, Adobe Acrobat, and Microsoft applications without manual re-typing of the data. | ||
| 1.15 | Transform data | Transform data into formats required for financial reporting and audit management, including tables, charts, graphics, and text. Tool loads data and formats into report layouts. | ||
| 1.16 | Exporting | Ability to generate and export data, reports, and documents to a corresponding Microsoft-type format (Excel, PowerPoint or Word), and to PDF format. | ||
| 1.17 | Audit trail | Provide an audit trail of activities, changes/edits, updates, and deletions made to any activity/document/version. The software captures modifications and actions performed by users, including name, date, version, and time stamp. Versions tracked in real time. | ||
| 1.18 | Report distribution | Ability to forward reports and other deliverables by email via the software platform and to automatically send copies to the sender’s standard email system. | ||
| 1.19 | Search queries | Ability to search database tables and stored documentation captured/stored in the tool. | ||
| 1.20 | Active, complete, and archived work | Ability to designate information/documents as active, complete, or historic/archived information. |
Ability to lock completed work processes and documents to prevent additional modifications after completion.
Capability to lock each document to create a final unmodifiable document.
Reversing the process is possible with a workflow concurrence from a high role user.
| 1.21 | System flexibility, no custom programming | System flexibility for users to create/produce various report types and/or report styles within the software application, without software customization/development requiring additional costs. |
| 1.22 | Ease of use | Application must be user-friendly, intuitive, accessible, and does not require extensive training. |
| 1.23 | Training | Any necessary standard training is provided at no additional cost. The training should enable a user to implement an automated report from a new data source and to build graphics, such as charts and graphs, that will be updated automatically as the source data is updated. |
| 1.24 | User access | User access only requires the tool, a computer, internet connection, browser and VPN access through the FCSIC network. |
| 1.25 | Customer support, user help and documentation | User help and documentation is available via 1) a U.S.-based dedicated FCSIC Customer Service Manager, available via telephone and email during FCSIC’s core business hours of 8:30 AM to 5 PM Eastern, Monday through Friday, 2) a U.S.-based customer service telephone number, available 24 hours a day, 7 days a week, 365 days a year, for help outside of core business hours, and 3) a U.S.-based website for online support, including a repository of reference and self-help materials (such as webinars, tutorials, FAQs, PDFs, or other formats). The tool is user-friendly, easy to use, and has an intuitive interface, with any necessary standard training provided at no additional cost. |
| 1.26 | Collaboration | User ability to conduct controlled collaboration, add comments, and initiate tasks (with automated event/deadline notifications). |
| 1.27 | Up to 15 user licenses for one annual subscription cost | Flexible with up to 15 users is required to avoid additional costs, unnecessary modifications, easy expansion, and scalable use. |
| 1.28 | Self-contained solution | Ability to provide a comprehensive, vigorous, secure platform with capabilities including audit trail and linking for visibility, control, and risk management, without the need to rely on SharePoint or other systems/tools for any part of the process. |
| 1.29 | No configuration maintenance or upgrade costs | No additional costs required for ongoing configuration, maintenance, upgrades/updates. |
Automated software upgrades/version updates, including the newest security and functional capabilities available.
| 1.30 | Professional consulting services | The vendor will provide professional consulting services to assist with the integration of business processes into the software solution. |
| 1.31 | Data location | No data may reside outside of the U.S. and is secured per FedRAMP compliance. |
| 1.32 | Working with the Farm Credit Administration (FCA) | FCSIC outsources its technology support to the Farm Credit Administration (FCA). The vendor must work with the FCA team to secure an Authority-to-Operate. |
| 1.33 | Data linking | The system shall have the capability to link data automatically from source documents or files to dashboards, narratives, and other information. Reports and dashboards shall have the ability to automatically update based on updated source data. |
| 1.34 | Application programming interfaces | Can support future integrations and Application Programming Interfaces (APIs). |
| 1.35 | Section 508 Compliance | All parts of the system that FCSIC will use must be compliant with Section 508 of the US Workforce Rehabilitation Act of 1973, as amended in 1998. |
| 1.36 | Records retention | The vendor shall support a system in accordance with the requirement for Federal agencies to manage their electronic records in accordance with applicable laws and regulations, such as 36 CFR § 1236. |
The federal requirements for maintaining records to retain functionality and integrity throughout the records’ full lifecycle include:
- Maintenance of links between records and metadata, and
- Categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA approved retention schedules.
| 2.1 | Publication production processes | Streamline FCSIC data collection, accessibility, report generation, and publishing. |
| 2.2 | Risks, time, and costs | Reduce risk, report production time, and costs. Allow accurate data reports to be produced on time and on or under budget. |
| 2.3 | Workflows, tracking, version control, scheduling | Increase the ease, efficiency, and accuracy of editorial and comment tracking, file version control, workflows/file access controls, content validations, and scheduling/milestones/deadlines. |
| 2.4 | Interactions within FCSIC and outside of the Corporation | Increase the ease, efficiency, and accuracy of interactions with other FCSIC offices, external auditors, and OMB. |
| 2.5 | Flexible inputs/outputs | Add flexibility in inputs/outputs and formats. Allow AFR data to be readily available and accessible for other uses, inside and outside of the OCFO. |
| 3.1 | Audit tracking | Solution must be able to link to and share data across other FCSIC processes, not just a solution for one or the other. |
| 3.2 | Reporting | Solution must be able to create, maintain, develop, process, and update the interim and final reports of any reporting processes that stem from Notices of Finding and Recommendation. |
| 3.3 | Includes certification capability | Solution must include an approval/certification solution so that these do not have to be processed externally. |
| 3.4 | Includes control frameworks | The application must be able to contain control frameworks such as COSO, ISO ERM, CobiT, CMS. |
| 3.5 | Status tracking | The applications must be able to track and provide the statuses of reviews, audits, inspections, reports, documents, findings, and recommendations. |
| 3.6 | Case management | The primary purpose of case management is to track the status of the audit process, including tasks processed by multiple parties, multiple approving channels or transfer of responsibilities. Case management includes defined user roles and permits the addition of individuals on an ad hoc basis. |
| 3.7 | Connecting recommendations with corrective action plans | The solution must provide for management planning and oversight of corrective actions needed to address audit recommendations in a timely manner and comply with Federal Managers' Financial Integrity Act (FMFIA) requirements. |
| 3.8 | Tracks two distinct audit resolution processes | 1) Tracking of audits from announcement through to the completion of corrective actions; 2) Tracking of External/GAO audits from announcement to completion of corrective actions recommended in audit reports. |
| 3.9 | Reporting | The application must provide for integrated report writing, provide standard reports or templates and permit input of FCSIC-specific reporting templates. Scheduled report generation would be highly desirable. Information for reporting will require access to existing data and fields (from existing systems) and additional fields as determined by FCSIC. This working group will be formed prior to and during the configuration phase of the solution implementation. |
| 3.10 | Provided by client (PBC) process | Must include an automated process for audit related Provided by Client (PBC) requests/deliverables that incorporates workflow, tracks due dates and other relevant dates, manages and holds every part of the process (including attachments), and provides status reports. |
| 3.11 | Automatic evidence collection | Ability to attach audit evidence/documents and edit such evidence/documents within the software to avoid the storage of redundant data on the network and/or in a shared drive. |
| 4.0 | Reports | In addition to the above system requirements, the vendor shall design, configure, and set up the system to automate a number of key quarterly/monthly/weekly/daily reports that are currently prepared manually. The list of reports that are included within this requirement are detailed in Appendix A starting on page 20. We are referring to these reports as “Day 1” reports because the vendor shall have them built soon after the system is set up for users. The reports should be completed within 9 weeks from the contract award date. The reports shall require FCSIC to download the relevant source data into the system, and then the reports should automatically be updated and generated based on the source data and period the report is being run for. The reports shall be set up to be run during a frequency dictated by FCSIC, but no less than monthly. |
| 5.0 | Annual Report | The vendor shall also build FCSIC’s Annual Report template in the system and automate relevant financial reporting and trial balance data to interface with that report. The vendor shall incorporate prior year pictures and graphs (or new similar pictures/graphs, as determined by FCSIC) into the annual report so that the template is fully compliant. See https://www.fcsic.gov/financials/annual-reports for a copy of our most recent annual report. The vendor shall work with FCSIC’s current printer to establish that print colors and proper schemas are established and communicated. This work shall be completed within 9 weeks from the contract award date |
| 6.0 | RCM and Controls | The vendor shall also set up the internal controls portion of the system with FCSIC’s updated Risk Control Matrix (RCM) and related policy and procedure documents. The vendor shall establish an executive dashboard over the internal control status. The vendor shall allow FCSIC up to 11 months after award date to prepare the RCM and other related support. Once the internal control documents (RCM, narratives, policies and procedures, etc.) are delivered to the vendor, they shall import them and create an executive dashboard within 9 weeks of delivery. |
File details come from the government source that posted it. Updated .