SSN 250288J Final.pdf

Sources Sought Notice 1

SOURCES SOUGHT NOTICE (SSN) 250288J

AUDIT MANAGEMENT SYSTEM (AMS)

THIS IS NOT A FORMAL REQUEST FOR QUOTE (RFQ) AND DOES NOT

COMMIT THE CENTERS FOR MEDICARE & MEDICAID SERVICES (CMS)

TO AWARD A CONTRACT NOW OR IN THE FUTURE

This is a SOURCES SOUGHT NOTICE (SSN) issued for the purpose of planning and performing market research. The purpose of this Notice is to determine the availability and capability of potential small businesses (e.g., 8(a), service-disabled veteran-owned and veteran-owned small business, HUBZone small business, small-disadvantaged business, and women-owned small business) that have the capability to support the Audit Management System (AMS) and Provider Statistical & Reimbursement (PS&R) change management system.

This work includes supporting CMS in maintaining and enhancing the AMS to allow the government to successfully perform the daily tracking, resolution and reporting of audit program activities, PS&R features/releases, and the AMS Change Request Module.

A. General Background:

The Centers for Medicare & Medicaid Services (CMS) Office of Financial Management (OFM), Financial Services Group (FSG) establishes policies and procedures to coordinate benefits, authorize payments, performs audits, collect debts, and negotiate settlements for the protection of the Federal Health Care Trust Funds. Office of Legislation’s Audit Management Group (AMG) serves as the principal CMS contact and lead for all internal audits, which includes coordinating all aspects of the audit – writing and clearing responses, leading meetings with auditors, compiling document requests, and communicating with the auditors. FSG’s Division of Audit Management & Resolution (DAMR) serves as CMS coordinator for the development and monitoring of all audit corrective action plans and overall resolution of recommendations resulting from audit functions.

AMG’s functions include coordinating, tracking, clearing and transmitting document requests related to Government Accountability Office (GAO) and Office of Inspector General (OIG)audits from the audit notice through issuance of the final audit report. They assist the relevant components/groups in drafting clear and transmit concise written responses requested by an auditor, and draft and clear the CMS response to draft audit reports and efforts to implement audit recommendations. AMG further works with the Office of the Assistant Secretary for Legislation, Office of General Counsel (OGC), and other offices as necessary to ensure a coordinated and accurate response to audits and briefs senior CMS and Health and Human Services’ officials on agency responses to the Government Accountability Office (GAO) and Office of Inspector General (OIG) audits.

Sources Sought Notice 2

DAMR’s functions include responsibility for assigning, tracking, controlling, monitoring, reconciling, and reporting of CMS-wide resolution of all GAO, OIG, and Single Audit recommendations through implementation of corrective action plans. Developing, coordinating, and overseeing the audit tracking and reporting includes, but is not limited to, generating reports for the administration of the audit resolution process, maintaining an audit clearance tracking system to aid the DAMR program analysts and CMS Component gatekeepers, dashboarding/reporting of audit activities and recommendation inventory balances, statutorily mandated reconciliation and reporting, recording and reporting of audit overpayment recoveries and receivable balances, and establishes a keyword tracking system for the audits.

DAMR’s functions also include oversight and serving as Contracting Officer Representative (COR) for AMS and providing support to the OAGM on the development of contract requirements, procurement documents, and contractor oversight and performance evaluations. Furthermore, DAMR supports and responds to the contractor and program budgetary needs related to audit and audit reimbursement activities as well as coordinates the development and monitoring of all audit corrective action plans and overall resolution of recommendations resulting from the OIG and GAO audits of CMS (internal audits) and OIG and Single Audits of external entities receiving funding via CMS programs and contracts (external audits).

Using the ServiceNow (SNOW) platform, FSG created an application to administratively track and monitor audit and program activities, hereafter known as the Audit Management System (AMS).

The Division of Program Services and Support (DPSS), within OFM CMS, uses OFM ServiceNow (SNOW) to facilitate PS&R change management and oversee its Feature, Release, and Decision records. OFM SNOW streamlines the process of implementing changes to the PS&R system by creating Feature records to document upcoming changes, Release records to track specific updates or improvements, and Decision records to log the decisions made throughout the change process. This process integration guarantees that all changes are carefully planned, executed, and tracked for accountability and compliance. The Provider Statistical & Reimbursement (PS&R) system is used to manage and track financial data related to healthcare providers, including claims, payments, and adjustments. The PS&R system helps ensure accurate reimbursement and compliance with Medicare policies.

The PS&R change management tracker module is included in the same SNOW instance as AMS.

B. Required Knowledge and Experience

Independently and not as an agent of the Government, the contractor responsible shall furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the requirements

Sources Sought Notice 3 presented in this notice. At a minimum, the following knowledge and experience are required:

• Thorough understanding of the ServiceNow platform of its application to provide support and maintenance

• Thorough understanding of the internal and external audits and reviews, Security Assessment and Authorizations (SA&A), Security Controls Assessments (SCAs), Penetration Testing (PEN Test), and Incident Response and self-assessments.

• Thorough understanding and knowledge of and ability maintain the security documentation such as System Security Privacy Plan (SSPP), Contingency Plan (CP), and Information System Risk Assessment (ISRA) and activities essential to sustain the Authorization to Operate (ATO).

• Understanding and experience with User Acceptance Testing (UAT) when certain independent validation of software and FSG ServiceNow components developed, modified, or implemented.

• Prior experience working on ServiceNow platform and application design.

C. Capability Statement Requirements

CMS requests that the respondent specifically address the requirements listed below.

Respondents should provide enough information for CMS to make an informed determination of their capability to perform each item identified below. It is acceptable for certified small business potential offerors to concentrate on a subset of the capabilities identified below. A certified small business potential offeror as prime contractor should describe how the respondent will provide at least 50% of the cost of labor (including indirect charges) required to perform the services. In the event of conflict between FAR clause 52.219-14 and 15 U.S.C. § 657s, for purposes of the limitations on subcontracting, CMS will follow 15 U.S.C. § 657s. Also, please provide a list of contract numbers that your organization has had (if applicable) and your role on the contract (prime contractor or subcontractor). If you were a subcontractor on a particular contract, please clarify the work that you did on that contract.

Responses based upon anticipated teaming arrangements are acceptable. The capability of each team member (prime contractor and subcontractors) shall be demonstrated relative to the anticipated functions/roles to be performed by each. Potential small businesses shall also include the business information outlined in the section D below as part of their response.

Please describe your capabilities and detailed experience performing similar activities to those listed below. Your responses should clearly demonstrate your ability to perform and understanding of the requirements to:

1. Support agency staff with all internal and external audits and reviews, Security Controls Assessments (SCAs,) and self-assessments. Provide system support include ensuring system functionality exists to assist in the review of audit

Sources Sought Notice 4 findings, in the development and closure of corrective action plans, and ensure that all compliance descriptions, which may result from audits or assessments.

2. Maintain security documentation such as System Security Privacy Plan (SSPP), Contingency Plan (CP), and Information System Risk Assessment (ISRA), and activities essential to sustain the Authorization to Operate (ATO).

3. Assist and develop scheduled and ad hoc systems reports from ServiceNow to support monthly, quarterly, semi-annual, and annual reporting to various entities to include actions taken and monetary recoveries during the reporting period as well as current inventories.

4. Provide administrative support for the ServiceNow platform including managing out-of-the-box functionality, establishing platform governance, ensuring effective user access management via CMS Enterprise Identify Management, and handling all AMS release management, onboarding and offboarding ServiceNow users, and ServiceNow platform version upgrades.

5. Develop and maintain a schedule of prioritized enhancement releases which are discussed, including estimated level of effort (i.e. story points), with COR and system user at monthly and/or any ad hoc meetings agency deems necessary.

Provide Project Status Reports on current projects.

6. Design a detailed test plan for every change (including system enhancements) made ServiceNow environment and associated applications including User Acceptance Testing (UAT) and any required follow-up debugging or correction of defects and regression testing to ensure implemented changes to not negatively impact other program functionalities.

7. Maintain and update data dictionaries and “As Built Documentation” describing the business process of the built system updated as system updates are released.

8. Maintain and update the applications User’s Guide. The documentation describes how the various functions of the systems operate and is updated as system releases are made.

9. Provide user training and overviews (as requested by the COR) on all system functions of the ServiceNow environment and associated applications.

10. Develop procedures to ensure that all deliverables are of an acceptable quality.

This shall include both the administrative and technical aspects of each deliverable.

D. Instructions for Submitting Responses to CMS

The following specific information is requested: (a) company descriptive literature; (b) specific related corporate experience; (c) experience with the type of capability expectations mentioned above; (d) references, to include points of contact, email addresses, and phone numbers; and (e) Business information outlined below:

a. Unique Entity Identifier (UEI)

b. Company Name

c. Company Address

d. Company Point of Contact, Phone and Email address

Sources Sought Notice 5

e. Point of Contact, Phone and Email address of individuals who can verify the demonstrated capabilities identified in the responses

f. Type of company (e.g., small business, 8(a), woman owned, veteran owned, etc.)

as validated via the System for Award management at www.sam.gov.

Registration via System for Award management (www.sam.gov) is a requirement for qualifying as a prime contractor with CMS. Furthermore, the small business size standard for the North American Industry Classification System (NAICS) code 541511 – Custom Computer Programming Services, will be applicable.

Responses are limited to one (1) page answers for each of the individual requirements (10 requirements total) stated in Section C with a total of no more than 10 pages for the entire capability statement. Capability statements shall designate and/all teaming arrangements and the work proposed to be performed by each team member.

All transmitted information marked proprietary shall be treated as such. Therefore, businesses should identify any proprietary information in their responses. Proprietary materials will either be distributed, nor discussed with, any other organization.

Information submitted in response to this notice will be used at the discretion of the Government. Further, the information submitted will remain confidential insofar as permitted by law, including the Freedom of Information and Privacy Acts.

Please note: Respondents should be aware that this SSN is for market research purposes only and any responses thereto, or lack thereof, will not constitute a commitment by CMS to treat any potential offeror more or less favorably in the anticipated forthcoming solicitation and/or ultimate award. Please be advised that CMS will not respond directly to organizations submitting information in response to this SSN.

Teaming Arrangements All teaming arrangements should also include the above-cited information and certifications for each entity on the proposed team. Teaming arrangements are encouraged.

Response Due Date Responses must be submitted electronically no later than 12:00 PM EST, Wednesday, March 19, 2025, to the Contracting Officer and Contract Specialist per information below. Capability statements will not be returned and will not be accepted after the due date.

Sources Sought Notice 6

CONTACT INFORMATION

Contracting Officer:

Rachel Johnson Centers for Medicare and Medicaid Services (CMS) Office of Acquisitions and Grants Management (OAGM) Medicare Support Contracts Group (MSCG) Division for Fee-For-Service Contracts (DFSC) 7500 Security Boulevard Baltimore, MD 21244 Phone: (410) 786-8995 Email: Rachel.Johnson@cms.hhs.gov

Contract Specialist:

Thaiana Rodrigues Maciel Centers for Medicare and Medicaid Services (CMS) Office of Acquisitions and Grants Management (OAGM) Medicare Support Contracts Group (MSCG) Division for Fee-For-Service Contracts (DFSC) 7500 Security Boulevard Baltimore, MD 21244 Phone (410) 786-8480 Email: Thaiana.Rodriguesmaciel@cms.hhs.gov mailto:Rachel.Johnson@cms.hhs.gov mailto:Thaiana.Rodriguesmaciel@cms.hhs.gov