NGA_DRAFT_SOW for RFI_HM047626_FSA_FISMA.pdf

UNCLASSIFIED

Last modified: 6 July 2026

National Geospatial-Intelligence Agency (NGA)

Financial Statement Audit and Federal

Information Security Modernization Act of 2014

Evaluation (FSA FISMA)

DRAFT Statement of Work

This document is intended for Request for Information purposes only. The information and details contained herein are subject to change.

UNCLASSIFIED FSA FISMA

Table of Contents

1. OBJECTIVE AND BACKGROUND

1.1 Entity Background

1.1.1 NGA Mission

1.1.2 History

1.1.3 Organizational Structure

1.1.4 NGA Financial Management

1.1.5 Systems and Service Providers

1.1.6 Financial Statements

1.1.7 Information Security

1.2 Audit and Evaluation Background

1.2.1 Financial Statement Audit

1.2.2 Federal Information Security Modernization Act Evaluation

2. REQUIREMENTS

2.1 Financial Statement Audit

2.1.1 Planning

2.1.2 Testing

2.1.3 Completion and Reporting

2.2 Federal Information Security Modernization Act Evaluation

2.2.1 Planning

2.2.2 Evaluation

2.2.3 Reporting

2.3 Program Management

2.3.1 Quality Control

2.3.2 Contractor Personnel

2.3.2.1 Security Information

2.3.2.2 Mandatory Training

2.3.2.3 Independence

2.3.2.4 Professional Competence

2.3.2.5 Confidentiality and Non-Disclosure

2.3.2.6 Key Personnel

2.3.3 Monthly Progress Reports

2.3.4 Technical Status and Other Meetings

3. AUDIT AND EVALUATION DOCUMENTATION

3.1 General Requirements for Financial Statement Audit Documentation

3.2 General Requirements for FISMA Evaluation Documentation

3.3 Access to and Retention of Documentation

4. PERIOD OF PERFORMANCE AND PLACE OF PERFORMANCE

4.1 Period of Performance

4.2 Place of Performance

4.2.1 Location

4.2.2 Travel

4.2.3 Government Furnished Property

5. INSPECTOR GENERAL OVERSIGHT AND ASSISTANCE

APPENDIX A – Deliverables

APPENDIX B – Labor Categories APPENDIX C – Security

C.1 Classified Work Performance Security Requirements C.2 Personnel Security Requirements C.3 Physical Security Requirements C.4 Unclassified Work Performance Security Requirements C.5 Uncleared Personnel Security Requirements C.6 Information Security Requirements C.7 Cybersecurity Requirements C.8 Insider Threat Requirements

1. OBJECTIVE AND BACKGROUND

The objectives of this Statement of Work (SOW) are to obtain: 1) an annual independent audit of the

National Geospatial-Intelligence Agency’s (NGA) financial statements, and 2) an annual independent evaluation of NGA’s information security program and practices in accordance with the Federal

Information Security Modernization Act (FISMA) of 2014, Public Law 113-283.

Please note: The Contractor shall follow the most recent version of all applicable laws, regulations, accounting and auditing guidance as well as information security management guidance as referenced throughout the SOW. The NGA Office of Inspector General (OIG) acknowledges that there may be changes in future guidance that impact the deliverables in this SOW. If such changes should occur during the period of performance of this order, appropriate changes to the terms, conditions, and price, if needed, of this order will be made by the Contracting Officer (CO) via contract modification.

1.1 Entity Background

1.1.1 NGA Mission

NGA’s mission is to provide timely, relevant, accurate, and actionable geospatial intelligence (GEOINT) in support of the nation’s security. GEOINT is the exploitation and analysis of imagery and geospatial information to describe, assess, and visually depict physical features and geographically referenced activities on the Earth. GEOINT consists of imagery, imagery intelligence, and geospatial information.

NGA delivers world-class GEOINT that provides a decisive advantage to policymakers, military service members, intelligence professionals and first responders.

NGA is a unique combination of a Department of War (DoW) combat support agency and a principal member of the U.S. Intelligence Community (IC). NGA receives guidance, mission priorities, and oversight from DoW, the Office of the Director of National Intelligence (ODNI), and Congress. NGA provides a wide range of GEOINT analyses, data and services for customers. This includes everything from contributing to the state of readiness of our military forces to ensuring safety of navigation in the air, on land, and over/under the seas. NGA also helps protect the homeland by providing critical insight for humanitarian efforts, disaster relief and recovery operations.

1.1.2 History

NGA was initially established as the National Imagery and Mapping Agency (NIMA) by the fiscal year

(FY) 1997 National Defense Authorization Act, which combined several DoW and IC components responsible for imagery and mapping capabilities into a single component. With the enactment of the

National Defense Authorization Act for FY 2004 on 24 November 2003, NIMA was officially renamed the National Geospatial-Intelligence Agency to better reflect its primary mission in the area of GEOINT.

1.1.3 Organizational Structure

Effective October 1, 2025, NGA’s internal organizational structure is led by NGA’s Director, Deputy

Director, Chief of Staff, and Senior Enlisted Leader with support by two Associate Directors (ADs) and the West Executive. The Financial Management directorate and Office of Small Business report to the

Deputy Director. The Chief of Staff oversees Security and Installations; Human Development; Corporate

Communications and Corporate Operations. The AD for Operations oversees the Agency’s operational elements while the AD for Capabilities oversees the Office of the Chief Information Officer; Office of

Contract Services; GEOINT Innovation and Research; and Program Executive Offices. Finally, the West

Executive represents the Director and Deputy Director at NGA’s Missouri campuses and assists with the integration of activities across the West.

NGA personnel includes civilian, military, and contractor employees across more than 100 locations in the U.S. and 20 international locations. NGA is headquartered in Springfield, Virginia (NGA-

Washington) and has two major locations in St. Louis, Missouri (NGA-St. Louis) and Arnold, Missouri

(NGA-Arnold). In 2026, NGA replaced its former St. Louis facility with a new modern, sustainable, and technologically advanced campus (previously referred to as Next NGA West or N2W) that will allow the agency to meet its evolving GEOINT mission.

1.1.4 NGA Financial Management

NGA’s Financial Management (FM) Directorate is aligned under NGA’s Deputy Director and is led by the Chief Financial Executive (CFE), Deputy CFE, and Comptroller. FM is comprised of several offices located at both NGA-Washington and NGA-Arnold. The FM Audit Liaison team within the

Comptroller’s office is responsible for audit liaison functions for the financial statement audit (FSA) and thus serves as the focal point for coordinating requests for audit documentation and meetings.

NGA has an Audit Committee (AC), chaired by the CFE and made up of senior leaders within the agency, which reports directly to the NGA Deputy Director. The roles and responsibilities of the AC include implementing and driving the overall progress of the FSA and resulting corrective action plan for the enterprise; establishing NGA’s audit goals and monitoring and managing risks to those goals; and facilitating communication between senior management, external stakeholders, and the independent auditors.

1.1.5 Systems and Service Providers

NGA uses a Momentum® Enterprise Solutions integrated financial management system, GEOINT-

Financials (GEO-F). GEO-F performs core federal financial functions such as budget execution; funds control; general ledger management; requisition, payment and receivable management; and external reporting. The National Reconnaissance Office serves as NGA’s application service provider for GEO-F.

In addition to GEO-F, NGA uses Oracle® PeopleSoft for human capital management (PeopleSoft Human

Resources module) and property accountability (PeopleSoft Asset Management module). NGA also utilizes and relies upon various DoD systems and other service providers including, but not limited to, the

Defense Civilian Pay System and the Defense Finance and Accounting Service for processing payroll and travel transactions as well as certain vendor payments. In FY 2025, NGA began using Treasury’s Invoice

Payment Platform (IPP) for unclassified invoice processing.

1.1.6 Financial Statements

NGA’s financial statements consist of the Balance Sheet, Statement of Net Cost, Statement of Changes in

Net Position, and Statement of Budgetary Resources. The Office of Management and Budget (OMB)

Circular No. A-136, Financial Reporting Requirements, specifies the form and content of the principal financial statements, the accompanying notes, required supplementary information (RSI), and other information (OI). NGA applies the above guidance, in addition to guidance issued by DoW and ODNI, when preparing its financial statements and agency financial report (AFR). NGA’s AFR is classified and therefore not publicly available.

1.1.7 Information Security

NGA’s information security program encompasses roles and responsibilities from multiple agency components including the Office of the Chief Information Officer (OCIO) and the Security and

Installations Directorate (SI). OCIO is responsible for internal, external, and contractor intelligence systems and programs under its purview in accordance with Intelligence Community Directive (ICD) 503, Intelligence Community Information Technology Systems Security Risk Management, Certification and

Accreditation. The Information Technology (IT) Audit Management Office, within OCIO, is responsible for liaison functions for FISMA and the IT portion of FSA and thus serves as the focal point for coordinating such documentation and meeting requests.

SI is responsible for protecting NGA’s classified and unclassified information and oversees the development, coordination, and dissemination of approved security classification guides (SCGs), including the Consolidated NGA (CoNGA) SCG. SI also provides classification management and security education to the workforce.

1.2 Audit and Evaluation Background

1.2.1 Financial Statement Audit

The Government Management Reform Act (GMRA) of 1994 (Public Law 103-356) amended the requirements of the Chief Financial Officers (CFO) Act of 1990 (Public Law 101-576) by requiring the annual preparation and audit of organization-wide financial statements of the 24 major executive departments and agencies. The GMRA also required audited financial statements of components of executive departments and agencies designated by the Director, OMB. The Senate Select Committee on

Intelligence Report No. 107-63, accompanying S. 1428, “Intelligence Authorization Act for FY 2002,” contained the initial requirement for an audit of the NGA financial statements. The Intelligence

Authorization Act of 2010 granted statutory authority to the NGA Inspector General (IG) and made NGA a Designated Federal Entity. As a direct result, the NGA OIG is responsible for performing or overseeing an independent audit of the NGA annual financial statements. 50 USC 3108 required a full financial audit of NGA and other elements of the intelligence community beginning with FY 2014. NGA has received a disclaimer of opinion on its financial statements for FYs 2014 through 2025.

1.2.2 Federal Information Security Modernization Act Evaluation

The Federal Information Security Modernization Act of 2014 (FISMA) amended previous FISMA language to 1) provide a comprehensive framework for ensuring the effectiveness of information security controls and 2) provide a mechanism for improved oversight of Federal agency information security programs. OMB has oversight authority over Federal agency information security policies, and the

Department of Homeland Security (DHS) has authority to administer the implementation of such policies.

FISMA directs the National Institute of Standards and Technology (NIST) to develop standards and guidelines for ensuring the effectiveness of information security controls over information systems that support Federal agency operations and assets. In response, NIST issued security controls and enhancements via Special Publication (SP) 800-53. NIST SP 800-53 excludes national security systems

(NSS); however, the Committee on National Security Systems Instruction (CNSSI) 1253 requires NSSs to align with NIST SP 800-53. FISMA requires senior agency officials to provide security for the information and information systems that support the operations and assets under their control and to report annually on the effectiveness of their policies and procedures.

In addition to agency reporting requirements, FISMA also requires each agency’s IG, or an external independent auditor determined by the IG, to perform an annual, independent evaluation of the effectiveness of the agency’s information security program and practices and report the results to OMB, in accordance with guidance and deadlines established by OMB. FISMA further instructed OMB to consult with DHS, CIGIE, and other appropriate parties to develop reporting metrics that IGs should use when performing their evaluation. For IC agencies, and to properly protect NSS information, reporting to

OMB is only at a summary level, which the IC OIG submits on behalf of the IC. As such, the IC OIG issues evaluation and reporting guidance to the IGs of IC agencies that is consistent with OMB guidance and updated, as necessary, for the IC and NSS.

2. REQUIREMENTS

2.1 Financial Statement Audit

The Contractor shall conduct an audit of NGA’s annual financial statements. The audit shall be performed in accordance with generally accepted government auditing standards (GAGAS), as specified in the

Government Accountability Office’s (GAO) Government Auditing Standards, and the provisions of OMB

Bulletin No. 24-02, Audit Requirements for Federal Financial Statements. In conducting the audit, the methodology used should be consistent with the GAO/Council of the Inspectors General on Integrity and

Efficiency (CIGIE) Financial Audit Manual (FAM). If the Contractor applies its own methodology, the

Contractor shall provide with the Audit Strategy deliverable, listed in 2.1.1 below, the FAM 1003 checklist that demonstrates how the Contractor’s audit approach addresses the elements of the FAM.

2.1.1 Planning

The Contractor shall plan the audit work consistent with the FAM and prepare related documentation as described in FAM and listed in Deliverable No. 006. The Contractor shall design an audit plan to obtain the evidence necessary to report on NGA’s financial statements, internal controls, and compliance with laws, regulations, contracts, and grant agreements. The Contractor shall communicate with the

Contracting Officer’s Representative (COR) prior to the implementation of any significant changes to the audit plan. The Contractor shall conduct an entrance conference with key NGA and OIG stakeholders before performing any significant planning activities that involve NGA management.

(Deliverable 006 as described in Appendix A)

2.1.2 Testing

The Contractor shall complete the following in accordance with the FAM:

• determine the nature, timing, and extent of audit procedures

• document the results of audit procedures performed

• document conclusions reached

Audit procedures shall encompass tests of internal controls, including information systems controls; tests of detail transactions and balances (substantive testing); and tests of compliance of applicable laws, regulations, contracts, and grant agreements. As necessary, and based on testing performed, the

Contractor shall develop findings and recommendations as described in GAGAS and FAM.

(Deliverables 007 and 008 as described in Appendix A)

2.1.3 Completion and Reporting

The Contractor shall complete audit procedures and prepare related documentation as described in FAM and listed in Deliverable No. 008. The Contractor shall evaluate results and conclusions reached and report results to the OIG and NGA management consistent with GAGAS, OMB, and FAM requirements.

The Contractor shall conduct an exit conference with key NGA and OIG stakeholders upon completion of the audit. The Contractor shall also conduct lessons-learned meetings with the appropriate NGA management representatives, NGA OIG, and COR to discuss the processes that were effective in the current year’s audit and those that could be improved during the subsequent year’s audit.

(Deliverables 008, 009 and 010 as described in Appendix A)

2.2 Federal Information Security Modernization Act Evaluation

The Contractor shall conduct an evaluation to assess the effectiveness and maturity of NGA’s information security program and practices in accordance with FISMA, OMB/DHS, IC OIG, and other applicable requirements. The FISMA evaluation shall be conducted in accordance with CIGIE Quality Standards for

Inspection and Evaluation (Blue Book) and with applicable annual instructions from OMB/DHS and IC

OIG.

The Contractor shall consult with the OIG in the selection of at least 7 systems to be reviewed for each annual FISMA evaluation.

2.2.1 Planning

The Contractor shall develop a plan to address the FISMA evaluation and reporting objectives and guidance provided by OMB/DHS and IC OIG. The Contractor shall design procedures to evaluate the

Agency’s maturity in addressing the IG FISMA metrics within the IG FISMA metric domains and

Cybersecurity Framework Functions. The Contractor shall conduct an entrance conference with key NGA and OIG stakeholders before performing any significant planning activities that involve NGA management.

(Deliverables 011 and 012 as described in Appendix A)

2.2.2 Evaluation

The Contractor shall perform evaluation procedures as described in the OIG-accepted evaluation program guide developed under Section 2.2.1 above. The Contractor shall document results of testing and conclusions reached in accordance with the CIGIE Blue Book. The Contractor shall develop findings that describe the condition, cause, criteria, effect and recommendation based on testing performed.

(Deliverable 013 as described in Appendix A)

2.2.3 Reporting

The Contractor shall develop an external FISMA evaluation report that complies with applicable

OMB/DHS and IC OIG guidance to be submitted to the IC OIG or OMB. The Contractor shall also develop an internal FISMA evaluation report to be issued to NGA management that includes, at a minimum, the elements of the external report, and the detailed findings and recommendations (as described in Section 2.2.2 above). The OIG and Contractor shall coordinate on the final form of the

FISMA reports. The Contractor shall conduct an exit conference with key NGA and OIG stakeholders upon completion of the evaluation. The Contractor shall also conduct lessons-learned meetings with the appropriate NGA management representatives, NGA OIG, and COR to discuss the processes that were effective in the current year’s evaluation and those that could be improved during the subsequent year’s evaluation.

(Deliverables 014 and 015 as described in Appendix A)

2.3 Program Management

2.3.1 Quality Control

The Contractor shall maintain a system of quality control that is designed to provide reasonable assurance that the FSA and FISMA evaluation are conducted in accordance with applicable professional standards as well as legal and regulatory requirements. The system of quality control shall encompass firm and individual independence, internal quality control over documentation and document retention, and monitoring of compliance with continuing professional education (CPE) and applicable licensure requirements. The Contractor Firm shall submit a memorandum of independence and quality control as well as the most recent peer review report and Public Company Accounting Oversight Board (PCAOB) inspection report, as applicable.

(Deliverable 001 as described in Appendix A)

2.3.2 Contractor Personnel

The Contractor shall ensure that the contract is staffed to meet the contract requirements. The Contractor shall provide a staffing plan at the onset of each period of performance and provide updates, as necessary, throughout the period. When assigning new individuals to the contract, the Contractor shall provide the individual’s resume as well as the task(s) (FSA, FISMA, or both) the individual will work on, estimated level of effort, and proposed labor category for COR approval. See labor category descriptions at SOW

Appendix B. All Contractor personnel shall comply with the requirements described in sections 2.3.2.1 through 2.3.2.5 below, unless otherwise instructed by the COR.

(Deliverable 002 as described in Appendix A)

2.3.2.1 Security Information

All Contractor personnel shall comply with the security requirements detailed in Appendix C.

2.3.2.2 Mandatory Training

All Contractor personnel shall complete the mandatory NGA training courses in accordance with NGA policies (typically 13 courses per person per year). The COR will communicate all required courses and related NGA policies to the Contractor upon award of the contract. Contractor personnel shall be responsible for maintaining current training records.

2.3.2.3 Independence

All Contractor personnel performing on the contract shall comply with GAGAS independence requirements. The contractor personnel shall submit a signed “Statement of Independence” form as included in the contract attachments. This statement is required for each period of performance.

(Deliverable 003 as described in Appendix A)

2.3.2.4 Professional Competence

All Contractor personnel shall comply with professional competence requirements as defined by GAGAS, including CPE requirements. Contractor personnel who are subject to GAGAS CPE requirements shall submit a signed “Statement of CPE Compliance” form as included in the contract attachments. This statement is required for each period of performance.

(Deliverable 003 as described in Appendix A)

2.3.2.5 Confidentiality and Non-Disclosure

All Contractor personnel shall sign and adhere to the NGA and NGA OIG non-disclosure agreements to protect highly sensitive and proprietary government information. The contractor personnel shall submit the signed NGA and NGA OIG Non-Disclosure Agreements as included in the contract attachments.

These agreements are required only once per overall contract period.

(Deliverable 004 as described in Appendix A)

2.3.2.6 Key Personnel

At a minimum, the Contractor must identify a key person for each of the following labor categories for the FSA task: Partner/Principal, IT Partner/Principal, Audit Senior Manager OR Audit Manager, IT

Senior Manager OR IT Manager, Supervisory Senior Auditor OR Senior Auditor, and IT Supervisory

Senior Auditor OR IT Senior Auditor. The Contractor must also identify a key person for each of the following labor categories for the FISMA task: IT Partner/Principal, IT Senior Manager OR IT Manager, and IT Supervisory Senior Auditor OR IT Senior Auditor. See labor category descriptions at SOW

Appendix B.

During the first 180 calendar days of performance, the Contractor shall make no substitutions of key personnel unless necessitated by illness, death, or termination of employment. The Contractor shall notify the COR within 5 calendar days after the occurrence of any of these events. After the initial 180 calendar days, the Contractor shall submit a written request to the COR at least 30 calendar days prior to substitution of key personnel.

2.3.3 Monthly Progress Reports

The Contractor shall submit monthly reports on the progress of the FSA and FISMA evaluation. The

Contractor shall include, at a minimum, the elements described in Deliverable No. 005.

(Deliverable 005 as described in Appendix A)

2.3.4 Technical Status and Other Meetings

The Contractor shall conduct regular meetings with stakeholders (OIG and NGA management, including the Audit Committee and Agency Leadership) to discuss the status and other significant matters relating to the FSA and FISMA evaluation, as applicable. The CO, COR, and/or Contractor may convene separate meetings to discuss any other issues or questions as they arise.

Technical status meetings shall provide NGA management and OIG with sufficient insight into the

Contractor’s progress on the FSA or FISMA evaluation to enable NGA management to fully understand emerging issues, the Contractor’s planned work, and management’s ongoing responsibilities. FSA status meetings should include discussion of IT issues related to the audit, unless the issues are deemed highly technical in nature and require a separate IT status meeting. Technical status meetings shall only include topics pertinent to NGA management and should address the following, at a minimum:

• Significant accomplishments/results of work performed since the last status meeting

• Outstanding documentation requests and potential delays

• Findings identified to date

• Proposed audit adjustments (FSA only)

• Significant issues/concerns

• Planned work to be performed/completed by the next status meeting

When an agenda or briefing charts are to be used for a meeting, the Contractor and COR shall discuss in advance and agree upon the form and content that is most appropriate for the intended audience. The

Contractor shall submit the meeting materials to the COR for review no later than 72 hours prior to distributing to management, except for regular status meeting materials. The Contractor shall submit regular status meeting materials to the COR for review no later than 24 hours prior to distributing to management. The timing of distributing materials to management may vary depending on the meeting and shall be agreed upon between the Contractor and the COR. Some meetings may require earlier coordination.

3. AUDIT AND EVALUATION DOCUMENTATION

3.1 General Requirements for Financial Statement Audit Documentation

The Contractor shall prepare audit documentation in accordance with GAGAS. The documentation should be developed in sufficient detail to provide a clear understanding of the work performed, audit evidence obtained, and its source, and to support conclusions reached in accordance with the documentation requirements included in the FAM and GAGAS. The Contractor shall plan and organize audit documentation and clearly link it to the audit objectives, audit plan, findings, and reports (as applicable). All documentation shall contain the proper security classification markings and follow the

CoNGA at all times.

3.2 General Requirements for FISMA Evaluation Documentation

The Contractor shall prepare evaluation documentation in accordance with CIGIE’s Blue Book. The documentation should be developed in sufficient detail to provide a clear understanding of the work performed, evidence obtained, and its source, and to support conclusions reached. The Contractor shall plan and organize documentation and clearly link it to the evaluation objectives, evaluation plan, findings, and reports, as applicable. All documentation shall contain the proper security classification markings and follow the CoNGA at all times.

3.3 Access to and Retention of Documentation

The Contractor shall protect all documentation from unauthorized access and apply the appropriate physical safeguarding measures at all times. Only Contractor staff with a justified need and the appropriate security clearances shall have access to documentation.

The OIG shall have ongoing access to Contractor personnel and documentation during regular business hours. Upon completion of the audit/evaluation, all documentation determined to be relevant to the conclusions of the audit/evaluation shall become the property of the OIG and shall not be disclosed outside of the OIG unless directed by statutory or other regulatory requirements, including the

Contractor’s internal quality control/inspection process or peer review process. In such cases, only personnel who have the appropriate security clearances and a justified need shall be considered for the granting of access to the workpapers. Any disclosure shall be in accordance with the DD 254, Contract

Security Classification Specification, upon approval of the CO. The retention period for workpapers supporting the audit and evaluation reports shall be for a period of at least eight years from the date of the audit and evaluation reports. Workpapers shall be maintained at NGA facilities in accordance with NGAI

8040.2, Records Management Program.

4. PERIOD OF PERFORMANCE AND PLACE OF PERFORMANCE

4.1 Period of Performance

The periods of performance for each CLIN will be provided at a later date.

4.2 Place of Performance

4.2.1 Location

The primary location for both FSA and FISMA evaluation work will be NGA headquarters in Springfield, VA. Work may also occur in St. Louis, MO, Arnold, MO, and other NGA-occupied sites as necessary and approved by the COR.

4.2.2 Travel

The Contractor shall submit all proposed site visits to the COR for review and approval prior to initiating travel. The Contractor should expect to incur local travel around the Washington, D.C. Metro region. The

Contractor should also expect to travel to other sites, including St. Louis, MO and other locations, as necessary, to complete audit and FISMA evaluation procedures. Travel costs will be reimbursed in accordance with FAR 31.205-46.

All planned and completed travel shall be included in the Monthly Progress Report.

4.2.3 Government Furnished Property

The government will provide workspace in the NGA facilities. Workspace will be furnished with virtual workstations which include access to NGA information systems, applications, and software necessary to perform the work. The Contractor will have the following software applications available: 1) Microsoft

Office tools; 2) Adobe Reader and Acrobat Pro; and 3) Caseware IDEA. The Contractor must only use

NGA-approved hardware and software within NGA facilities. Internet access will be available to

Contractor personnel who complete the required security trainings. In addition, the government will provide access to telecommunications (classified and unclassified), photocopy equipment, office furniture, and routine office supplies. Access to general office equipment, conference rooms, or offices of adequate size will be provided, as needed.

The Contractor shall adhere to all applicable NGA policies regarding the usage of internet, NGA networks, and NGA computer systems.

5. INSPECTOR GENERAL OVERSIGHT AND ASSISTANCE

The NGA OIG has the overall responsibility to ensure that contract technical requirements are satisfied, and reports are completed in a timely manner and comply with applicable requirements. The NGA OIG

Oversight Team, which includes the COR, will follow FAM 6701 guidance, as applicable, and will:

a. Provide technical advice and coordination between NGA officials and Contractor personnel, as necessary;

b. Obtain audit/evaluation documentation, monitor project status, and review and accept deliverables described in SOW Appendix A; and

c. Assist the Contractor in performing procedures in the event that the Contractor is not permitted access to the information. If such assistance is necessary, the NGA OIG Oversight Team will coordinate with the Contractor regarding the specific procedures to be performed. The OIG will prepare a report documenting the results or conclusions that may be incorporated into the

Contractor’s documentation or may be referenced by the Contractor.

d. Transmit the final audit and evaluation reports to management.

During the course of the audit/evaluation, the Contractor shall notify the COR in advance of meetings held with NGA management to discuss significant issues and the COR may attend as needed. The

Contractor shall not discuss opinions or audit/evaluation conclusions with NGA personnel without prior approval from the COR.

1 FAM 670, IG Oversight of Financial Statement Audits Performed by Independent Public Accounting (IPA) Firms, is designed for IG oversight of FSA work; however, NGA OIG will follow the same guidance, to the extent possible, for oversight of the

FISMA evaluation work.

APPENDIX A – Deliverables

No. Title

SOW

Ref.

Description

Due No

Later Than2

General Contract Deliverables

001 Firm

Memorandum for Independence and Quality

Control, Peer

Review Report and PCAOB

Inspection

Report (as applicable)

2.3.1 The Contractor Firm shall submit a memorandum that includes the following:

• A statement that the firm is independent with respect to this reporting entity

• Any existing, ongoing or planned non-audit services with respect to this reporting entity

• Any lawsuits with this reporting entity

• Any relationship with this reporting entity that could impair independence

• Explanation of the firm’s current internal quality control system, including such items as audit documentation review procedures, staff independence requirements, and continuing professional education requirements

The Contractor shall also submit the following:

• A copy of the firm’s most recent internal inspection report or equivalent, external Peer Review, Letter of Comments, and management’s response

• Results or a copy of the firm’s most recent Inspection Report prepared by the PCAOB and the firm’s response (as applicable)

10 Jan

002 Staffing Plan 2.3.2 The Contractor shall provide an initial staffing plan that includes the following information for each individual assigned to the contract:

• Task(s) the individual will work on (FSA, FISMA, or both)

• Estimated level of effort (hours) for the period

• Labor category

• Estimated timing, if not assigned for the full project period

Within ten (10) calendar days after the start of the period of performance

003 Individual

Statements of

Independence and CPE

Compliance

2.3.2.3

2.3.2.4

All Contractor personnel shall submit signed Statements of

Independence and CPE compliance as included in the contract attachments.

Note: If an individual works on both FSA and FISMA, only one

Statement of Independence and one Statement of CPE

Compliance is required.

Within ten (10) calendar days after the start of the period of performance3 or within ten (10) calendar days of an individual’s first day on the contract

2 When the due date falls on a Federal holiday or weekend, the Deliverable will be due the following business day. If the start of a period of performance is delayed, the deliverable due dates will be modified as necessary.

3 Applies to all contractors who are assigned and approved to work at the onset of each period of performance.

No. Title

SOW

Ref.

Description

Due No

Later Than2

004 Non-Disclosure

Agreements

2.3.2.5 All Contractor personnel shall submit signed NGA and NGA

OIG Non-Disclosure Agreements as included in the contract attachments.

Within ten (10) calendar days of an individual’s first day on the contract4

005 Monthly

Progress Reports

2.3.3 The monthly progress report shall include sections for both FSA and FISMA which shall contain the following elements at a minimum:

• Progress to date compared with the overall audit/evaluation plan and timeline

• Matters that could impact deliverable due dates

• Significant accounting, auditing, and evaluation issues

• Potential scope limitations

• Staffing Plan to include labor hours incurred against each project by individual (by month and cumulative), labor category, and audit/evaluation phases

• Travel Report to include trips taken and planned

Within five (5) business days of the previous month-end

Financial Statement Audit Deliverables

006 Audit Strategy

Documents

2.1.1 Audit Strategy Documents shall include the following elements, at a minimum:

• A schedule of budgeted hours for each phase of the audit

(planning, testing, reporting)

• Audit strategy, including materiality determinations, overall risk assessments, and preliminary analytical procedures addressing the elements described in FAM

• Cycle matrix linking business processes/cycles to material line items, accounts, note disclosures, and classes of transactions

If the Contractor applies its own methodology, the Audit Strategy

Documents shall include a completed FAM 1003 checklist that demonstrates how the Contractor’s planned audit approach addresses the elements of FAM. An alternative crosswalk may be provided if agreed upon with the COR.

30 Mar

007 Audit Plans 2.1.2 Audit Plans (for material line items, accounts, note disclosures, and classes of transactions) shall include the following:

• Cycle memorandums for each cycle identified in the cycle matrix that demonstrate an understanding of the associated business processes and components of internal control including relevant information systems

• A line item risk analysis identifying the auditor’s identification and assessment of risks of material misstatement at the assertion level

15 May

4 These agreements are required only once per overall contract period.

No. Title

SOW

Ref.

Description

Due No

Later Than2

• A description of the nature, timing and extent of planned risk assessment and audit procedures including the following, as applicable:

• A section on tests of significant internal controls (including entity-level and information systems controls)

• A section on substantive testing procedures to be applied to the individual account balances

• A section on tests of compliance with applicable laws, regulations, contracts, and grant agreements and a list of those to be tested

• A section on the procedures to be performed on RSI and

OI

008 Audit Testing and Completion

Documentation

2.1.2 Audit Testing Documentation shall include, at a minimum:

• All workpapers that document the control, substantive, and compliance testing performed (consistent with planned procedures described in Deliverable No. 007 or reasons such planned procedures were not performed) and results of such procedures, including associated sampling plans and evaluation of sample results

• Overall conclusions reached, including the auditor’s response to significant risks

• As necessary and based on testing performed, documentation of findings which include the elements of a finding as described in GAGAS and FAM. Findings shall be submitted, with supporting workpapers, for COR review prior to release to management.

Audit Completion Documentation shall include, at a minimum:

• Summary of uncorrected misstatements

• Audit exposure evaluation

• Overall analytical procedures

• Audit summary memorandum

• Management representation letter

• Legal counsel response

• FAM 1003 audit completion checklist

Note: The Contractor shall refer to the latest version of FAM

670A for minimum expected audit documentation.

TBD5

009 Audit Reports

(Draft and Final)

2.1.3 Audit Reports shall include the auditor’s conclusions on the following:

• Financial statements

• Internal control

DRAFT (to

OIG):

15 calendar days before

5 At the beginning of each contract period, the Contractor and the COR will agree upon a reasonable schedule for delivery of audit documentation throughout the audit, with all final audit documentation due no later than the date of issuance of the final audit report.

No. Title

SOW

Ref.

Description

Due No

Later Than2

• Whether the agency was substantially compliant with the requirements of the Federal Financial Management

Improvement Act of 1996 (FFMIA)

• Compliance with applicable laws, regulations, contracts and grant agreements

• RSI

• Other information

These reports may be combined into a single report or drafted as separate reports but must include the elements and report language described in the FAM and consistent with OMB

Bulletin 24-02, or successor bulletins.

As applicable, the draft reports shall be cross-referenced to supporting findings and audit documentation.

planned Final report date

DRAFT (to management):

7 calendar days before planned

Final report date

FINAL:

15 Nov

010 Management

Letter (Draft and

Final)

2.1.3 As applicable, the Management Letter shall include any internal control deficiencies that were not required to be included in

Deliverable No. 009 and other operational matters of sufficient importance to merit management’s attention.

The draft letter shall be cross-referenced to supporting findings and audit documentation.

DRAFT:

15 calendar days before

15 Dec

FISMA Evaluation Deliverables

011 FISMA Planning

Documents

2.2

2.2.1

FISMA Planning Documents shall include the following, at a minimum:

• A planned milestone schedule including budgeted hours for each phase of the evaluation (planning, evaluation, reporting)

• List of systems selected including a description of the selection process and factors considered

XXX

012 FISMA

Evaluation

Program Guide

2.2.1

The FISMA Evaluation Program Guide shall include the following, at a minimum:

• A description of the nature, timing, and extent of planned procedures for assessing the maturity level for each IG

FISMA metric

• Planned procedures for assessing the status of prior year findings and recommendations

28 Feb

013 FISMA

Evaluation

Documentation

2.2.2 FISMA Evaluation Documentation shall include, at a minimum:

• All workpapers that document procedures performed

(consistent with planned procedures described in Deliverable

No. 012 or reasons such procedures were not performed);

TBD6

6 At the beginning of each contract period, the Contractor and the COR will agree upon a reasonable schedule for delivery of

FISMA documentation throughout the evaluation, with all final documentation due no later than the date of submission of the draft external report.

No. Title

SOW

Ref.

Description

Due No

Later Than2 results of such procedures; relevant criteria; and overall conclusions reached

• As necessary and based on testing performed, documentation of findings which include the following elements: condition, cause, criteria, effect and recommendation. Findings shall be submitted, with supporting workpapers, for COR review prior to release to management.

014 External FISMA

Evaluation

Report (Draft and Final)

2.2.3 The external FISMA Evaluation Report shall comply with

applicable reporting requirements issued by OMB/DHS and IC

OIG.

The draft external FISMA Evaluation Report shall be cross-referenced to supporting evaluation documentation.

DRAFT (to

OIG):

30 calendar days before

FINAL (to

OIG):

3 business days before the required date of submission to the IC OIG

015 Internal FISMA

Evaluation

Report (Draft and Final)

2.2.3 The internal FISMA Evaluation Report shall include, at a minimum:

• Determination of the overall effectiveness of NGA’s information security program and practices

• Assessed maturity levels for the IG FISMA reporting metrics

• Detailed findings and recommendations, as applicable, including management responses

• Status of prior year recommendations

• Elements and report language described in the CIGIE Blue

Book

The Contractor and the OIG shall agree upon the final form of the internal evaluation report.

The draft internal FISMA Evaluation report shall be cross-referenced to supporting documentation.

DRAFT (to

OIG):

30 calendar days before

DRAFT (to management):

15 calendar days before

60 calendar days after

External Report

(Deliverable

014) Final due

APPENDIX B – Labor Categories

Partner/Principal

The minimum experience requirements in this category include: a) being a Partner or Principal or equivalent in the Contractor’s organization, b) having a minimum of 10 years of audit experience, of which at least five (5) years relate to Federal government financial statement audits, c) having a bachelor’s degree, and d) being an active Certified Public Accountant (CPA) in good standing with the

AICPA and State Boards.

IT Partner/Principal

The minimum experience requirements in this category include: a) being a Partner or Principal or equivalent in the Contractor’s organization, b) having a minimum of 10 years of IT audit experience7, of which at least five (5) relate to the Federal IT environment, c) having a bachelor’s degree, and d) being a

Certified Information Systems Auditor (CISA) or Certified Information Systems Security Professional

(CISSP).

Audit Senior Manager

The minimum experience requirements in this category include: a) being an Audit Senior Manager or equivalent in the Contractor’s organization, b) having a minimum of eight (8) years of audit experience, of which at least four (4) relate to Federal government financial statement audits, c) having a bachelor’s degree, and d) being an active CPA in good standing with the AICPA and State Boards.

IT Senior Manager

The minimum experience requirements in this category include: a) being an IT Senior Manager or equivalent in the Contractor’s organization, b) having a minimum of eight (8) years of IT audit experience, of which at least four (4) relate to the Federal IT environment, c) having a bachelor’s degree, and d) being a CISA or CISSP.

Audit Manager

The minimum experience requirements in this category include: a) being an Audit Manager or equivalent in the Contractor’s organization, b) having a minimum of six (6) years of audit experience, of which at least three (3) relate to Federal government financial statement audits, c) having a bachelor’s degree, and

d) being an active CPA in good standing with the AICPA and State Boards.

IT Manager

The minimum experience requirements in this category include: a) being an IT Manager or equivalent in the Contractor’s organization, b) having a minimum of six (6) years of IT audit experience, of which at least three (3) relate to the Federal IT environment, c) having a bachelor’s degree, and d) being a CISA or

CISSP.

7 ‘IT audit experience’ used here and in other labor categories in Appendix B refers to experience performing IT audit procedures as part of a financial statement audit or performing FISMA audit or evaluation work.

Supervisory Senior Auditor

The minimum experience requirements in this category include: a) being a Senior Auditor or equivalent in the Contractor’s organization, b) having a minimum of four (4) years of audit experience, of which at least two (2) years relate to Federal government financial statement audits, and c) having a bachelor’s degree that includes 24 semester hours in accounting.

IT Supervisory Senior Auditor

The minimum experience requirements in this category include: a) being an IT Senior Auditor or equivalent in the Contractor’s organization, b) having a minimum of four (4) years of IT audit experience, of which at least two (2) relate to the Federal IT environment, and c) having a bachelor’s degree.

Senior Auditor

The minimum experience requirements in this category include: a) being a Senior Auditor or equivalent in the Contractor’s organization, b) having a minimum of three (3) years of audit experience, and c) having a bachelor’s degree that includes 24 semester hours in accounting.

IT Senior Auditor

The minimum experience requirements in this category include: a) being an IT Senior Auditor or equivalent in the Contractor’s organization, b) having a minimum of three (3) years of IT audit experience, and c) having a bachelor’s degree.

Experienced Staff Auditor

The minimum experience requirements in this category include: a) being a Staff Auditor or equivalent in the Contractor’s organization, b) having a minimum of one (1) year of audit experience, and c) having a bachelor’s degree that includes 24 semester hours in accounting.

IT Experienced Staff Auditor

The minimum experience requirements in this category include: a) being an IT Staff Auditor in the

Contractor’s organization, b) having a bachelor’s degree, and c) having a minimum of one (1) year of IT audit experience.

Staff Auditor

The minimum requirements in this category include a) being a Staff Auditor or equivalent in the

Contractor’s organization and b) having a bachelor’s degree.

Assistant/Intern

The minimum requirements in this category include a) being an assistant, intern or equivalent in the

Contractor's organization and b) having completed two years of college working toward a business, accounting, or other appropriate bachelor’s degree.

Project Manager

The minimum experience requirements in this category include: a) having a minimum of three (3) years of project management experience and b) having a bachelor’s degree.

Senior Specialist

The minimum experience requirements for this category include: a) having experience of at least eight (8) years in the related field, b) having a bachelor’s degree in a related field, and c) having a recognized standing in a related field, as evidenced by, for example, certification or membership in a professional organization.

Junior Specialist

The minimum experience requirements for this category include: a) having experience of at least four (4) years in the related field, b) having a bachelor’s degree in a related field, and c) having a recognized standing in a related field, as evidenced by, for example, certification or membership in a professional organization.

Senior Statistician

The minimum experience requirements for this category include: a) having at least eight (8) years of statistical calculations and analysis and b) having a bachelor’s degree in a related field.

Junior Statistician

The minimum experience requirements for this category include: a) having at least four (4) years of statistical calculations and analysis and b) having a bachelor’s degree in a related field.

APPENDIX C – Security

C.1 Classified Work Performance Security Requirements

Contractors must abide by the DD Form 254 – Contract Security Classification Specification (referred to as DD254 hereafter), the National Industrial Security Program Operating Manual (NISPOM 32 CFR Part

117), and all other applicable security policies and regulations including operational security (OPSEC) requirements.

Defense Counterintelligence and Security Agency (DCSA) remains the Cognizant Security Agency

(CSA) for individuals performing work with collateral (SECRET or TOP SECRET) security clearances.

As such, Security Executive Agent Directive (SEAD) 3 reporting should continue to be provided to the

Contractor’s Facility Security Officer (FSO) for reporting to DCSA via Defense Information Security

System (DISS). DCSA will also dictate mandatory security training as the CSA for the collateral cleared community.

C.2 Personnel Security Requirements

Contractor personnel performing Top Secret/Sensitive Compartmented Information (TS/SCI) work on the contract are required to have active TS/SCI clearances for access to TS/SCI facilities, when performing duties within TS/SCI environments, and for access to TS/SCI computer systems for the…