CFMS_RFI_GOLD_v2.0_Amendment.pdf

UNCLASSIFIED

(U) United States Cyber Command

(USCYBERCOM)

(U) Request for Information (RFI)

Cyber Financial Management System (CFMS)

May 21, 2019

Request for Information

Cyber Financial Management System May 2019

(U) USCYBERCOM

(U) Request for Information (RFI)

Cyber Financial Management System (CFMS) May 2019

(U) United States Cyber Command (USCYBERCOM) is seeking information from industry to assist with the development and planning of the enterprise Cyber Financial Management System

(CFMS). This is a Request for Information (RFI) notice only. This is not a Request for Proposal

(RFP).

1. (U) Overview and Procurement Description

(U) USCYBERCOM requires an extensible enterprise Cyber Financial Management System

(CFMS) capable of tracking funding throughout the phases of Planning, Programming, Budgeting and Execution (PPBE) for historical, current and future years. The consolidated solution must support the management of funding from various Command processes that include, but are not limited to:

Program Objective Memorandum (POM) & Budget Estimate Submission (BES)

Development and Management

Future Years Defense Programming Development

Program Decision Memorandum and Resource Management Decision Tracking

Spend Plan Development and Management

Military Interdepartmental Purchase Request (MIPR) Creation and Execution

Management

Fund Expenditures and Outlays

Fiscal Year (FY) Closeout

Contract Obligations and Expenditures

Civilian Pay

Travel

Special Accounts and Funds

Requirements Generation and Execution

(U) This RFI is requesting responses from both large and small businesses, including the following subsets: Small Disadvantaged Businesses (SDBs), Historically Underutilized Business

Zones (HUBZone) Firms, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses

(SDVOSBs) and Women Owned Small Businesses (WOSBs).

2. (U) Scope of RFI

(U) Through the responses provided, the Government intends to obtain the following information:

a. (U) Description of industry’s capabilities to meet the technical requirements described in this RFI.

b. (U) Industry input and suggestions on resource management approaches that would maximize innovation, minimize cost/schedule, improve performance, and reduce risk.

c. (U) Acquisition recommendations including contract type, contract structure, strategies to maximize competition, and strategies to maximize small business participation.

3. (U) Technical Requirements

(U) The contractor shall provide information on consolidated Commercial Off-the-Shelf

(COTS), Government Off-the-Shelf (GOTS) or non-developmental solution(s) that meet the

Government’s process mapping, workflow identification, and technical characteristic requirements as described in Appendix A.

(U) The solution is expected to be a single source effort that has various modules capable of meeting the Government’s requirements. The CFMS will have a fixed baseline system with configurable templates that can be adapted throughout the life of system. Templates will be user buildable and configurable. The CFMS shall provide a user-definable logic-driven system workflow that is capable of adapting to and managing all USCYBERCOM resources.

4. (U) Requested Information

(U) All requested information is intended to facilitate the Government’s market research efforts and inform the Government’s acquisition considerations. Please ensure submissions include responses to the following information:

a. (U) Identification and Interest:

o (U) Company Name and Address; Company Representative’s Name and Business

Title o (U) Business Category(ies): (e.g., Large Business, Small Business, SDB, HUBZone, 8(a), SDVOSB, WOSB, involvement in mentor and/or protégé program, etc.)

o (U) Company’s ability to meet the classification and security requirements of this effort (including cleared facilities) o (U) Explain your company’s potential interest in this effort (e.g., Prime, Subcontract, Teaming, etc.)

b. (U) Technical Approach Recommendations:

o (U) Description of consolidated COTS, GOTS or non-developmental solution items that address USCYBERCOM’s requirements, as described in Appendix A.

Highlight any additional features of the solution that would prove beneficial to the

CFMS.

o (U) Rough Order of Magnitude (ROM) (presented in increments of twenty-four

(24) licenses/users) cost/price and schedule for initial capability execution. This should include Operations and Maintenance (O&M) support.

o (U) How will you architect the system workflow (as described in Appendix A) and ensure the solution fits the Command’s current workflow?

o (U) Does your COTS, GOTS or non-developmental solution operate on commercial hardware?

o (U) What Air Force accounting systems is your solution currently compatible with?

c. (U) Completion of the attached Technical Characteristics Capability Worksheet. This worksheet shall be used to map Appendix A requirements to your solution. Please read the instructions provided, and complete in its entirety.

d. (U) Risk:

o (U) Risks and dependencies the Government should be aware of that could impact successful execution of this effort (e.g., licensing concerns, intellectual property, etc.)

5. (U) Industry Discussions

(U) Representatives of USCYBERCOM may choose to meet with respondents and hold one-on-one discussions. Such discussions would be intended to obtain additional clarification of RFI responses.

6. (U) Questions

(U) Questions regarding this announcement shall be submitted in writing by email to proposal_submission@cybercom.mil and ktguy@cybercom.mil and shall be clearly marked

“QUESTIONS in response to Cyber Financial Management System RFI”. Verbal questions will not be accepted. Answers to questions will be posted to FedBizOpps (FBO). The

Government does not guarantee that questions received after 2 July 2019 will be answered. The

Government will not reimburse companies for any costs associated with the submission of their

RFI responses.

7. (U) Response Guidelines mailto:ktguy@cybercom.mil

(U) Interested parties are requested to respond to this RFI with a white paper. Reponses shall specifically describe responses to each of the bullets in Appendix A.

(U) White papers shall be in Microsoft (MS) Word for Office, Adobe PDF, or compatible format and shall not exceed twenty (20) pages, excluding cover, title, and table of contents pages. A page is defined as each face of an 8 ½ by 11-inch sheet with information contained within a one-inch margin on all sides. Text shall be Times New Roman and no less than 10-point font. The response should not exceed a 5MB email limit for all items associated with the RFI response.

(U) Companies that wish to respond to this RFI shall send responses clearly marked

“RESPONSES to Cyber Financial Management System RFI via email, and time stamped no later than 30 July 2019 Eastern Time to proposal_submission@cybercom.mil and ktguy@cybercom.mil. In the subject line of the email please label in the following format:

“Cyber Financial Management System _RFI Responses_Companyname_DDMMYYYY.”

8. (U) Disclaimer

(U) This RFI is not an RFP and is not to be construed as a commitment by the Government to issue a solicitation or ultimately award a contract. Responses will neither be considered as proposals, nor will any award be made as a result of this RFI. All information contained in the

RFI is preliminary and subject to modification and is in no way binding on the Government.

Federal Acquisition Regulation (FAR) clause 52.215-3, “Request for Information or Solicitation for Planning Purposes”, is incorporated by reference in this RFI. The Government does not intend to pay for information received in response to this RFI. Respondents to this invitation are solely responsible for all expenses associated with responding to this RFI. This RFI will be the basis for collecting information on available capabilities and is issued solely for information and planning purposes. Proprietary information and trade secrets, if any, shall be clearly marked on all materials provided in response to this RFI. All received information that is marked

“Proprietary” will be handled accordingly. Please be advised that all submissions become

Government property and will not be returned. In accordance with FAR 15.201(e), responses to this RFI are not offers and cannot be accepted by the Government to form a binding contract.

9. (U) Attachments

(U) Technical Characteristics Capability Summary Worksheet: Respondents are asked to fill out the attached Technical Characteristics Capability Summary Worksheet, by placing an ‘X’ next to each requirement they are capable of fulfilling with their single solution.

(U) CFMS Interface Requirements Diagram: To be used as a visual example of what the financial management process currently includes.

mailto:proposal_submission@cybercom.mil

10. (U) Appendix A: Technical Requirements

(U) Process Mapping and Workflow Identification

(U) In addition to providing a software/material solution, the contractor shall conduct process mapping and workflow identification for processes relevant to the proposed system. This process mapping will examine the flow of work for Cradle-to-Grave resource execution among the stakeholders to identify/validate each action executed by the respective division. The process mapping shall document the status-quo process, identify any gaps and/or redundancies within the current processes, and recommend improvements to the process. The process mapping shall result in:

Validation of system users and stakeholders (at the Directorate level). A list of all stakeholders that contribute to the successful execution of each function and their respective roles and responsibilities.

Documented process maps and detailed Command workflows. The mapping shall identify inputs and outputs within the processes. The workflow identification shall include the “if, then” logic associated with the successful routing of requests.

Validation/recommendation of necessary artifacts within each step of the workflow.

Identification of artifacts, handoffs, overlaps, and efficiencies within the process.

Recommendation of standardized information fields to be used within the process.

(U) Technical Characteristics

(U) Operational Requirements

(U) The CFMS shall contain a mechanism that will automate and facilitate the coordination of budgetary and financial management across multiple domains utilizing the existing

USCYBERCOM Enterprise Cross Domain Solution. The Command regularly receives requests for a broad array of capabilities that must be vetted/validated, planned, funded and executed in a standardized manner. The current environment involves multiple parties within the Command interacting across different systems and it does not provide a mechanism to automate, augment, or otherwise enhance a user’s ability to complete tasks in an efficient way.

(U) The CFMS shall house all USCYBERCOM required financial management functions and request approvals within one system (Planning, Programming, Budgeting and Execution); it will work from a single form with a single workflow to process funding certification requests.

(U) The CFMS shall be accessible to users with the appropriate permissions, who will each have an individual account. By using standardized or common data sets and associated functions, users across the Command with specified permissions shall be able to:

Query a common database for current and planned requirements.

Submit funding requests for requirements (both internal and external to the Command) for approval and check the status of current and past requests.

Display status logs (with timestamps) of current and past notifications and approval requests.

Run tailored data reports and analytics (e.g., expenditure reports, obligation reports, burn rate analyses, financial forecasts, unliquidated obligations, etc.). Provide the ability to organize budget records in a graph and/or tree structure wherever and whenever applicable.

(U) Interface and Migration Requirements

(U) The proposed CFMS shall:

Be able to interface and interact with multiple Air Force Accounting Systems, databases and other systems across multiple domains. Integration shall include data to and from the following currently supported systems, at a minimum:

o Defense Enterprise Accounting and Management System (DEAMS) o DFAS (Defense Finance and Accounting Services) o Procurement Desktop-Defense (PD2) – Command’s Current Contracting System o Wide Area Work Flow (WAWF) o Knowledge Management and Decision Support (KMDS) o Defense Resource Data Warehouse (DRDW) o ABIDES o CYBERVAULT (not operational) o JIRA (confluence) o Requirements Management System (SharePoint)

Include migration of function and integration of data from the following currently supported systems, at a minimum:

o e915 – currently used to staff MIPR requests within the Command.

o Comprehensive Cost and Requirement System (CCaRS) – current Command financial management system

(U) Resource Management Data Requirements

Provide authorized users the ability to create, read, update, and delete detailed records about an arbitrary number of budget record entries.

Provide Command-specific standardized fields and attributes of a budget record.

Provide users the ability to associate budget line items with the projects, programs, tasks and requirements they are funding.

Interface with external systems of record for budget management via API, to push and pull data as required.

Provide users with (Command approved) pre-defined forms/templates to support budget planning and funds execution (e.g., new record entry, funding acquisition form, MIPR, etc.).

Provide users with the ability to staff (gain approval) resource certification requests

(MIPRs) through the respective approval process in support of certification.

o Future capability would be to execute the certification of MIPRs in house.

(U) Functional Process Requirements

List all of the budget records in a concise, filterable list view.

Allow authorized users to create, read, update and delete workflows related to budget records.

Allow authorized users to create, read, update and delete a variety of dashboards based on budget records (e.g., budget years, color of money, means of execution, etc.).

(U) Support Requirements

(U) The contractor shall support the following:

Technical configuration, administration and maintenance functions necessary for the

CFMS to integrate with the existing USCYBERCOM Enterprise Cross Domain Solution.

Implementation of a cross-domain system that will ultimately contain requirements and resource data used throughout USCYBERCOM.

Application support (e.g., software maintenance) during the development of the Program

Objective Memorandum (POM), and configuration changes when necessary.

Prepare end-user training materials to support CFMS users in transitioning to the system.

Build and document integration steps from the existing systems onto the sponsor’s internal system, NIPRNet, and SIPRNet.

Integration of new systems introduced into the financial management process by

USCYBERCOM or other DoD Agencies.

o Support shall include ensuring all historical financial data is maintained..

(U) The contractor shall provide CFMS support during its deployment; once it is deployed and operational, the contractor shall provide operations, maintenance, system administration, and

Help Desk support for the CFMS and its associated infrastructure.

(U) After initial deployment, the contractor shall manage operations and ensure that the system is never down for more than two (2) consecutive business days, unless previously approved by the

Contracting Officer’s Representative (COR). Moreover, the contractor shall ensure the system is available 99% of the time, on a monthly basis.

(U) The contractor shall provide Help Desk support for issues associated with the CFMS.

(U) System Features

(U) The following sections describe the minimum features that the CFMS shall incorporate.

a. (U) User Accounts, Permissions, and Responsibilities:

(U) The CFMS shall support the following classes of users:

CFMS Administrator: Responsible for software updates, database maintenance, and user account maintenance. The most complete and comprehensive category of administrative account.

CFMS Approver: Responsible for approving new requirements; will be based on dollar thresholds. No software maintenance permissions. Responsibilities include the monitoring and maintenance of requirements requests.

Regular User: All other authorized users; has permissions to enter, edit, and delete requirements of which they are the owners.

b. (U) Data Management:

(U) The CFMS shall ensure that the following characteristics are maintained:

Consistency: The data shall be consistent across the database – contradictory/conflicting records (e.g., different spellings of company/personnel names) shall be flagged and brought to the owning user’s attention.

Up to date: The data shall include the most up-to-date information. The CFMS database shall identify incomplete funding records that have been dormant for a specified amount of time and shall be flagged and brought to the owning user’s attention for action.

Completeness: Criteria for data completeness shall be verified with the

Government and enforced via data management rules.

Security: The CFMS database shall be secure. Unauthorized access shall be prevented, and data shall be survivable and recoverable in the case of system and/or software failures.

Integrity: Provisions shall be made to protect the integrity of CFMS data – data shall not be changed except by authorized users and shall be tracked with audit logs.

Data retention: The CFMS shall retain historical resource data in accordance with DoD and Command records management policies.

c. (U) Data Search:

(U) The CFMS shall provide a search capability to all users to conduct data inquiries over the CFMS database. Searches shall be tailorable by combinations of relevant attributes, that include but are not limited to:

Owning organization

Requirement/contract name

Record IDs

Data tags

Fiscal year

Funding type/source

MIPR number and/or receiving organization

Other search parameters as negotiated

d. (U) Data Sharing and Reporting:

(U) There are several forms of data sharing that shall be implemented within the CFMS.

These shall include, but are not limited to:

Stakeholder Data Notifications: When certain types of data or information are entered (specific types to be determined by user groups during system configuration), a notification or alert message shall be generated and sent to specified recipients (nominally the POC as listed within a specified data structure)

(e.g.; approvals, updates).

Collaboration Messages: Messages and/or modified Coordination Requests between the users.

Data Downloads/Transfers: Users (particularly Administrators) shall have the ability to transfer data to other systems.

e. (U) Security Requirements

(U) In an architecture to be defined, the RMS shall handle unclassified and classified data across multiple domains. The contractor will provide cleared individuals who can access all domains up to the TS/SCI level. The contractor shall ensure requirements for safeguarding classified information and classified materials, for obtaining and verifying personnel security clearances, for controlling access to restricted information and

Government property, and for the security of automated and non-automated management information. The contractor’s management system shall prevent unauthorized disclosure of classified and sensitive unclassified information. The Government shall be immediately notified if any security incident or any indication of a potential unauthorized disclosure compromise of classified or sensitive unclassified information.

(U) Optional Requirements

(U) USCYBERCOM is also seeking information from industry to assist with the development and planning of several optional requirements. The following areas of support are in the very initial stages of planning. At the present time, USCYBERCOM is seeking information concerning the following requirements.

Requirements Management: USCYBERCOM requires an enterprise solution to support requirements management. The solution shall be capable of tracking and reporting on requirements from needs identification through solution identification, resourcing, execution and deployment. The enterprise solution shall be adaptable to the

USCYBERCOM requirements workflow and approval process. The system shall provide configurable reporting capability and shall be capable of migrating or integrating data and function from CFMS and requirements management.

Portfolio Management: USCYBERCOM requires an enterprise solution to support portfolio management (from the portfolio, program and project levels). The solution shall provide project and program (e.g., a portfolio of projects) management capabilities to track, aggregate, and integrate cost, schedule, performance, and risk. The system shall also provide project and program management capabilities that address performance management, manpower, and other critical aspects to successful execution. The system shall provide configurable reporting capability based on these various aspects of project and program management. The system shall provide configurable reporting capability and shall be capable of migrating or integrating data and function from CFMS and portfolio management.

In the event that Army, rather than Air Force, becomes the Executive Agent for

USCYBERCOM, the CFMS shall be able to interface with Army Accounting Systems, databases and other systems across multiple domain.

o (U) What Army and accounting systems is your solution currently compatible with?