CIVIL WORKS BUSINESS INTELLIGENCE RISK MANAGEMENT FRAMEWORK CERTIFICATION AND CONTINUOUS MONTIORING

USACE intends to compete this requirement as an 8(a) set-aside under North American Industry Classification System (NAICS) code 541511 (Custom Compute Programming Services). The contract is anticipated to contain a period of performance consisting of one base year plus two one-year option periods. The contract is anticipated to be predominantly firm fixed price with cost reimbursable line items for materials and travel.

Submission requirements: Please submit a capabilities statement in addition to responding to the attached Questionnaire. Submissions should not exceed 15 pages with 12-point font, single spaced, using 1-inch margins. Responses should be submitted in PDF format. Responses should describe the interested party's capabilities to complete the required services detailed below. The Draft Performance Work Statement is included. Oral communications will not be considered. The Questionnaire, table of contents and cover pages are not included in the page count.

Background: The U.S. Army Corps of Engineers (USACE) Institute for Water Resources (IWR) seeks services and support to government staff with preparing technical documentation, completing specific tasks, and conducting continuous monitoring associated with maintaining an Authority to Operate (ATO) on the Department of Defense Information Network (DODIN) through compliance with DoD instruction 8510.01 Risk Management Framework (RMF) for DoD Information Technology[1] for software, systems and platform technology managed by the Civil Works Business Intelligence (CWBI) program.

CWBI is an Automated Information System (AIS) that provides a central location for management and tracking performance of USACE Civil Works (CW) business line activity through an integrated geospatially enabled decision support system. CWBI provides the umbrella structure, support, and guiding procedures to accomplish the migration of systems, applications, and data into a common CW cloud-smart environment. The CWBI environment is aligned with DoD and Army data strategy to make data visible, accessible, understandable, linked, trusted, interoperable, and secure (VAULTIS).

Description of Services: Contractor shall support the CWBI Program Management Office (PMO) in assuring compliance with DoDI 8510.01, preparing technical documentation and completing specific tasks associated with CWBI’s Authority to Operate (ATO), supporting CWBI cloud cybersecurity architecture, and administering change management procedures. The contractor will work closely with the CWBI PMO, USACE CIO/G-6, and others to develop and monitor the necessary documentation of all applications within CWBI.

The contractor will also provide technical information for any necessary meetings with USACE CIO/G-6 and/or Army personnel as CWBI continuously performs RMF steps. There will be several specific deliverables within this contract associated with anticipated documentation and reports connected with CWBI and its components. There are approximately 140 components (including applications and databases) currently identified as part of CWBI.

The contractor will review existing RMF documentation and edit/develop as necessary in partnership with module owners. The assumption in this contract request would be that the documentation for these 140 modules will continue to be maintained and enhanced for future Security Control Assessor – Validator (SCA-V) and/or Continuous Monitoring (ConMon) audits conducted on the CWBI program.

As part of CWBI’s requirement to maintain an ATO, the contractor will assist the CWBI PMO with the implementation of a continuous monitoring strategy, including scanning applications for vulnerabilities, providing guidance on vulnerability remediation, and hardening cloud infrastructure and policies to ensure cybersecurity compliance.

Furthermore, the contractor will be an integral part of CWBI’s change management process, serving as a reviewer and validator of application change requests to ensure compliance with DoD RMF and cybersecurity requirements. See the attached PWS for additional information and the attached Questionnaire.