Request for Information - Construction Software.pdf

FDIC

Federal Deposit Insurance Corporation Division of Information Technology

Request for Information – Construction Software

THIS IS A REQUEST FOR INFORMATION (RFI) ONLY. This RFI is issued solely for information and planning purposes – it does not constitute a Request for Proposal (RFP) or a promise to issue a RFP in the future. This request for information does not commit the Government to contract for any supply or service whatsoever. Further, the FDIC is not seeking proposals at this time and will not accept unsolicited proposals. Responders are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this RFI; all costs associated with responding to this RFI will be solely at the interested party’s expense. Not responding to this RFI does not preclude participation in any future RFP, if any is issued.

1.0 Purpose

The Federal Deposit Insurance Corporation (FDIC) requests information related to establishing a new single award contract to procure construction software that empowers architectural engineering staff to collaborate in real time and manage projects from design to completion on any device - anywhere. The solution would need to be able to transfer large files such as REVIT, work as a collaboration tool for all phases of design and construction. The solution will also effortlessly manage punch lists, RFIs and submittals. The collaboration will include drawing reviews, tracking changes, comparing revisions, maintaining versions control, and adding notations directly to PDFs without needing to reprint or rescan documents for multiple users to keep everyone on the same page. The purpose of this Request for Information (RFI) is to identify potential sources and engage the vendor community for market research and recommendations related to FDIC’s requirements and any innovative approach to better meet the goals and objectives of this requirement. 1The solution should preferably be a part of The Federal Risk and Authorization Management Program (FedRAMP).

2.0 RFI Response Requirements

Vendors are asked to respond to the following inquiries and address the goals and objectives identified in the purpose above.

Please note this is not a Request for Proposal (RFP) and any response provided will not be considered an offer; therefore, pricing information not specifically requested should not accompany this RFI. Information obtained through this RFI may be used in the development of the Request for Proposal. The FDIC reserves the right to issue an RFP to those firms that, in its sole discretion, appear to have the technical capabilities required. This request does not obligate

1 If an IT solution is not FedRAMP certified, FDIC requires companies to establish an Authority to Operate (ATO) in accordance with the requirements discussed in Appendix B.

the FDIC to issue a solicitation or RFP to contract for services or to guarantee inclusion of a firm on any potential solicitation list.

The FDIC is not liable for any costs that might be incurred or associated with the preparation of information provided. All questionnaires in response to the FDIC’s market research will be protected and properly disposed of after a potential solicitation list is established.

It is highly encouraged that concise responses are provided and contain no extraneous information (e.g., marketing material) are provided. Proprietary information, if any, should be minimized and must be clearly marked.

RFI responses are limited to 5 pages measuring 8.5 by 11 inches with normal margins and a typeface no smaller than 12 point. Submit your response as a PDF file not exceeding 10MB in file size. The e-mail shall be titled “(insert Company Name) – FDIC Construction Software RFI Response.”

All responses shall be submitted to *insert contracting officer on XX date*. While the Government reserves the right to contact any vendor for further clarification of their submission no formal responses to any questions will be issued as a result of this RFI.

3.0 RFI Response Items

3.1 Company Overview

• Provide company name, local contact mailing address, phone number, fax number, e-mail address of designated point of contact, and DUNS number.

• Provide address of your headquarters.

• Provide a brief description of your company, services, business size (revenue, employees, customers), and point(s) of contact, including name, address, phone(s) and e-mail address along with a list of manufacturer/reseller partnerships that your company currently maintains and the type of partnership (e.g., service/solution provider, value-added reseller, etc.).

3.2 RFI Requirements

(1) Does your company have the ability to deliver all of the requirements identified in the Purpose? Specify where company capabilities fall short or capabilities that exceed the required objectives.

(2) Are there industry best practices that would be applicable to this requirement that have not been incorporated in the purpose? If so, please identify and elaborate on why they should be considered.

(3) What additional information, if any, would you need on the current environment/inventory to properly respond to an RFP?

(4) Specifically provide the billing model, e.g. fixed (flat) rates, subscriptions, labor hours base on labor categories, your company generally uses for providing the types of services described in this RFI.

(5) Does your company have capability of dealing with multiple locations across multiple geographic areas?

(6) Does your company have experience successfully implementing your solution with emphasis in federal state or local government.

(7) Specify if solution is part of FedRAMP or include anticipated date

(8) Does your company have API capabilities as well as experience interfacing with IBM’s

TRIRIGA or Maximo products.

Attachment A

Assessment and Authorization Requirements – Moderate Baseline Authorization to Operate The Contractor shall not create, collect, use, process, store, maintain, disseminate, disclose, and dispose of FDIC data within an Information Technology (IT) system without an Authorization to Operate (ATO) signed by the FDIC Authorizing Official (AO) granted via the Assessment & Authorization (A&A) process. The FDIC process for obtaining and maintaining ATO is in accordance with NIST SP 800-37 Risk Management Framework for Information Systems and Organizations. The Contractor shall implement security and privacy controls at the moderate baseline and adhere to current FDIC policies, procedures, and guidance for the A&A process as defined below.

Complete the FDIC Assessment & Authorization Process.

a. A&A Documentation. The Contractor, in accordance with applicable National Institute of Standards and Technology (NIST) Special Publication (SP)s , shall develop the A&A documentation. The A&A documentation consists of the following: System Security Plan, Contingency Plan, Contingency Plan Test Results, Incident Response Plan, Incident Response Plan Test Results, Configuration Management Plan (if applicable), and Security Assessment Report. Additional documents that may be required include Plan of Action and Milestones (POA&M) and/or Interconnection Security Agreement (ISA). The extent of the documentation required may depend on the Contractor’s ability to leverage a Federal Government ATO or FedRAMP package to comply with FDIC requirements.

b. Independent Assessment. Contractor shall have an independent assessor perform an assessment of security and privacy controls at the moderate baseline as outlined in NIST SP 800-53A Assessing Security and Privacy Controls in Information Systems and Organizations to determine the extent to which the selected controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting security and privacy requirements for the system and the FDIC. An independent assessor is defined by NIST SP 800-37 Risk Management Framework for Information Systems and Organizations. The independent assessor requirement may be satisfied by: (1) an internal audit or assessment group that possesses the required skills and technical expertise to develop effective assessment plans and to conduct assessments, as appropriate. This group is separate and independent from the part of the organization that has responsibility for developing or maintaining the system; or (2) acquiring the services of an external (outside) third-party independent assessor. Should the independent assessment find deficiencies, the Contractor must create Plan of Action & Milestones (POA&M) to track and manage associated remediation activities to closure. In the case of unacceptable assessment results or if the Contractor does not remediate control deficiencies in a timely manner as established in the POA&Ms, FDIC may treat the failure as an event of default.

c. Privacy Compliance Documentation. As part of the A&A process, the Contractor may be required to support the FDIC in the completion of a Privacy Threshold Analysis (PTA). The creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal of Personally Identifiable Information (PII) by an IT system triggers the requirement to complete a PTA. Upon review of the PTA, the FDIC Privacy Program determines whether a Privacy Impact Assessment (PIA) and/or Privacy Act System of Records Notice (SORN), or modifications thereto, are required. The Contractor shall provide all support necessary to assist the FDIC in completing the PIA in a timely manner and shall ensure that project management plans and schedules include time for the completion of the PTA, PIA, and SORN (to the extent required) as milestones. Support in this context includes responding timely to requests for information from the FDIC about the creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal of PII on the Contractor’s system, and providing timely review of relevant compliance documents for factual accuracy. Information on the FDIC’s privacy compliance process, including PTAs, PIAs, and SORNs, is accessible at www.fdic.gov/privacy.

d. Continuous Monitoring/Ongoing Annual Assessment. The Contractor shall develop an Information Security and Privacy Continuous Monitoring Plan to have the security and privacy controls assessed on an ongoing annual basis in accordance with OMB Circular A-130, NIST SP 800-37 and NIST SP 800-137. Ongoing annual assessment and evidence of the control effectiveness is part of the continuous monitoring activities of the FDIC. Adherence to the terms and conditions specified by the AO as part of the authorization decision are also monitored. Ongoing annual control assessment continues as the information generated as part of continuous monitoring is correlated, analyzed, and reported to the FDIC via the Oversight Manager. Should the independent assessment find deficiencies, the Contractor must create or update Plan of Action & Milestones (POA&M) to track and manage associated remediation activities to closure. In the case of unacceptable assessment results or if the Contractor does not remediate control deficiencies in a timely manner as established in the POA&Ms, FDIC may treat the failure as an event of default. As part of Continuous Monitoring, the Contractor shall conduct Contingency Plan and Incident Response Testing on an annual basis and provide those test results to the FDIC. In addition, the Contractor shall keep the system security package updated and provide the latest system security package to the FDIC on annual basis.

e. Authorization to Operate (ATO). Upon completion of the A&A documentation and independent assessment, the Contractor shall submit a complete A&A package with a validation by the independent assessor to the Oversight Manager for acceptance by the FDIC Authorizing Official (AO), or designee, at least thirty (30) days prior to the use of the system. The FDIC is the final authority on the compliance of the A&A package and may limit the number of resubmissions of a modified A&A package. The FDIC’s issuance of the ATO does not alleviate the Contractor’s responsibility to ensure the controls are implemented and operating effectively. The A&A package must include the following:

Deliverables (30 Days Prior to System Use) Security and Privacy System Security Plan Security and Privacy Assessment reports

Plan of Action and Milestones http://www.fdic.gov/privacy