Civil works business intelligence risk management framework certification and continuous montioring

USACE intends to award a contract for this requirement as a competitively awarded 8(a) set-aside. The contract contains a period of performance consisting of one base year plus two one-year option periods. The contract is anticipated to be predominantly firm fixed price with cost reimbursable line items for materials and travel.

Background: The U.S. Army Corps of Engineers (USACE) Institute for Water Resources (IWR) seeks services and support to government staff with preparing technical documentation, completing specific tasks, and conducting continuous monitoring associated with maintaining an Authority to Operate (ATO) on the Department of Defense Information Network (DODIN) through compliance with DoD instruction 8510.01 Risk Management Framework (RMF) for DoD Information Technology[1] for software, systems and platform technology managed by the Civil Works Business Intelligence (CWBI) program. 

CWBI is an Automated Information System (AIS) that provides a central location for management and tracking performance of USACE Civil Works (CW) business line activity through an integrated geospatially enabled decision support system. CWBI provides the umbrella structure, support, and guiding procedures to accomplish the migration of systems, applications, and data into a common CW cloud-smart environment.  The CWBI environment is aligned with DoD and Army data strategy to make data visible, accessible, understandable, linked, trusted, interoperable, and secure (VAULTIS).

Description of Services: 

Contractor shall support the CWBI Program Management Office (PMO) in assuring compliance with DoDI 8510.01, preparing technical documentation and completing specific tasks associated with CWBI’s Authority to Operate (ATO), supporting CWBI cloud cybersecurity architecture, and administering change management procedures.  The contractor will work closely with the CWBI PMO, USACE CIO/G-6, and others to develop and monitor the necessary documentation of all applications within CWBI.  The contractor will also provide technical information for any necessary meetings with USACE CIO/G-6 and/or Army personnel as CWBI continuously performs RMF steps.     

There will be several specific deliverables within this contract associated with anticipated documentation and reports connected with CWBI and its components.  There are approximately 140 components (including applications and databases) currently identified as part of CWBI.  The contractor will review existing RMF documentation and edit/develop as necessary in partnership with module owners.  The assumption in this contract request would be that the documentation for these 140 modules will continue to be maintained and enhanced for future Security Control Assessor – Validator (SCA-V) and/or Continuous Monitoring (ConMon) audits conducted on the CWBI program. 

As part of CWBI’s requirement to maintain an ATO, the contractor will assist the CWBI PMO with the implementation of a continuous monitoring strategy, including scanning applications for vulnerabilities, providing guidance on vulnerability remediation, and hardening cloud infrastructure and policies to ensure cybersecurity compliance.  Furthermore, the contractor will be an integral part of CWBI’s change management process, serving as a reviewer and validator of application change requests to ensure compliance with DoD RMF and cybersecurity requirements.

Questions regarding this solicitation must be submitted in writing to the Points of Contact listed in this notice. No phone calls will be accepted. All questions regarding this solicitation must be submitted in MS Word. Applicable references to solicitation or PWS paragraphs should be included. All questions must be submitted no later than 1630 / 430PM US Eastern Standard Time on Thursday, 13 FEBRUARY 2025. Questions received after the due date and time may or may not be answered. 

Contract Award is anticipated to be no later than 13 MARCH 2025. 

See the attached PWS for additional information and the attached Past Performance Questionnaire. 

Amendment 0001 is issued to provide answers to questions and includes an amended SF1449. The due date and time remain the same.