RFI - Tech Commiittee - Industry Day -13 April - Final.pdf

Request for Information: CIG21R0001

CIGIE Technology Committee Industry Day Series Information Technology Audit/Federal Audit Executive Council (FAEC)

Council of the Inspectors General on Integrity and Efficiency (CIGIE) CIGIE Technology Committee

AGENCY CONTRACTING OFFICER: RFI RELEASED: 24 FEBRUARY 2021

REBECCA MILLS RFI CLOSED: 21 MARCH 2021

REBECCA.MILLS@CIGIE.GOV VIRTUAL INDUSTRY DAY: 13 APRIL 2021

Council of the Inspectors General on Integrity and Efficiency Page 2 of 9

REQUEST FOR INFORMATION

CIGIE Technology Committee Industry Day Series – IT Audit/FAEC

1.0 Introduction

1.1 Background. The Council of the Inspectors General on Integrity and Efficiency (CIGIE) is an independent entity established within the executive branch to address integrity, economy and effectiveness issues that transcend individual Government agencies and aid in the establishment of a professional, well-trained, and highly skilled workforce in the Offices of Inspectors General (OIGs). The CIGIE Technology Committee is a standing committee supporting the overall CIGIE mission, with their own mission to facilitate effective information technology (IT) audits, evaluations, inspections, and investigations by Inspectors General (IGs), and to provide a vehicle for the expression of the OIG community's perspective on Governmentwide IT operations. The CIGIE Technology Committee is releasing a Request for Information (RFI) to elicit responses from vendors and other interested parties on specific information technology tools, software, and services they can provide to OIGs. Specifically, the purpose of this RFI is to assist the CIGIE Technology Committee in obtaining information on cyber security and Federal Information Security Modernization Act of 2014 (FISMA) audit, evaluation, and inspection tools, software, and services, which could assist OIG staff to more effectively perform their oversight missions.

1.2 Purpose. The CIGIE Technology Committee plans to conduct a series of industry days on various topics throughout the year. The information we receive from this specific RFI will be used to select vendors to participate in an industry day event on specific cyber security audit, evaluation, and inspection tools, software, and services they can provide to OIGs for their oversight missions that will be held on April 13, 2021. Future technology industry days are planned for the topic areas of investigations, emerging technology, and data analytics / visualization. Please do not respond to this specific RFI with tools covering the additional listed topic areas. Respondents who provide a response not related to the current topic will not be considered for the industry day and will be disposed of. Continue to monitor the beta.sam.gov for additional RFI announcements.

THIS IS A REQUEST FOR INFORMATION (RFI) ONLY. This RFI is issued solely for information and planning purposes – it does not constitute a Request for Proposal (RFP) or a promise to issue an RFP in the future. This RFI does not commit the Government to contract for any supply or service whatsoever.

Further, the CIGIE Technology Committee is not at this time seeking proposals and will not accept unsolicited proposals. Respondents are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this RFI; all costs associated with responding to this RFI will be solely at the interested party’s expense. Not responding to this RFI does not preclude participation in any future RFP, if any is issued. It is the responsibility of the potential offerors to monitor beta.sams.gov for additional information pertaining to this requirement.

2.0 Overview

CIGIE is an independent federal entity established within the executive branch under the authority of the Inspector General Act of 1978, as amended. CIGIE membership includes 75 statutorily created OIGs with the mission to address the integrity, economy, and effectiveness challenges that transcend individual government agencies. The CIGIE Technology Committee, one of the seven standing committees

Council of the Inspectors General on Integrity and Efficiency Page 3 of 9 supporting the overall CIGIE mission, promotes effective teamwork in addressing Governmentwide initiatives, improving OIG IT activities, and safeguarding national IT assets and infrastructure.

Specifically, the CIGIE Technology Committee provides a forum for the OIGs to share information, including IT best practices and technology capabilities. The CIGIE Technology Committee also coordinates IT-related activities of CIGIE members, advises CIGIE and its members on IT issues, and conducts relevant IT educational and training activities.

OIG auditors regularly perform IT audits, inspections, and evaluations, such as the FISMA independent evaluation, throughout the year. Specifically, the OIGs might report on a variety of vulnerabilities, such as threats from malicious code, malware, rootkits and botnets, corrupted software files, operating system deficiencies, and many other cyber security and internal control weaknesses. Additionally, the results of these IT audits, inspections, and evaluations may help the CIGIE Technology Committee inform the OIGs about relevant crosscutting IT issues.

3.0. Overview of Technologies and Solutions Sought

This RFI is intended to inform the CIGIE Technology Committee on the status of IT audit, inspection, and evaluation cyber security tools, software, and services to assist auditors in conducting cyber security and FISMA audits and evaluations of their organizations.

Responses to this RFI will be reviewed to assist the CIGIE Technology Committee in identifying best in class solutions, which will in turn allow the OIGs to meet their statutory requirements and effectively meet their oversight missions.

At a minimum, responses to this RFI must include a description of the IT audit, inspection, and evaluation cyber security tools, software, and services available and how they can be used by auditors to accomplish their cyber security and FISMA audits and evaluations work. The tools or tools used and provided by servicers must be consistent with the National Institute of Standards and Technology (NIST) security content automation protocol.

If possible, responses to this RFI should also provide examples of how the tools, software, and services were previously used or are being utilized to support a government agency’s information technology audit, evaluation, and inspection of work.

3.1 Capabilities: Information Technology Oversight Support Tools

In this RFI, the CIGIE Technology Committee is interested in learning about cyber security audit and evaluation tools, software, and services that could support auditors in conducting information technology oversight responsibilities:

• Penetration testing – Penetration testing is security testing in which assessors mimic real-world attacks to identify methods for circumventing the security features of an application, system, or network. It often involves launching real attacks on systems and data using tools and techniques commonly used by attackers.1

1 Penetration testing - Glossary | CSRC (nist.gov) https://csrc.nist.gov/glossary/term/penetration_testing

Council of the Inspectors General on Integrity and Efficiency Page 4 of 9

• Vulnerability Scanning – Vulnerability scanning involves using automated tools to identify hosts, host attributes (e.g., operating systems, applications, open ports), and their associated vulnerabilities. Vulnerability scanning tools typically help identify outdated software versions, missing patches, and misconfigurations.2

• Asset identification – Attributes and methods (e.g., tools, software, or services) to uniquely identify an asset.3

• Social media vulnerability assessment – Tools, software, or services that may help test the vulnerability of social media (e.g., Facebook, Twitter, LinkedIn).

• Endpoint security – Tools, software, or services that help in evaluating endpoints or entry points of end-user devices such as desktops, laptops, and mobile devices from being exploited by malicious actors and campaigns.

• Governance, risk, and compliance – Tools, software, or services that help in managing an organization's overall governance, enterprise risk management, and compliance with regulations (e.g., NIST regulations and policy).

• Cloud security monitoring o Cloud access security broker – Tools, software, or services that could help OIGs evaluate an organization’s cloud-based security policy enforcement points, placed between cloud service consumers and cloud service providers to combine, and interject enterprise security policies as the cloud-based resources are accessed.

o Data migration – Tools, software, or services that could help OIGs evaluate how the organization moves data from one storage system or computing environment to another.

• Wireless assessments – Tools, software, or services that may help OIGs in testing an organization’s monitoring of specific parts of the radio frequency spectrum to identify unauthorized wireless transmissions and/or activities.4

• Cutting Edge / Industry Specific – “Cutting edge” or industry cyber security evaluation and oversight tools, software, or services for use by Auditors in OIG’s staff to perform their respective oversight missions.

4.0. Responses

The CIGIE Technology Committee will compile all the responses into a single PDF document that will become a reference directory for CIGIE and CIGIE member research. This material will be strictly for internal use by CIGIE and its member organizations only and will not be published on a public facing website. The document will be used for market research purposes.

By submitting an RFI response, you are consenting to be included in the reference directory.

All respondents who provide an RFI to the required specifications are not guaranteed a presentation slot at the referenced CIGIE Technology Committee Industry Day.

2 Vulnerability Scanning - Glossary | CSRC (nist.gov) 3 Asset Identification - Glossary | CSRC (nist.gov) 4 Wireless Intrusion Detection System (WIDS) - Glossary | CSRC (nist.gov) https://csrc.nist.gov/glossary/term/Vulnerability_Scanning https://csrc.nist.gov/glossary/term/asset_identification https://csrc.nist.gov/glossary/term/wireless_intrusion_detection_system

Council of the Inspectors General on Integrity and Efficiency Page 5 of 9

All respondents who provide an RFI to the required specifications are guaranteed to be included in the vendor reference directory that will be provided to the various CIGIE member organizations.

4.1 Submission Contents. Failure to follow the format below may remove your company for consideration of presentations and inclusion in the reference directory. The response must include the following components:

4.1.1 Top Sheet. Respondents are required to fill out the “Top Sheet” that has been included as Attachment A. This document will be attached to the front of the White Paper. The Top Sheet does not count towards the page requirement count. It will be included in the reference guide previously mentioned.

4.1.2 White Paper. The White Paper has a limitation of five (5) pages. It will be made up of two sections.

Section 1 shall provide administrative information and will not count towards the paper limitation of five

(5) pages. Information that will be included in this order are:

4.1.2.1. Name, mailing address, overnight delivery address (if different from mailing address), phone number, and e-mail of designated point of contact.

4.1.2.2. Business type. If small business, please select the title that reflects your category. If none is designated, it will be considered ‘small business – not specified’. (Responses may include: Large Business, Small Businesses [8(a), HUBZone, Woman-Owned, Service-Disabled Veteran-Owned]).

4.1.2.3. CAGE Code and DUNS Code; NAICS Codes

4.1.2.4. If applicable, the current governmentwide contracts, their sponsoring agency, and the period of performance for that contract.

4.1.2.5. List the capability titles that apply to the paper that were identified in Section 3.1. (For example – “Capabilities: Endpoint Security, Wireless assessment, Cutting Edge”)

Section 2 shall provide the technical response to the posted RFI. Responses must clearly identify the technology capability the tool supports that were identified in the Section 3.1.

Proprietary information, if any, should be minimized and MUST BE CLEARLY MARKED. To aid the Government, please segregate proprietary information.

4.2 Submitting. Interested parties are requested to respond to this RFI with their completed response to the contracting officer, Ms. Rebecca Mills, by mail to Rebecca.Mills@cigie.gov. The email MUST have the subject “CIGIE Technology Committee Industry Day Series – IT Audit/FAEC RFI”. Failure to comply with this naming convention will remove your company’s response from consideration.

White papers in Microsoft Word for Office 2013 or higher compatible format are due no later than 5:00 PM EST on 21 MARCH 2021 via email. Responses shall be limited to five (5) pages with font no smaller than 10-point. Graphics and charts are not required - if they are provided in the respondent’s submission, they will be counted towards the page limit. Please be advised that all submissions become Government property and will not be returned.

mailto:Rebecca.Mills@cigie.gov

Council of the Inspectors General on Integrity and Efficiency Page 6 of 9

4.3 Industry Day. Respondents may be contacted based on their submission to be invited to present at the Committee’s Industry Day that will be held for approximately two (2) hours on April 13, 2021. The event will be held virtually utilizing a virtual audio and video conferencing platform (e.g., Zoom for Government). All responses submitted to the RFI are not guaranteed a presentation spot. The number of presentations will be limited due to schedule limitations and will be selected by the government based on submission time and RFI response. Vendors who are selected will be notified by 31 MARCH 2021 by the Contracting Officer, Rebecca Mills.

Selected respondents will present the capabilities of their tools, software, or services and will not perform a demonstration. Presentations will be limited to PowerPoints and additional details will be made available in the future. Presentations will be finalized by 9 APRIL 2021. If a vendor does not meet the deadlines they will forfeit their place and may be removed from the event lineup.

If a member of the Industry is interested in securing an audience link to the event, please contact the CIGIE Contracting Officer, Rebecca Mills by 9 APRIL 2021.

4.3.1 Vendor Reference Directory. The CIGIE Technology Committee understands that the industry at large would like the government to review their submission. We appreciate the effort that companies are taking by responding to the RFI. There is an anticipation of a high-volume of responses. The number of presentation slots are limited due to time. To maximize the visibility of the White Paper, the Committee will create a single Reference Directory of ALL responses that meet the RFI requirements. This Directory will be a government market research reference tool that will be made available to all 75 of the OIGs.

5.0 Terms and Conditions, Disclaimers, and Important Notices

FAR 52.215-3 Request for Information or Solicitation for Planning Purposes (Oct 1997)

a) The Government does not intend to award a contract based on this solicitation or to otherwise pay for the information solicited except as an allowable cost under other contracts as provided in subsection 31.205-18, Bid and proposal costs, of the Federal Acquisition Regulation.

b) Although "proposal" and "offeror" are used in this Request for Information, your response will be treated as information only.

It shall not be used as a proposal.

c) This solicitation is issued for the purpose of gathering information on new cyber security and FISMA audit, inspection, and evaluation tools, software, and services to be used by auditors.

Council of the Inspectors General on Integrity and Efficiency Page 7 of 9

By submitting an RFI response, you are consenting to be included in the Reference Directory. This directory will be made available to all CIGIE member organizations. The directory will NOT be published on a public facing website.

All respondents who provide an RFI to the required specifications are guaranteed to be included in the vendor reference directory that will be provided to the various Office of the Inspectors General.

CIGIE Technology Committee representatives may or may not choose to meet with potential respondents. Such discussions would only be intended to get further clarification of potential capability to meet the requirements, especially any development and certification risks.

CIGIE Technology Committee representatives may or may not contact respondents for Industry Day presentation slots.

All respondents who provide an RFI to the required specifications are NOT guaranteed a presentation slot at the referenced CIGIE Technology Committee Industry Day.

Administration by Federal and Non-Federal Personnel:

Federal employees are subject to the non-disclosure requirements of a criminal statute, the Trade Secrets Act, 18 U.S.C. § 1905. The Federal Government may seek the advice of qualified non-Federal personnel.

The Federal Government also may use non-Federal personnel to conduct routine, nondiscretionary administrative activities. The respondents, by submitting their response, consent to CIGIE Technology Committee providing their response to non-Federal parties. Non-Federal parties given access to responses will be subject to an appropriate obligation of confidentiality prior to being given the access.

Proprietary, Confidential, or otherwise Sensitive Information:

Because information received in response to this RFI may be used to structure future programs and funding opportunity announcements or otherwise be made available to the public, respondents are strongly advised to NOT include any information in their responses that might be considered business sensitive, proprietary or otherwise confidential. The Federal Government does not guarantee confidentiality of the information received. Although CIGIE Technology Committee asks that no confidential business information be submitted, it is CIGIE Technology Committee practice to protect the provided information and make it available on a need-to-know basis only to CIGIE and CIGIE member organization personnel and contractors who will be using this information on behalf of such entities.

However, CIGIE Technology Committee will have no liability whatsoever for disclosure of such information that is provided.

Council of the Inspectors General on Integrity and Efficiency Page 8 of 9

If a respondent chooses to submit business sensitive, proprietary or otherwise confidential information, it must be clearly and conspicuously marked. Responses containing confidential, proprietary, or privileged information must be conspicuously marked as described below. Failure to comply with these marking requirements may result in the disclosure of the unmarked information under the Freedom of Information Act or otherwise. The Federal Government is not liable for the disclosure or use of unmarked information and may use or disclose such information for any purpose.

If your response contains confidential, proprietary, or privileged information, you must include a cover sheet with your response marked as follows identifying the specific pages containing the confidential, proprietary, or privileged information:

Notice of Restriction on Disclosure and Use of Data:

Pages [list applicable pages by number] of this response may contain confidential, proprietary, or privileged information that is exempt from public disclosure. Such information may be used or disclosed only for the purposes described in this RFI [list the RFI response name]. The Federal Government may use or disclose any information that is not appropriately marked or otherwise restricted, regardless of source.

In addition, (1) the header and footer of every page that contains confidential, proprietary, or privileged information must be marked as follows: “Contains Confidential, Proprietary or Privileged Information Exempt from Public Disclosure” and (2) every line and paragraph containing proprietary, privileged or trade secret information must be clearly marked with double brackets or highlighting.

6.0 Questions

Questions regarding this announcement shall be submitted in writing by e-mail to the agency’s Contracting Officer, Rebecca Mills at rebecca.mills@cigie.gov. We will only answer questions that have the subject of the email as “CIGIE Technology Committee Industry Day Series – IT Audit/FEAC Questions.” Verbal questions will NOT be accepted. Questions shall NOT contain proprietary or classified information. Any questions submitted to anyone else other than the listed person will NOT be accepted. The Government does not guarantee that questions received after 5 MARCH 2021 will be answered.

7.0 Summary

THIS IS A REQUEST FOR INFORMATION (RFI) ONLY to identify sources that can provide information technology tools, software, and services to the CIGIE and its member organizations. The information provided in the RFI is subject to change and is not binding on the Government. CIGIE has not made a commitment to procure any of the items discussed, and release of this RFI should not be construed as such a commitment or as authorization to incur cost for which reimbursement would be required or sought. All submissions become Government property and will not be returned.

The CIGIE Technology Committee will be holding a quarterly series of sub-committee themed Industry Days that will correspond with published RFIs. All properly formatted RFI submissions will be guaranteed inclusion in the government directory for reference. Presentations for the Industry Day will be selected from the respondents. All RFI submissions are NOT guaranteed to present at the Industry Day due to capacity limitations. Vendors will be notified for presentations by 31 March 2021 by the Contracting Officer.

mailto:rebecca.mills@cigie.gov

Council of the Inspectors General on Integrity and Efficiency Page 9 of 9

Industry Day will be held virtually on 13 April 2021. If a member of industry is interested in participating as an audience member they must contact the Contracting Officer by 9 April 2021 for registration information.

Attachment 1: Vendor Top Sheet