RFI UDALL FISMA_Financial Audit.pdf

UDALL.GOV

MORRIS K. UDALL AND STEWART L. UDALL FOUNDATION (UDALL)

REQUEST FOR INFORMATION (RFI)

Financial and Federal Information Security Modernization Act (FISMA) Audit Services

I. INTRODUCTION/PURPOSE OF REQUEST FOR INFORMATION

The Morris K. Udall and Steward L. Udall Foundation (Udall) is issuing this Request for Information (RFI) to obtain information for the purposes of market research which may inform future requirement and contract efforts regarding performing functions in support of both Financial and Federal Information Security Modernization Act (FISMA) Audits for the Udall Agency.

The annual (fiscal year) Financial Audit consists of non-personal, financial auditing services for the Udall Agency at an enterprise level in accordance with the U.S. Generally Accepted Government (GAO) Auditing Standards.

The Federal Information Security Modernization Act (FISMA) Audit is a mandated evaluation aimed at ensuring the agency's information security program meets federal standards for safeguarding information and information systems.

All interested and qualified businesses (i.e., Small Business, Other than Small) are encouraged to respond to this notice in accordance with the instructions addressed herein.

Partial responses to technical specifications set forth in Contractor’s Capabilities Statement - Section 4 of this notice will be accepted.

THIS REQUEST FOR INFORMATION IS SOLELY FOR INFORMATIONAL AND

PLANNING PURPOSES AND DOES NOT CONSTITUTE A SOLICITATION. The RFI is solely for market research, planning and information purposes. In accordance with FAR 15.201(e), responses to this notice are not offers and cannot be accepted by the Government to form a binding contract, nor do they affect a potential offeror's ability to respond to any future synopsis/solicitation, which may or may not follow or restrict the Government's eventual acquisition approach. The Government will not provide reimbursement for any information that may be submitted in response to this notice, and no basis for a claim against the Government shall arise from a response to this notice or Government use of any information provided. Respondents are solely responsible for all expenses associated with responding to this RFI. All submissions become Government property and will not be returned. Unless advised or indicated on the responses to this RFI, all information furnished will be considered non-proprietary.

II. BACKGROUND/PROGRAM DESCRIPTION

The Morris K. Udall and Stewart L. Udall Foundation (Udall) has a need for support services in order to perform both a Financial Audit and a Federal Information Security Modernization Act (FISMA) Audit.

The Financial Audit consists of comprehensive annual (fiscal-year), non-personal, financial auditing services for the Udall Agency.

FISMA Audit serves as a mandated evaluation aimed at ensuring the agency's information security program meets federal standards for safeguarding information and information systems. This audit involves a thorough review of security policies, procedures, and controls to identify strengths and areas needing improvement. The FISMA audit ensures an objective assessment, helping the agency maintain compliance with federal information security requirements and improve its cybersecurity posture. The audit findings will provide insights into current security risks, enabling the agency to address vulnerabilities and strengthen its overall information security framework.

III. CONTRACTOR’S CAPABILITIES STATEMENT

The purpose of this RFI is for the Udall Foundation to improve its understanding of market capabilities and identify qualified vendors capable of providing Audit Services. Interested vendors shall identify their capabilities to meet the requirements as specified in Sections 1 – 4 below. Be very specific when describing experience in providing similar and/or the same type work to other Federal Agencies. Draft Technical Specifications are listed below in Section 4.

Section 1 – Cover Letter The cover letter must clearly identify the following information:

1. Company’s Name

2. Company’s Address

3. DUNS Number

4. Point of Contact(s) (Name, title, email, and phone number)

5. Identify your business size – Other than small, small, small disadvantaged, 8(a)-certified small disadvantaged, HUBZone small, woman-owned small, very small, veteran-owned small, service-disabled veteran-owned small.

7. Federal contract vehicles the Udall Foundation may consider for this requirement for which you are an awardee (e.g., Government Wide Acquisition Contracts (GWACs), GSA Schedules).

8. Potential Teaming Partners or Subcontractors.

Note: If partnerships are suggested to complete the work, please describe what areas the partners will be respectively working on and provide details on the approach and the capability.

Section 2 - Capabilities Statement Submit a capabilities statement that includes basic information describing the company. The capabilities statement should also include a brief description of the company, products, services, history, ownership, financial information, and other information deemed relevant.

The submitted Capabilities Statement shall not exceed ten (10) pages, in addition to a one (1) page cover letter, for a total submission not to exceed eleven (11) pages.

Section 3 – Past Performance Provide up to three examples of projects of similar in size, scope, and complexity to the technical specifications, preferably with the Federal Government. Briefly describe the scope of work, to include the customer environment, application solution designed/ implemented, project management methodology, security requirements, best practices/lessons learned, and relevant metrics. Please also include the period of performance, total contract value, and whether the work was performed as a prime or sub-contractor or describe any teaming arrangements.

Section 4 – Technical Specifications Based on the Technical Specifications stated below, please describe your company's understanding of the requirements, including a general plan for how to meet the objectives, recommended governance model, and organizational structure. Describe your company’s methodology for staffing this type of requirement in terms of workforce retention and recruiting/hiring process.

The draft Technical Specifications are as follows:

Financial Audit Services Audit:

The annual financial audits must be performed by an independent Certified Public Accounting firm with prior experience performing audits of federal micro-agencies in accordance with the following standards:

• The U.S. Generally Accepted Government Auditing Standards

• The GAO Government Auditing Standards (Yellow Book) o Outlines requirements for financial statements, notes to financial statements, and comments on the effectiveness of internal control and compliance with laws and regulations.

• The Office of Management and Budget (OMB) Bulletin No. 21-04.

• The firm must have experience conducting audits of agencies with federal trust funds.

Describe the following tasks to be performed:

1. Conduct a high-level review of the Udall Foundation’s internal control environment.

2. Conduct an entrance conference with key Udall Foundation officials.

3. Complete an Internal Control Management and Evaluation assessment that provides an understanding of the elements of the Udall Foundation’s internal control structure.

4. Prepare a Management Letter of findings and recommendations.

5. Perform tests to form conclusions regarding financial statements as reliable, accurate, complete and including all disclosures.

6. Perform substantive testing based upon the determinations of the strength of the internal control environment.

7. Discuss potential audit findings with Udall Foundation personnel throughout the course of the audit.

8. Develop overall conclusions and communicate them to the Udall Foundation.

9. Provide a Final Audit Report.

10. Hold an exit conference with the Udall Foundation.

Note: The Final Audit Report and the Management Letter must be completed and transmitted to the Udall Foundation no later than 41 days after the end of the fiscal year being audited (i.e., no later than November 10th).

Federal Information Security Modernization Act (FISMA) Audit:

The contractor shall conduct an independent assessment of the agency’s compliance with the Federal Information Security Modernization Act of 2014 (FISMA), as required by the Office of Management and Budget (OMB) and the Department of Homeland Security (DHS). The assessment will evaluate the maturity and effectiveness of the agency’s information security program and controls, in alignment with:

• OMB Circular A-130 (Managing Information as a Strategic Resource)

• NIST Special Publication 800-53, Rev. 5 (Security and Privacy Controls for Federal

Information Systems and Organizations)

• FY 202X IG FISMA Reporting Metrics issued by DHS and OMB

Required Assessment Areas The contractor shall evaluate the agency’s security program in accordance with the five functional areas of the NIST Cybersecurity Framework (CSF):

• Identify – Risk management, system inventory, and categorization (FIPS 199).

• Protect – Access controls, awareness training, data protection, and security policies.

• Detect – Continuous monitoring, audit logging, and incident detection capabilities.

• Respond – Incident response plans, reporting, and handling procedures.

• Recover – Contingency planning, disaster recovery, and system resilience.

Maturity Assessment and Compliance with DHS FISMA Reporting Metrics The contractor shall assess the agency’s information security program using the Inspector General (IG) FISMA Reporting Metrics issued by DHS and OMB, which apply across the life of the contract, including the initial award period and any subsequent optional years.

This includes evaluating both the core metrics, which remain consistent year over year, and the fiscal year-specific priority metrics for each applicable year of the contract. The assessment shall be conducted in alignment with the five-tier maturity model, which classifies program effectiveness as follows:

Ad Hoc (Level 1): Policies and procedures are informal and inconsistently implemented.

Defined (Level 2): Policies and procedures exist but are not consistently followed or enforced.

Consistently Implemented (Level 3): Policies and procedures are formally documented and applied across the agency.

Managed and Measurable (Level 4): The security program is actively monitored and assessed for effectiveness.

Optimized (Level 5): The agency proactively adapts its security program to emerging threats.

The contractor shall determine the agency’s maturity level across all five functional areas of the NIST Cybersecurity Framework: Identify, Protect, Detect, Respond, and Recover. The assessment shall identify gaps between the current state and DHS/OMB expectations, with specific attention to security control implementation and FISMA compliance.

As part of the final report, the contractor shall provide a detailed analysis of identified gaps and risk-based recommendations to improve the agency’s security posture. These recommendations must be actionable, align with federal security policies and best practices, and focus on increasing the agency’s maturity in key areas. The report shall clearly document the agency’s compliance status across all core and priority metric areas in the applicable IG FISMA Reporting Metrics for the relevant fiscal year(s) and include a compliance roadmap prioritizing security improvements based on risk.

Key Tasks and Deliverables

The contractor shall perform the following tasks:

Pre-Audit Planning & Kickoff Meeting

The contractor shall begin the engagement with a kickoff meeting, during which they will review previous audit findings and associated Plan of Actions and Milestones (POA&Ms). In addition, the contractor shall develop a comprehensive audit work plan that outlines key tasks, timelines, and deliverables for the audit process.

Assessment of Security Program Maturity

The contractor shall conduct a thorough assessment of the agency’s security program, which includes interviewing relevant agency personnel, reviewing existing policies, procedures, and security documentation, and performing technical testing such as vulnerability scanning and configuration reviews. Additionally, the contractor shall evaluate the agency’s compliance with its specific security requirements to ensure alignment with federal standards and best practices.

Testing of Security Controls

The contractor shall perform a comprehensive test of the agency’s security controls by assessing a sample of systems against the relevant NIST SP 800-53 controls. This process will include a review of key operational processes such as access management, logging, encryption, and patching, as well as verification of the implementation of critical security measures, including security training, contingency planning, and incident response processes.

Findings and Risk Analysis

The contractor shall identify security weaknesses and areas of noncompliance within the agency’s information security program. Based on these findings, the contractor shall assign appropriate risk levels to each identified issue and recommend targeted remediation strategies to address these vulnerabilities.

Reporting & Closeout

The contractor shall prepare a draft FISMA Audit Report that details the audit findings and recommendations. Following the draft, a review meeting with agency stakeholders shall be conducted to discuss the report’s content and incorporate any necessary feedback. Based on this discussion, the contractor will then finalize and deliver the Final Audit Report, which must include a compliance score as well as risk-based recommendations to address any identified deficiencies.

Contractor Qualifications

The contractor shall demonstrate extensive expertise in federal cybersecurity frameworks and FISMA compliance, including proficiency in applying the NIST Risk Management Framework (RMF) and conducting comprehensive security control assessments. This foundational knowledge is essential for evaluating and ensuring that the agency’s security posture aligns with federal standards and best practices.

In addition, the contractor must possess a strong background in security testing methodologies, such as vulnerability assessments, to ensure a thorough evaluation of the agency’s security controls. Prior experience in conducting FISMA audits for federal agencies is required, ensuring that the contractor is well-versed in the regulatory environment and capable of delivering thorough and insightful audit outcomes.

Period of Performance & Key Milestones The period of performance for the FISMA audit shall commence only after the FISMA IG Metrics have been made available. Upon availability, the contractor is expected to initiate the audit process within 10 business days of the agency notifying that it is ready to start. The final report shall be completed by July 15, ensuring that the agency has sufficient time to complete the necessary data entry for the CyberScope data call due on July 31.

IV. QUESTION AND ANSWER (Q&A) PERIOD

As this is a Request for Information (RFI) and not a request for quotes or proposals, no questions are being accepted at this time.

V. SUBMISSION OF INFORMATION

The information requested in support of the Capabilities Statement must be submitted in writing. The submitted Capabilities Statement shall not exceed ten (10) pages, in addition to a one (1) page cover letter, for a total submission not to exceed eleven (11) pages.

Your submission should be organized in accordance with the instructions in this document in order to permit a thorough and accurate review by the Government.

Responses to this RFI must be submitted via electronic mail no later than 20 February 2025 at 2:00PM, MST (AZ) to the following:

Terri L. Harrison at harrison@udall.gov

Responses not received by the closing date and time may not be considered.

VI. POINTS OF CONTACT

mailto:harrison@udall.gov

All comments, inquiries and responses should be directed to the following individual:

Terri L. Harrison Contracting Officer harrison@udall.gov mailto:harrison@udall.gov