RFI - Tech Committee - CIO Subcommitteee Industry Day -July 27 - Final.pdf

Request for Information: CIG21R0003

CIGIE Technology Committee Industry Day Series – Chief Information Officer Technologies Chief Information Officer Subcommittee

Council of the Inspectors General on Integrity and Efficiency (CIGIE) CIGIE Technology Committee

AGENCY CONTRACTING OFFICER: RFI RELEASED: JUNE 23, 2021

REBECCA MILLS RFI CLOSED: JULY 14, 2021

REBECCA.MILLS@CIGIE.GOV VIRTUAL INDUSTRY DAY: JULY 27, 2021

mailto:REBECCA.MILLS@CIGIE.GOV

REQUEST FOR INFORMATION

CIGIE Technology Committee Industry Day Series – Chief Information Officer Technologies

Council of the Inspectors General on Integrity and Efficiency

1.0 Introduction

1.1 Background. The Council of the Inspectors General on Integrity and Efficiency (CIGIE) is an independent entity established within the executive branch to address integrity, economy and effectiveness issues that transcend individual Government agencies and aid in the establishment of a professional, well-trained, and highly skilled workforce in the Offices of Inspectors General (OIGs). The CIGIE Technology Committee is a standing committee supporting the overall CIGIE mission, with their own mission to facilitate effective information technology (IT) audits, evaluations, inspections, and investigations by Inspectors General (IGs), and to provide a vehicle for the expression of the OIG community's perspective on Governmentwide IT operations. The CIGIE Technology Committee is releasing a Request for Information (RFI) to elicit responses from vendors and other interested parties on specific information technology tools, software, and services they can provide to OIGs. Specifically, the purpose of this RFI is to assist the CIGIE Technology Committee in obtaining information on enterprise tools, software, and services, which could assist OIG Chief Information Officers (CIOs) to perform their information security and information management missions more effectively and efficiently.

1.2 Purpose. The CIGIE Technology Committee plans to hold a series of industry days on various topics throughout the year. On July 27, 2021, we will be conducting an industry day, which will cover specific enterprise tools, software, and services that vendors can provide to OIGs for their CIO missions. The information we receive from this specific RFI will be used to select vendors for participation in our industry day event. Future technology industry days are planned for the topic areas of emerging technology and data analytics / visualization. Please do not respond to this specific RFI with tools covering the additional listed topic areas. We will dispose of and not consider any responses for industry day that are not related to the current topic. Continue to monitor the beta.sam.gov for additional RFI announcements.

THIS IS A REQUEST FOR INFORMATION (RFI) ONLY. This RFI is issued solely for information and planning purposes – it does not constitute a Request for Proposal (RFP) or a promise to issue an RFP in the future. This RFI does not commit the Government to contract for any supply or service whatsoever.

Further, the CIGIE Technology Committee is not at this time seeking proposals and will not accept unsolicited proposals. Respondents are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this RFI; all costs associated with responding to this RFI will be solely at the interested party’s expense. Not responding to this RFI does not preclude participation in any future RFP, if any is issued. It is the responsibility of the potential offerors to monitor beta.sams.gov for additional information pertaining to this requirement.

2.0 Overview

CIGIE is an independent federal entity established within the executive branch under the authority of the Inspector General Act of 1978, as amended. CIGIE membership includes 75 statutorily created OIGs with the mission to address the integrity, economy, and effectiveness challenges that transcend individual government agencies. The CIGIE Technology Committee, one of the seven standing committees supporting the overall CIGIE mission, promotes effective teamwork in addressing Governmentwide initiatives, improving OIG IT activities, and safeguarding national IT assets and infrastructure.

Specifically, the CIGIE Technology Committee provides a forum for the OIGs to share information, including IT best practices and technology capabilities. The CIGIE Technology Committee also coordinates IT-related activities of CIGIE members, advises CIGIE and its members on IT issues, and conducts relevant IT educational and training activities.

According to the National Institute of Standards and Technology, CIOs are responsible for:

• Providing advice and other assistance to the head of the executive agency and other senior management personnel of the agency to ensure that information technology is acquired, and information resources are managed in a manner that is consistent with laws, Executive Orders, directives, policies, regulations, and priorities established by the head of the agency.1

• Developing, maintaining, and facilitating the implementation of a sound and integrated information technology architecture for the agency; and

• Promoting the effective and efficient design and operation of all major information resources management processes for the agency, including improvements to work processes of the agency.2

3.0. Overview of Technologies and Solutions Sought

Responses to this RFI will be reviewed to assist the CIGIE Technology Committee in identifying best in class solutions, which will in turn allow the OIGs to meet their statutory requirements and effectively meet their CIO missions.

At a minimum, responses to this RFI must include a description of the tools, software, and services available and how they can be used by OIG CIOs to accomplish their operational missions in support of their IG organization. The tools or tools used and provided by servicers must be consistent with the National Institute of Standards and Technology (NIST) security content automation protocol.

If possible, responses to this RFI should also provide examples of how the tools, software, and services were previously used or are being utilized to support a government agency CIO’s information security and information management missions in an audit and investigative organization.

3.1 Capabilities: CIO Technology and Management Support Tools

In this RFI, the CIGIE Technology Committee is interested in learning about the enterprise tools, software, and services, listed directly below, which could assist OIG CIOs as they provide information and technology service and support to their IG organizations.

• User Management Tools – Cloud-based identity and access management, identity as a service

(IDaaS), user account management, access rights management, and privileged access management tools, software, and services, which can be used in an audit or investigative environment. Two subsets of this include:

1 NIST Glossary, “Chief Information Officer,” Accessed May 5, 2021, CIO - Glossary | CSRC (nist.gov).

2 NIST Glossary, “Chief Information Officer,” Accessed May 5, 2021, CIO - Glossary | CSRC (nist.gov).

https://csrc.nist.gov/glossary/term/CIO https://csrc.nist.gov/glossary/term/CIO

• Multifactor Authentication – Tools, software, and services, which require two or more distinct factors and do not require a password for authentication.3

• Derived credentials for use on mobile devices.

• Collaboration – collaboration tools, software, and services, which can be used in a government oversight environment. Cutting-edge collaboration is preferred beyond the standard Microsoft Office suite of tools, chat or video services.

• e-Discovery – Tools, software, and services that will allow an organization to maintain data objects and their metadata so that the data attribution can be known, and to provide data to an authorized legal-representative upon request.4 Additionally, tools, software, and services tools might help an agency collect existing departmental records and facilitate the review and production of electronically stored information, such as emails, computer files, and databases.

• Records Management Applications – Tools, software, and services that will allow an agency to ensure long-term preservation of its critical data, preferably in an audit or investigative environment. Distinction should be made for how to identify records as opposed to documents, classification of records and use of disposition schedules. Application of Artificial Intelligence examples is strongly desired. Solutions that allow for complex records to be stored in their native case management systems and managed externally should be differentiated from those that duplicate records in a centralized Records Management Application and what the advantages are for the proposed solution.

• Data Governance – Tools, software, and services that help an agency manage the principles, policies, processes, frameworks, tools, metrics, and oversight required to effectively manage data at all levels, from creation to disposition. Special consideration for Data Visualization tools is desired. Proposed solutions should support the effort to build a “long-term, enterprise-wide Federal Data Strategy to:

• Better govern and leverage the Federal Government’s data;

• Enable government data to be accessible and useful for the American public, businesses, and researchers; and

• Improve the use of data for decision-making and accountability for the

Federal Government, including for policy-making, innovation, oversight, and learning.”

• Internet of Things (IoT) – a system of interrelated computing devices, mechanical and digital machines, objects, animals or people that are provided with unique identifiers (UIDs) and the ability to transfer data over a network without requiring human-to-human or human-to-computer interaction. Use in a federal agency environment that meets all security requirements is required.

• Technology Business Management - Technology Business Management (TBM) is an IT management framework that implements a standard IT spend taxonomy. In other words, it implements a standard way to categorize IT costs, technologies, resources, applications and services. TBM enables organizations to disaggregate IT spending into smaller, consistent categories to provide CIOs and other C-suite executives with a more accurate and detailed

3 NIST Glossary, “MFA,” Accessed May 11, 2021, MFA - Glossary | CSRC (nist.gov).

4 NIST, eDiscovery 5.5 (Working Document), Accessed May 11, 2021, 5.5 eDiscovery | NIST.

https://csrc.nist.gov/glossary/term/MFA#:%7E:text=NIST%20SP%20800%2D63%2D3,authenticators%20that%20provide%20different%20factors.

https://www.nist.gov/itl/55-ediscovery understanding of their organization’s IT costs. This allows agencies to identify duplicative or unnecessary spending and to make better informed decisions regarding future investments.

• Low-code, no-code - development platforms are types of visual software development environments that allow enterprise developers and citizen developers to drag and drop application components, connect them together and create mobile or web apps.

• Mobile Device Applications –mobile device development and application use within the Federal Government. Apple iOS is the most common use but some agencies utilize Android phones.

4.0. Responses

The CIGIE Technology Committee will compile all the responses into a single PDF document that will become a reference directory for CIGIE and CIGIE member research. This material will be strictly for internal use by CIGIE and its member organizations only and will not be published on a public facing website. The document will be used for market research purposes.

By submitting an RFI response, you are consenting to be included in the reference directory.

All respondents who provide an RFI to the required specifications are not guaranteed a presentation slot at the referenced CIGIE Technology Committee Industry Day.

All respondents who provide an RFI to the required specifications are guaranteed to be included in the vendor reference directory that will be provided to the various CIGIE member organizations.

4.1 Submission Contents. Failure to follow the format below may remove your company for consideration of presentations and inclusion in the reference directory. The response must include the following components:

4.1.1 Top Sheet. Respondents are required to fill out the “Top Sheet” that has been included as Attachment A. This document will be attached to the front of the White Paper. The Top Sheet does not count towards the page requirement count. It will be included in the reference guide previously mentioned.

4.1.2 White Paper. The White Paper has a limitation of five (5) pages. It will be made up of two sections.

Section 1 shall provide administrative information and will not count towards the paper limitation of five

(5) pages. Information that will be included in this order are:

4.1.2.1. Name, mailing address, overnight delivery address (if different from mailing address), phone number, and e-mail of designated point of contact.

4.1.2.2. Business type. If small business, please select the title that reflects your category. If none is designated, it will be considered ‘small business – not specified’. (Responses may include: Large Business, Small Businesses [8(a), HUBZone, Woman-Owned, Service-Disabled Veteran-Owned]).

4.1.2.3. CAGE Code and DUNS Code; NAICS Codes

Council of the Inspectors General on Integrity and Efficiency

4.1.2.4. If applicable, the current governmentwide contracts, their sponsoring agency, and the period of performance for that contract.

4.1.2.5. List the capability titles that apply to the paper that were identified in Section 3.1. (For example – “Capabilities: Endpoint Security, Wireless assessment, Cutting Edge”)

Section 2 shall provide the technical response to the posted RFI. Responses must clearly identify the technology capability the tool supports that were identified in the Section 3.1.

Proprietary information, if any, should be minimized and MUST BE CLEARLY MARKED. To aid the Government, please segregate proprietary information.

4.2 Submitting. Interested parties are requested to respond to this RFI with their completed response to the contracting officer, Ms. Rebecca Mills, by mail to Rebecca.Mills@cigie.gov. The email MUST have the subject “CIGIE Technology Committee Industry Day Series – Chief Information Officer Technologies.” Failure to comply with this naming convention will remove your company’s response from consideration.

White papers in Microsoft Word for Office 2013 or higher compatible format are due no later than COB on Wednesday, July 14, 2021 via email. Responses shall be limited to five (5) pages with font no smaller than 10-point. Graphics and charts are not required - if they are provided in the respondent’s submission, they will be counted towards the page limit. Please be advised that all submissions become Government property and will not be returned.

4.3 Industry Day. Respondents may be contacted based on their submission to be invited to present at the Committee’s Industry Day that will be held for approximately two (2) hours on July 27, 2021. The event will be held virtually utilizing a virtual audio and video conferencing platform (e.g., Zoom for Government). All responses submitted to the RFI are not guaranteed a presentation spot. The number of presentations will be limited due to schedule limitations and will be selected by the government based on submission time and RFI response. Vendors who are selected will be notified by July 16, 2021 by the Contracting Officer, Rebecca Mills.

Selected respondents will present the capabilities of their tools, software, or services (and may also be asked to perform a brief demonstration of a specific tool, software, or service). Presentations will be limited to PowerPoints and additional details will be made available in the future. Presentations will be due by 1 PM EST finalized by July 23, 2021. If a vendor does not meet the deadlines, they will forfeit their place and may be removed from the event lineup.

The PowerPoints that are selected for the presentation will be made available in PDF format in addition to the Vendor Reference Directory. The PDF will be made available in the same format and method as the Vendor Reference Directory.

If a member of the Industry is interested in securing an audience link to the event, please contact the CIGIE Contracting Officer, Rebecca Mills by 1 PM EST on July 23, 2021.

mailto:Rebecca.Mills@cigie.gov

Council of the Inspectors General on Integrity and Efficiency

4.3.1 Vendor Reference Directory. The CIGIE Technology Committee understands that the industry at large would like the government to review their submission. We appreciate the effort that companies are taking by responding to the RFI. There is an anticipation of a high-volume of responses. The number of presentation slots are limited due to time. To maximize the visibility of the White Paper, the Committee will create a single Reference Directory of ALL responses that meet the RFI requirements. This Directory will be a government market research reference tool that will be made available to all 75 of the OIGs.

5.0 Terms and Conditions, Disclaimers, and Important Notices

FAR 52.215-3 Request for Information or Solicitation for Planning Purposes (Oct 1997)

a) The Government does not intend to award a contract based on this solicitation or to otherwise pay for the information solicited except as an allowable cost under other contracts as provided in subsection 31.205-18, Bid and proposal costs, of the Federal Acquisition Regulation.

b) Although "proposal" and "offeror" are used in this Request for Information, your response will be treated as information only.

It shall not be used as a proposal.

c) This solicitation is issued for the purpose of gathering information on new cyber security and FISMA audit, inspection, and evaluation tools, software, and services to be used by auditors.

By submitting an RFI response, you are consenting to be included in the Reference Directory. This directory will be made available to all CIGIE member organizations. The directory will NOT be published on a public facing website.

All respondents who provide an RFI to the required specifications are guaranteed to be included in the vendor reference directory that will be provided to the various Office of the Inspectors General.

CIGIE Technology Committee representatives may or may not choose to meet with potential respondents. Such discussions would only be intended to get further clarification of potential capability to meet the requirements, especially any development and certification risks.

Council of the Inspectors General on Integrity and Efficiency

CIGIE Technology Committee representatives may or may not contact respondents for Industry Day presentation slots.

All respondents who provide an RFI to the required specifications are NOT guaranteed a presentation slot at the referenced CIGIE Technology Committee Industry Day.

Administration by Federal and Non-Federal Personnel:

Federal employees are subject to the non-disclosure requirements of a criminal statute, the Trade Secrets Act, 18 U.S.C. § 1905. The Federal Government may seek the advice of qualified non-Federal personnel.

The Federal Government also may use non-Federal personnel to conduct routine, nondiscretionary administrative activities. The respondents, by submitting their response, consent to CIGIE Technology Committee providing their response to non-Federal parties. Non-Federal parties given access to responses will be subject to an appropriate obligation of confidentiality prior to being given the access.

Proprietary, Confidential, or otherwise Sensitive Information:

Because information received in response to this RFI may be used to structure future programs and funding opportunity announcements or otherwise be made available to the public, respondents are strongly advised to NOT include any information in their responses that might be considered business sensitive, proprietary, or otherwise confidential. The Federal Government does not guarantee confidentiality of the information received. Although CIGIE Technology Committee asks that no confidential business information be submitted, it is CIGIE Technology Committee practice to protect the provided information and make it available on a need-to-know basis only to CIGIE and CIGIE member organization personnel and contractors who will be using this information on behalf of such entities.

However, CIGIE Technology Committee will have no liability whatsoever for disclosure of such information that is provided.

If a respondent chooses to submit business sensitive, proprietary, or otherwise confidential information, it must be clearly and conspicuously marked. Responses containing confidential, proprietary, or privileged information must be conspicuously marked as described below. Failure to comply with these marking requirements may result in the disclosure of the unmarked information under the Freedom of Information Act or otherwise. The Federal Government is not liable for the disclosure or use of unmarked information and may use or disclose such information for any purpose.

If your response contains confidential, proprietary, or privileged information, you must include a cover sheet with your response marked as follows identifying the specific pages containing the confidential, proprietary, or privileged information:

Notice of Restriction on Disclosure and Use of Data:

Pages [list applicable pages by number] of this response may contain confidential, proprietary, or privileged information that is exempt from public disclosure. Such information may be used or disclosed only for the purposes described in this RFI [list the RFI response name]. The Federal Government may use or disclose any information that is not appropriately marked or otherwise restricted, regardless of source.

In addition, (1) the header and footer of every page that contains confidential, proprietary, or privileged information must be marked as follows: “Contains Confidential, Proprietary or Privileged Information Exempt from Public Disclosure” and (2) every line and paragraph containing proprietary, privileged or trade secret information must be clearly marked with double brackets or highlighting.

6.0 Questions

Questions regarding this announcement shall be submitted in writing by e-mail to the agency’s Contracting Officer, Rebecca Mills at rebecca.mills@cigie.gov. We will only answer questions that have the subject of the email as “CIGIE Technology Committee Industry Day Series – Chief Information Officer Technologies.” Verbal questions will NOT be accepted. Questions shall NOT contain proprietary or classified information. Any questions submitted to anyone else other than the listed person will NOT be accepted. The Government does not guarantee that questions received will be answered. Question answers will be sent to those who request them in one communication after the quote close.

7.0 Summary

THIS IS A REQUEST FOR INFORMATION (RFI) ONLY to identify sources that can provide information technology tools, software, and services to the CIGIE and its member organizations. The information provided in the RFI is subject to change and is not binding on the Government. CIGIE has not made a commitment to procure any of the items discussed, and release of this RFI should not be construed as such a commitment or as authorization to incur cost for which reimbursement would be required or sought. All submissions become Government property and will not be returned.

The CIGIE Technology Committee will be holding a quarterly series of sub-committee themed Industry Days that will correspond with published RFIs. All properly formatted RFI submissions will be guaranteed inclusion in the government directory for reference. Presentations for the Industry Day will be selected from the respondents. All RFI submissions are NOT guaranteed to present at the Industry Day due to capacity limitations. Vendors will be notified for presentations by July 16, 2021 by the Contracting Officer.

Industry Day will be held virtually on July 27, 2021. If a member of industry is interested in participating as an audience member, they must contact the Contracting Officer by July 22, 2021 for registration information.

Attachment 1: Vendor Top Sheet mailto:rebecca.mills@cigie.gov

Event Date: July 27, 2021 Vendor Submitted Top Sheet

For Official Uses Only – CIGIE Technology Committee

Company Name

Website Point of Contact #1

Address Point of Contact #2

DUNS Point of Contact #3

CAGE CODE

Set Asides:

Contract Vehicle (Agency, Contract Number, POC, Exp. Date)

Written Narrative

Tools Services

Attachment 1 - Industry Day Top Sheet.pdf