Internal Controls and Complicance - RFI 1.21.2026.pdf

Federal Emergency Management Agency (FEMA) Risk Management and Compliance Division

Request for Information (RFI) January 21, 2026

REQUEST FOR INFORMATION (RFI) SUMMARY: The Department of Homeland Security (DHS), Federal Emergency Management Agency (FEMA), Risk Management and Compliance Division (RMC).

requires contractor support for internal controls, and financial and information technology (IT) services.

Specifically, expertise in the following seven functional areas is needed:

1) Execution and monitoring of all aspects of OMB circular A-123, appendix B, C, and D

2) Extensive knowledge and application of GAO Greenbook

3) Enterprise and program planning

4) Cyber Security

5) Flood Insurance Operations Management

6) IT General Controls

7) Extensive knowledge of National Institute of Standards and Technology

(NIST) 800-53 controls

GENERAL INFORMATION: This RFI is issued solely for information gathering purposes to identify sources that can provide support for the RMC Division. This support will address steady-state operations and instances of increased staffing needs (surge conditions). In accordance with FAR 15.201(e), RFIs may be used when the Government wants to obtain price, delivery, other market information, and capabilities for planning purposes. Responses to these RFIs are not offers and cannot be accepted by the Government to form a binding contract. This RFI shall not be construed as a commitment by the Government for any purpose, nor does it restrict the Government to an ultimate acquisition approach.

Respondents are solely responsible for all expenses associated with their RFI response. Respondents will not receive additional information in response to their submittal to the RFI and will not be notified of the resulting market research.

PROPRIETARY INFORMATION AND DISCLAIMERS: Respondents shall identify any proprietary information in its RFI response. Information submitted in response to this RFI will be used at the discretion of the Government. Further, the information submitted will remain confidential insofar as permitted by law, including the Freedom of Information and Privacy Acts. FEMA reserves the right to utilize any non-proprietary technical information in the anticipated PWS or solicitation.

Although it is not necessary to address in their response, respondents shall be aware of any potential, actual, or perceived organizational conflicts of interests. Any real or potential conflicts must be sufficiently mitigated prior to a contract award. For further guidance, refer to the Federal Acquisition Regulation, Part 9.5.

NAICS CODE: 541211

PRODUCT SERVICE CODE (PSC): B547

ANTICIPATED PERIOD OF PERFORMANCE START DATE: March 2026

ANTICIPATED ACQUISITION STRATEGY: To be determined

ATTACHMENT: N/A

RFI RESPONSE SUBMITTAL INSTRUCTIONS:

Interested contractors shall submit their RFI responses electronically to Janine Bennett, Contracting Officer, at janine.bennett@fema.dhs.gov and Matthew Dusing, Contracting Officer Representative, at matthew.dusing@fema.dhs.gov no later than 1:00PM Eastern Standard Time (EST), February 4, 2026.

Questions regarding this RFI are due no later than 1:00PM Eastern Standard Time (EST), January 28, 2026.

“RFI Response for FEMA/OCFO - internal controls, financial and IT services” shall be in the subject line of your e-mail. All responses shall be unclassified, with proprietary information clearly marked. The document format shall be either Microsoft Word (.doc or .docx), or Adobe Acrobat (.pdf) formats. Pages shall be 8.5 by 11 inch and shall use a type pitch that is no smaller than a standard 11-point font type, with the exception of charts, graphs, or tables, which shall use a pitch not smaller than 10-point font.

Responses shall not exceed (4) pages in length including images, data displays, charts, graphs, and tables.

Page limitation does not include: 1 cover page. Do not include promotional materials.

RFI Responses shall include the following information in the order below:

A. Cover Page with the following information:

1. Company Name

2. Company Address

3. UEI Number

4. Company Point of Contact - Name, Title, Phone, and Email address

5. Statement of current business size status (i.e., HUBZone small business concern, service-disabled veteran-owned small business firm, 8(a) contractor, woman-owned small business, small business, or large business concern). Also, business size in relation to the NAICS code size standards assigned to this acquisition.

6. GSA Schedule Number, Contract Number, and Period of Performance and/or DHS Strategic Sourcing Vehicle Category Name and Contract Number, if applicable

B. Contractor Capability Statement - No more than one page in length

1. Summarization of relevant projects showing capabilities relevant to the seven functional areas previously identified in this RFI.

2. Past performance in applicable areas

C. Contractor RFI Responses to questions - No more than one page in length

The responses received will assist FEMA with identifying the number and nature of the entities that consider themselves potential technical solution providers. Each respondent, by submitting a response, agrees that any cost incurred in response to this RFI, or in support of activities associated with this RFI, shall be the sole responsibility of the respondent. FEMA shall incur no obligations or liabilities whatsoever, to anyone, for any costs or expenses incurred by the respondent in responding to this RFI.

REQUEST FOR INFORMATION (RFI) QUESTIONS

1. Flood Insurance Operations Management

Describe your organization’s experience supporting flood insurance operations, with specific emphasis on the design, implementation, and assessment of internal control processes and procedures. Include examples of how your approach has supported compliance, risk mitigation, operational oversight, and program integrity within complex or federally regulated environments.

2. IT General Controls

Describe your experience implementing, assessing, or monitoring IT general controls within federal environments. Include a discussion of methodologies, frameworks, tools, and lessons learned.

3. Staffing and Capacity Approach

Describe how your organization would structure staffing to support all seven functional areas identified in this RFI, including approaches for surge requirements, specialized expertise, and continuity of operations. If partnerships or subcontracting would be utilized, describe how they would be managed to ensure performance and accountability.