Request_for_Information_(IT_Gap_Analysis).doc

Request for Information

The FEC is seeking information about the strategies and capabilities of available vendors (small businesses) to perform Information System Asset Inventory and Gap Analysis. This information can then be used for comparative purposes and to inform OCIO and validate its assumptions as it writes a performance work statement (PWS). Although OCIO knows what applications and systems it has in place, it must formalize and document the inventory process with a consistent and repeatable methodology. OCIO anticipates that undertaking an asset/information system inventory and a gap analysis will involve the following tasks below: If our assumptions are incorrect, and you have a different approach, please provide the specific detail of your approach with your response to the RFI.

· Create and document an accurate map of the network. This map should also include wireless devices and connections to any clouds, external networks and other networks.

· Create an accurate list of all devices (computers, printers, routers, gateways, etc.) on the network. For each device, record host name, role (its purpose on the network), MAC Address (and IP address if static), service tag, physical location, operating systems or firmware, Ports use, Firewall rules (if any), type of data the devices process and who can access the data.

· Create a list of all protocols running on the network.

· Record physical routes that FEC Virtual Local Area Network (VLAN) traffic traverse.

· Assign a specific person who is responsible for each asset.

· Remove any unauthorized devices or protocols on the network.

· Identify and document the current network enclaves: which groups of users on the network have access to what types of information (HR enclave has access to the personnel files; OGC has access to the legal files, etc.).

· Map and document the FEC’s information systems according to the definitions provided for in NIST 800-60.

· Develop and document a high-level, comprehensive understanding of the FEC’s strategic dependency on each information system and the data it contains.

· Develop and document an analysis of the impact that a loss of the Confidentiality, Integrity or Availability of the information contained in each system would have on the agency.

· Formally document an Organizational Impact Statement for each information system that describes the business function supported by the system (or group of systems) and the mission impact (SEVERE, SERIOUS, LIMITED) in the event of a loss of Confidentiality, Integrity or Availability of that information.

· Apply the FIPS 199 mandatory security categorization standard to each information system using the Organizational Impact Statement as a guide. This task will establish the initial baseline of security controls for each system.

· Map and document existing security controls as they apply to the identified information systems.

· Identify and document gaps between NIST 800-53 minimum security controls and existing security measures.