Request for Information - Financial Statement Audit (FSA) and Federal Information Security Modernization Act (FISMA) Evaluation

                                                                               (U) Request for Information

Financial Statement Audit (FSA) and Federal Information Security Modernization Act (FISMA) Evaluation

1.       Description & Purpose

1.1     The purpose of this Request for Information (RFI) is to gain information on current Industry practices and capabilities that would meet the following requirement: 1) an annual independent audit of the National Geospatial-Intelligence Agency’s (NGA) financial statements and 2) an annual independent evaluation of NGA’s information security program and practices in accordance with the Federal Information Security Modernization Act of 2014 (FISMA). 

1.2       THIS IS A REQUEST FOR INFORMATION (RFI) ONLY.  This RFI is issued solely for information and planning purposes – it does not constitute a Request for Proposal (RFP) or a promise to issue an RFP in the future.  This request for information does not commit the Government to contract for any supply or service whatsoever.  Further, NGA is not seeking proposals at this time and will not accept unsolicited proposals.  Respondents are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this RFI - all costs associated with responding to this RFI will be solely at the interested party’s expense.  Not responding to this RFI does not preclude participation in any future RFP, if one is issued. 

1.      Background

NGA has a need for independent FSA and FISMA evaluation services.

2.1       Planned Acquisition: Services as described in attached Draft Statement of Work (SOW).

2.2       Performance:

2.2.1    Period of Performance (POP): 1 Jan 2028 – 31 Dec 2032.

2.2.2    Location(s): NGA Washington (Springfield, Virginia), NGA St. Louis (St. Louis, Missouri), NGA Arnold (Arnold, Missouri) and other sites as required and approved by the COR.

2.3       Security Requirements: The anticipated security requirements are detailed in Appendix C of the Draft SOW. Offerors will be required to hold Top-secret Facility Clearance and personnel performing classified work will be required to possess Top Secret/SCI with Counterintelligence Polygraph.

1.     Requested Information

Responses must contain UNCLASSIFIED information only and be marked “UNCLASSIFIED” at least on the first page of the response. No classified information may be included anywhere in the response.

Neither proprietary or classified concepts, nor classified information should be included in the submittal. Information contained in the responses may be solicited, and reviewed by NGA non-Government consultants / experts who are bound by appropriate non-disclosure agreements.

3.1       ADMINISTRATIVE

Information to include the following as a minimum:

3.1.1.         Name, mailing address, overnight delivery address (if different from mailing address), phone number, fax number, company website, and e-mail of designated point(s) of contact.

3.1.2.         Business Type: based upon NAICS code 541211 Office of Certified Public Accountants

The respondent is to provide answers to the following questions:

To be considered for a Small Business set-aside, at least 50 % of the cost of contract performance incurred for personnel shall be expended for employees of the respondent.

RESPONSE

Are you a Small Business?  If so, which type:

□ YES                □ NO

Small Disadvantaged small business?

□ YES                □ NO

Service Disabled small business? (FAR 19.14)

□ YES                □ NO

8(a) small disadvantaged small business? (FAR 19.8)

□ YES                □ NO

HUBZone small business? (FAR 19.13)

□ YES                □ NO

Woman-Owned Small Business? (FAR 19.15)

□ YES                □ NO

Involved in a mentor and/or protégé program?

□ YES                □ NO

3.1.3          DUNS Number:

3.1.4          Commercial and Government Entity (CAGE) Code:

Defense Security Service TOP SECRET facility security clearance?

3.1.5          DCAA or other certified cost accounting system?

                  Details:

                  Time keeping system?

                  Details:

3.1.6          Do you have a GSA Federal Supply Schedule (FSS) contract vehicle applicable to the NAICS code(s) identified above?  If yes, provide the contract number.

3.1.7          Is there a Governmentwide Acquisition Contract (GWAC) that would be suitable for this requirement?

3.1.8          Are you aware of FAR Clause 52.219-14, Limitation of Subcontracting?

3.1.9          Are you interested as a prime or subcontractor?  If you answer yes as a subcontractor, if there was a piece carved-out for small businesses or an opportunity to be a designated small business prime instead of a subcontract, would you be interested in the designated Prime opportunity?

3.1.10        What portion of the work could be set-aside for small businesses?

3.1.11        Can two or more small businesses through teaming or Joint Venture, etc. perform the work? If so, what portion of the work could be set-aside for small businesses?

3.1.12        Would you submit a proposal for this requirement if released?

3.1.13        Is there another suggested NAICS code? If yes, please provide rationale along with the recommended NAICS code.

3.2       EXPERIENCE –

3.2.1          Provide relevant details on the respondent providing FSA and/or FISMA audit or evaluation services to other Federal Government agencies in the last five (5) years. Relevant details should include, but not be limited to, the agency and contract number; period of performance; whether performed as a prime or subcontractor; contract type, pricing structure; full time equivalents (FTEs) provided; the qualifications of the personnel performing the services; security details; and the specific nature of the services provided and how it demonstrates the respondent’s abilities and capacity to meet NGA’s requirements.

3.3       CAPABILITIES – Provide responses to the following related to the respondent’s capability to meet the proposed acquisition set forth in section 2 of this RFI including the Draft SOW.

3.3.1          Describe the respondent’s current service capabilities, including specific skills, experience, tools, software, and any best practices. Detail any service capabilities the respondent currently does not possess to support the Draft SOW and whether additional hiring or teaming arrangement is expected. Response should include whether the respondent is capable of conducting the FSA, FISMA evaluation, or both.

3.3.2          Describe the respondent’s current security capabilities and plans, including the availability of appropriately cleared personnel with the necessary skills and experience beginning at contract award and throughout the POP.

3.3.3          Is the respondent aware of any potential Organizational Conflicts of Interest (OCI) or independence issues related to current or recent work at NGA?

3.4       RECOMMENDATIONS/FEEDBACK – The respondent is invited to provide specific feedback on the Draft SOW, if appropriate. (Comments using track changes in the Draft SOW document are acceptable and do not count against the page limit. The Government may or may not post responses to comments, however, all will be reviewed and considered). Other recommendation areas may include anticipated contract terms & conditions, variations in delivery schedule, price and/or cost proposal support, data requirements, contract pricing, and any other areas that the respondent believes is relevant for the Government to achieve its stated objectives.

4.0       Responses

4.1       Responses shall be in Microsoft Office/Word or compatible format and shall not exceed 10 pages (excluding any comments/track changes made in the Draft SOW). A page is defined as each face of an 8½” x 11” sheet with information contained within a one-inch margin on all sides.  Font type shall be Times New Roman 12 point.

4.2       Responses are due no later than 5:00 pm ET on 31 July 2026.  Responses shall be limited to and submitted via e-mail only as a message attachment to and with the message subject line “RFI Response: HM0476-26-FSA/FISMA”.

4.3       Proprietary information, if any, should be minimized and MUST BE CLEARLY MARKED.  To aid the Government, please segregate proprietary information.  Please be advised that all submissions become Government property and will not be returned.

5.0       Meetings and Discussions - The Government representatives may or may not choose to meet with potential RFI respondents. Such meetings and discussions would only be intended to get further clarification of potential capability.

6.0       Questions – Respondents are encouraged to submit a response to this RFI and incorporate any questions they have for a potential solicitation utilizing section 3.1.12. However, if potential offerors have questions regarding the RFI that impact their decision to submit a response to this RFI, please submit your questions by noon (ET) on 24 July 2026. Please note that the Government cannot guarantee a response to your question before the submission deadline of 31 July, 2026. However, the Government will be sure to address these questions if a solicitation is issued.Questions regarding this RFI should be submitted in writing by e-mail to Camille Garcia (ann.c.gracia.ctr@nga.mil) and Alexis Patillo (alexis.b.patillo@nga.mil). If Questions and Responses are posted they will be posted on System for Award Management (SAM.gov) for all interested vendors.

7.0       Summary

This RFI is only intended for the Government to identify sources that can provide the needed services to fulfill the Government’s requirement.  The information provided in this RFI is subject to change and is not binding to the Government. The Government has not made a commitment to procure any of the RFI requirements discussed, and release of this RFI should not be construed as such a commitment or as authorization to incur cost for which reimbursement would be required or sought. All submissions become Government property and will not be returned.