FMS-ACES Development and Deployment RFI.pdf

UNCLASSIFIED

FMS-ACES RFI

Version 1.0 October 2022

Foreign Military Sales

– Army Case Execution System

(FMS-ACES)

Development and Deployment Services

Request for Information

(RFI)

Version 1.0 October 2022

Prepared By:

Program Executive Office Enterprise Information Systems Product Lead, FMS-ACES and Functional Lead, United States Army Security Assistance Command (USASAC) i

THIS PAGE INTENTIONALLY LEFT BLANK

ii

Table of Contents

1.0 Introduction

2.0 FMS-ACES Description

2.1 Background

2.2 Problem Description

2.3 Core Capabilities

3.0 Current and Future State

4.0 High Level Objectives

5.0 Key Information Points

6.0 References / Supplementary Information

7.0 Information Requested

7.1 Focus Areas

7.2 Response Approach

7.3 Special Requirements

8.0 Instructions

1.0 Introduction

The Army Contracting Command – Rock Island (ACC-RI) on behalf of the Product Lead (PL) Foreign Military Sales (FMS) – Army Case Execution System (ACES) (hereafter FMS-ACES) under U.S. Army Program Executive Office Enterprise Information Systems (PEO EIS) is seeking information on the following: (1) approaches in developing and deploying a secure solution that automates Army Case Execution business processes in support of FMS, (2) delivery timeline, to include incremental releases, and (3) overall costs.

Specifically, the Army is seeking an innovative FMS-ACES solution that accounts for technology evolution and technology insertion with minimal impact to solution composition, provides dynamic business rules generation to accommodate evolving mission scenarios, allows for data model extensibility for unique Government data elements associated with Laws, Policies, Regulations, and Directives (LPRDs) and interfaces, and meets requirements with minimal customization.

In addition, the FMS-ACES solution must be successfully delivered through agile development and deployment cycles that maximize (1) Development, Security, and Operations (DevSecOps) automation to Continuous Integration and Continuous Delivery (CI/CD), (2) compliance with the Continuous Risk Management Framework (cRMF), and (3) attainment of a Continuous Authority to Operate (cATO).

The purpose of this Request for Information (RFI) is for planning purposes and responses to this notice are not offers and cannot be accepted by the Government to form a binding contract. Information received in response to this RFI shall be safeguarded adequately from unauthorized disclosure.

Disclaimer: This RFI is for informational purposes only. This is not a “request for proposal (RFP)” to be submitted. It does not constitute a solicitation and shall not be construed as a commitment by the Government. Responses in any form are not offers and the Government is under no obligation to award a contract as a result of this announcement. No funds are available to pay for preparation of response to this announcement. Any information submitted by respondents to this technical description is strictly voluntary. Responses will not be returned to the responder. It is the responsibility of potential offerors to monitor websites for additional information pertaining to this requirement.

2.0 FMS-ACES Description

2.1 Background

FMS and other security cooperation programs support United States Government (USG) foreign policy as well as national security objectives. These programs require a wide range of participants and business processes to develop, execute, and fulfill orders for defense articles and services placed by foreign governments and international organizations.

The Defense Security Cooperation Agency (DSCA) manages security cooperation programs for the Office of the Secretary of Defense (OSD) and is responsible for reporting timely and accurate finance, acquisition, and logistics case execution information to various stakeholders including the Department of State (DoS), Congressional leadership, and international customers. However, this responsibility is often challenged given DSCA currently lacks sufficient visibility into case execution data and data standardization across the Department of Defense (DoD), to include the Military Departments (MILDEPs) and Implementing Agencies (IAs) where case execution data resides. This is due in large part to disparate legacy architectures where data is housed in stove-pipe systems containing non-standardized data and processes.

Consequently, a lack of common functionality and data sharing ability limits DSCA mission execution to a significant degree. The lack of an enterprise approach with standard processes increases risk to data integrity, adds unnecessary man-hours to the overall data collection process, and provides inadequate delivery tracking for mission critical defense articles and services.

The problem boundaries can be defined functionally, organizationally, and technically. Functionally, the business needs are specific to the subset of security cooperation business processes related to case execution. Organizationally, a wide range of entities need to access and/or manage case execution data, from the DoS for high-level case execution reporting to the MILDEPs/lAs where a majority of case execution data is generated. Technically, the current systems cannot keep pace with increasing Security Cooperation requirements to improve:

• Funds availability reporting

• Querying capabilities

• Case lifecycle execution

• Requisition / Order submission and tracking

• On-line integrated data repositories

• Financial and logistics auditability.

While much of the process capability within Centralized Integrated System for International Logistics (CISIL) has met the Army’s needs, the audit needs of the FMS process, specifically the Financial Improvement and Audit Readiness (FIAR)/Federal Information System Control Audit Manual (FISCAM) compliance, have outpaced the development and enhancement of the supporting technology. The lack of a role-based access control (RBAC) mechanism to define roles and privileges for system use also impacts the overall auditability, segregation of duties enforcement, and security of the system.

Currently, FMS transactions post in non-United States Standard General Ledger (USSGL) accounts in CISIL which are not compliant with Standard Financial Information

Structure (SFIS) requirements. This also contradicts Standard Line of Accounting (SLOA) policy. SLOA, A subset of SFIS requirements, is central to creating proper visibility and accountability of financial resources. Noncompliance undermines proper stewardship controls (fund owners, authorizing parties, and funds receipt accuracy).

Furthermore, for the last 15 years, the Army has operated a supplemental application to CISIL called the Case Management Application (CMA) (previously called Case Execution Analyzer (CEA)). The CMA is the Army Security Assistance Enterprise's (ASAE) enterprise workflow and workload management tool. The Army developed the CMA to run on top of CISIL to provide a modern user interface and computing environment with new functionality needed to accomplish the Army FMS Mission. The CMA includes additional data entry and fields not able to be included in CISIL. It also includes case alerts, user workload assignments, historic data capture, performance measurement and Defense Performance Management and Appraisal Program (DPMAP) functionality, document workflow, and final form preparation and production.

The CMA functionality must be consolidated into the modernized solution, which should be provided via an intuitive and easy-to-use interface for the end user.

Additionally, Army Reports is a consolidated data source for the ASAE FMS lifecycle data, which is owned and supported by DSCA under the Security Cooperation Information Portal (SCIP) umbrella. Army Reports is used for all Army FMS historical reporting requirements and utilizes COGNOS software for reporting capabilities.

Finally, CISIL functions as a batch system, processing transactions at pre-designated times and frequencies (daily, weekly, monthly). The modernized solution should be able to continue to support batch processing as dictated by the interfaces with specific systems, however, also allow for future expansion and shift to near real-time data processing and visibility as the coordinating systems and processes allow.

2.2 Problem Description

The Army is seeking to modernize its legacy FMS case implementation, execution, and closure system, CISIL, and centralize additional functionality included in several ancillary applications used to improve and enhance CISIL functionality and user interfaces. The primary function for CISIL is to centrally manage FMS case logistics, financials, and close outs while simultaneously synchronizing multiple Army and Department of Defense (DoD) systems and introducing supply requirements into the Army and DoD domestic supply systems. CISIL is wholly responsible for validating and applying all FMS laws, regulations, policies, and directives (LRPDs) to these supply requirements. CISIL is an antiquated system, developed in Common Business Oriented Language (COBOL) in the 1970s utilizing internal COBOL data storage/structures and not a standalone relational database management system (RDBMS). It has been in a brown-out state since 1996 with only critical mission requirements updated over time and no enhancements / improvements to COBOL coding/data structures. While the system currently performs the required capabilities, adjustments to the system are costly with COBOL program resources quickly becoming scarce. The Office of the

Secretary of Defense (OSD) has directed the Army to replace the aging CISIL with a modernized system that meets the needs of the Army’s FMS program.

The Army has directed that the modernized solution will be hosted in cArmy, the Army’s enterprise cloud environment. Additionally, the modernized solution must be able to support Army and non-Army United States Government partners (e.g., Missile Defense Agency, National Security Agency, General Services Administration). The Army has determined that a new system, the FMS-ACES, is necessary to keep pace with modern technologies, cybersecurity advancement, auditability, financial compliance, DSCA data collection, and shared requirements. FMS-ACES will meet the security cooperation community's business needs for improved visibility and quality of case execution data, comply with federal mandates and DoD standards, adopt standard end-to-end business processes and standard data elements to foster a new more robust business environment. The new system should provide a place where stakeholders can work together to proactively manage the Government's security cooperation programs, utilize modern programming languages and frameworks, and provide a more sustainable and maintainable application by way of an intuitive, familiar, and more modern user interface.

The FMS-ACES solution must meet specific Title 22 authorities that govern the Security Assistance Account (SAA) business process requirements for improved visibility and quality of data across the enterprise environment. The capabilities need to support systemically generated transactional processing to achieve more efficient case execution to better serve the customer. They must also meet business process reengineering conditions for defense business system (DBS) funds certification, specifically the need to document "to-be" business processes.

2.3 Core Capabilities

The following core capabilities are required to provide the functionality necessary to meet FMS case execution mission operations.

• Case Initiation: creates preliminary record(s) from initial information interfaced from the Defense Security Assistance Management System (DSAMS)

• Case Implementation: completes the preliminary record created during initiation and ensures all information is accurate and that the case is ready for execution activities

• Logistics: processes that process Requisitions / Customer Orders, maintain current and accurate status, and post shipment information

• Financial Execution: processes to provide financial information and status during case execution lifecycle; key processes for distributing funds, managing Interfund (Direct Cite)/Non-Interfund (Centralized) billing, reporting funds to the designated system(s), and managing and reporting performance report and fund status to the designated system(s)

• Case Lifecycle: processes and on-line queries used by case managers to manage case execution

• Case Closure: processes and on-line queries used to manage case closure at the case and line levels; these processes assign case/line closure responsibilities, prioritize workload based on the overall position of the case, track closure progress with visibility to all key stakeholders; they enable authorized case closure personnel to perform the logistic review, financial reconciliation and line certification as each line becomes supply, service complete (SSC) throughout case execution

• Foundational: actions and activities that are shared across processes like data download/print, data grid column filtering, compliance requirements for audit, cyber, etc.; those items that pertain to the overall application and not just one specific process or area

3.0 Current and Future State

Figure 1 depicts the Current State of case execution, with multiple applications and systems being used to conduct the management and implementation of the entire case execution process.

Figure 1. Current State

Figure 2 depicts the Future State of case execution, with one system to conduct the management and implementation of the entire case execution process.

Figure 2. Future State

4.0 High Level Objectives

High-level objectives include:

• Improve standardization of business processes and data

• Improve visibility and quality of case execution data

• Improve the availability and accessibility of data used for informed decision-making

• Improve the ability to enhance, sustain, and maintain the solution by applying flexible and adaptive technologies

• Comply with Federal and DoD mandates, to include DoD finance, acquisition, logistics, and Information Technology (IT) security policies

• Provide greater ability to implement, execute, forecast, and handle fluctuations in the level of administration of security cooperation programs

• Provide enhanced capabilities for transactional processing required for case execution, such as improved Graphical User Interface (GUI), transactional edits, and validation checks

• Provide an intuitive user interface that navigates the user through assigned processes

• Consolidate data into dynamic reports and dashboards

• Provide role-based access controls (RBAC) based on a roles and permissions hierarchy

• Automate data validation rules to ensure data context and accuracy at entry and ingest

• Provide access to historical data, to include performing data conversion

• Display data in a consolidated manner in a single view (e.g., common operating picture)

5.0 Key Information Points

FMS-ACES must standardize and automate all case execution processes with the ability to modify / overwrite business process workflows based on exceptions aligned to user roles and permissions.

FMS-ACES must be operational on Government-approved laptops and tablets.

FMS-ACES must be hosted in cArmy, the Army’s enterprise cloud environment, all applications must be Impact Level (IL) 4 and Federal Risk and Authorization Management Program (FedRAMP) compliant.

FMS-ACES must support information confidentiality, integrity, and availability ratings of Moderate/Moderate/Moderate or lower in accordance with Federal Information Processing Standards (FIPS) 199 and National Institute of Standards and Technology

(NIST) SP 800-122.

FMS-ACES must be NIST 800-53 compliant.

FMS-ACES must be compliant with applicable Office of Management and Budget (OMB) memorandums as they relate to Executive Order 14028 (e.g., M-21-31 Minimum Logging Standards, M-22-09 Federal Zero Trust Architecture Strategy, M-22-18 Third Party Secure Software Development Self Attestations)

FMS-ACES must provide user access via a Common Access Card (CAC)-enabled Authentication certificate with option for Multi-Factor Authentication.

FMS-ACES must be able to authenticate a user at Authenticator Assurance Level (AAL) 2 and Identity Assurance Level (IAL) 2 in compliance with NIST SP 800-63.

FMS-ACES must support role-based access control (RBAC) within business process workflow implementation and data access.

FMS-ACES must support DoD and federal Public Key Infrastructure (PKI) electronic certificate signatures on document outputs.

FMS-ACES must be compliant with the Electronic Signatures in Global and National Commerce Act (ESIGN Act, 15 U.S. Code Chapter 96).

FMS-ACES must be accessible from the Government Non-secure Internet Protocol Network (NIPRNet).

FMS-ACES will not process Personally Identifiable Information (PII) / Protected Health Information (PHI) data.

FMS-ACES will not be designated a National Security System in accordance with NIST Special Publication (SP) 800-59.

FMS-ACES must support National Archives and Records Administration (NARA) record archival requirements for all documents requiring archival; requirements will apply to unsigned but final, wet signed final, and electronically signed final documents.

FMS-ACES must provide the ability to readily make system changes after Initial Limited Deployment and Full Deployment, while realizing significant reductions in sustainment costs and reducing maintenance risk.

FMS-ACES is not a financial system; however, as a financial feeder system, it must be compliant with the following financial standards: SFIS and FIAR/FISCAM.

FMS-ACES must account for technology evolution and the ability to perform technology insertion into the solution with “minimal” effort.

FMS-ACES must provide an intuitive user interface that navigates the user through assigned processes.

FMS-ACES must consolidate data into dynamic reports and dashboards.

FMS-ACES must automate defined validation rules to ensure data context and accuracy at entry/ingest.

FMS-ACES must be able to access historical data, to include performing data conversion.

FMS-ACES must be able to present data in a consolidated manner in a single view (e.g.

common operating picture.

6.0 References / Supplementary Information

The following artifacts / products are included as Attachments to assist in providing a description of the required capability.

• Requirements Master List: Attachment 006 (Attach006-FMS-ACES RFI – Requirements Master List.xlsx)

• Operating Environment Description: Attachment 007 (Attach007-FMS-ACES RFI

– Operating Environment Description.pdf)

• Sample Files: Attachment 008 (Attach008-FMS-ACES RFI – Sample Files.zip)

• Sample Forms: Attachment 009 (Attach009-FMS-ACES RFI – Sample Forms.zip)

• Sample Screenshots: Attachment 010 (Attach010-FMS-ACES RFI – Sample Screenshots.zip)

7.0 Information Requested

7.1 Focus Areas

This RFI focuses on the following areas:

• Preferred Solution

• Approach, Data, and Innovation

• Cloud Hosting and Cybersecurity

• Requirements Clarity and Viability

• User Experience Approach

• Cost, Schedule, and Performance

• Sustainment Approach

• Contract Considerations

7.2 Response Approach

Refer to Attachment 001 – FMS-ACES RFI Questions (Attach001-FMS-ACES RFI - Questions.pdf) for the list of questions associated with the information being requested for each focus area noted in paragraph 7.1. Refer to Attachment 002 – FMS-ACES RFI Questions Response Template (Attach002-FMS-ACES RFI - Questions Response Template.docx) for the template to use when preparing your response to each question.

An “Additional Information” section has also been provided in Attachment 002 for you to include any additional information you believe the Government should take into consideration. Your response to the information requested should be from the perspective of your preferred solution and/or process(es) vice past performance / demonstrated experience.

Refer to Attachment 003 – FMS-ACES RFI Requirements Feedback Template (Attach003-FMS-ACES RFI - Requirements Feedback Template.xlsx) to be used to provide Requirements Feedback.

Refer to Attachment 004 – FMS-ACES RFI Cost ROM Template (Attach004-FMS- ACES RFI - Cost ROM Template.xlsx) to be used to provide your Cost ROM.

Refer to Attachment 005 – FMS-ACES RFI Schedule Template (Attach005-FMS-ACES RFI - Schedule Template.xlsx) to be used to provide your schedule.

To provide more informed responses, it is recommended that you become familiar with the reference materials and information provided, specifically regarding the requirements.

See paragraph 8.0 for submission Instructions.

7.3 Special Requirements

The Government will review market information to ascertain potential market capacity to: 1) provide services consistent, in scope and scale, with those described in this notice and otherwise anticipated; 2) secure and apply the full range of corporate financial, human capital, and technical resources required to successfully perform similar requirements; 3) implement a successful project management plan that includes:

compliance with program schedules; cost containment; meeting and tracking performance; hiring and retention of key personnel and risk mitigation; and 4) provide services under a performance based service acquisition contract.

8.0 Instructions

Participation in response to this RFI will not preclude any vendor from responding to future acquisitions, either individually or as part of a team.

Marketing brochures will not be considered adequate information in response to this

RFI.

Limit responses to the Government templates provided and the associated Instructions for each. Submit each requested item with the filename specified below.

Requested Item

Template Filename (please note extension for file format)

Question Responses

Attachment 002 – FMS-ACES RFI Questions Response Template

Attach002-FMS-ACES RFI – Questions Response Template.docx)

CompanyName-Att002-FMS- ACES RFI-Question Responses.docx or .pdf

Requirements Feedback

Attachment 003 – FMS-ACES RFI Requirements Feedback Template

(Attach003-FMS-ACES RFI – Requirements Feedback Template.xlsx)

CompanyName-Att003-FMS- ACES RFI-Requirements Feedback.xlsx

Cost ROM Attachment 004 – FMS-ACES RFI Cost ROM Template

(Attach004-FMS-ACES RFI – Cost ROM Template.xlsx)

CompanyName-Att004-FMS- ACES RFI-Cost ROM.xlsx

Schedule Attachment 005 – FMS-ACES RFI Schedule Template

(Attach005-FMS-ACES RFI – Schedule Template.xlsx)

CompanyName-Att005-FMS- ACES RFI-Schedule.xlsx

The format of Attachment 002 – FMS-ACES RFI Questions Response Template reflects a one-inch margin and the font is set at Times New Roman, 10pt (which is the minimum). This format must be preserved. Graphics and tables that are legible without magnification are acceptable.

Proprietary information, if any, should be minimized and MUST BE CLEARLY MARKED on all submitted products.

Please submit your responses via e-mail to ashley.c.smith92.civ@army.mil) and pamela.m.grys.civ@army.mil by 1300 Central Time November 30, 2022. Submissions should be directed per the instructions.

Questions regarding this RFI should be submitted via e-mail to ashley.c.smith92.civ@army.mil) and pamela.m.grys.civ@army.mil no later than 1300 Central Time on November 4, 2022.

RFI Attachments:

001 – FMS-ACES RFI Questions (Attach001-FMS-ACES RFI – Questions.pdf)

002 – FMS-ACES RFI Questions Response Template (Attach002-FMS-ACES RFI – Questions Response Template.docx)

003 – FMS-ACES RFI Requirements Feedback Template (Attach003-FMS-ACES RFI – Requirements FeedbackTemplate.xlsx)

004 – FMS-ACES RFI Cost ROM Template (Attach004-FMS-ACES RFI – Cost ROM.xlsx)

005 – FMS-ACES RFI Schedule Template (Attach005-FMS-ACES RFI – Schedule Template.xlsx)

006 – FMS-ACES RFI Requirements Master List (Attach006-FMS-ACES RFI – Requirements Master List.xlsx)

007 – FMS-ACES RFI Operating Environment Description (Attach007-FMS-ACES RFI

– Operating Environment Description.pdf)

008 – FMS-ACES RFI Sample Files (Attach008-FMS-ACES RFI – Sample Files.zip)

009 – FMS-ACES RFI Sample Forms (Attach009-FMS-ACES RFI – Sample Forms.zip)

010 – FMS-ACES RFI Sample Screenshots (Attach010-FMS-ACES RFI – Sample Screenshots.zip) mailto:ashley.c.smith92.civ@army.mil mailto:pamela.m.grys.civ@army.mil mailto:ashley.c.smith92.civ@army.mil mailto:pamela.m.grys.civ@army.mil