CJIS Audit Tool, Program, and Training

The Transportation Security Administration (TSA) Flight Operations Division, Law Enforcement Information Coordination Section (LEICS) is conducting market research for a Criminal Justice Information Systems (CJIS) auditing tool and training for LEICS Systems personnel. The solution is to assist the CJIS Security Officer (CSO) with establishing an audit program and provide personnel with training on assessing up to seven hundred (700) TSA agencies auditable entries across a thirty (30) month cycle. The entities routinely access CJIS systems for criminal and non-criminal justice purposes. The TSA CSO is issuing this Request for Information (RFI) to procure a CJIS audit tool that aligns with CJIS Security policy and develop an audit program to include training for ICS personnel. LEICS is issuing this Request for Information (RFI) to procure a CJIS audit tool and development of an audit program that's inclusive of training for ICS Systems personnel that will meet the following operational environments and minimum specifications: Audit Program Development and Training Specifications: - Conduct a gap analysis of TSAs current audit processes - Build, perform, and manage multiple CJIS triennial audits from non-criminal justice (NCJA) and criminal justice agencies (CJA) - Provide a customized CJIS audit tools that will assist TSA/LEICS personnel with governing access and detecting user anomalies to CJI data. - Conducts onsite and offsite CJIS Security Audits (in-person or virtually), that are in alignment with the FBI CJIS Security Policy to include Information Technology Security (ITS) Security Audits, NCIC Policy Compliance Reviews, N-DEX Policy Compliance Reviews, Next Generation Identification (NGI) Compliance Review, NCIC Validation, ORI and ORION file validation - Identify out of compliance areas based on pre-audit responses and send automatic alerts/notifications that include policy responses to the entity being audited - Review/analyze information system audit records for indication of inappropriate or unusual activity, investigate suspicious activity or suspected violations, to report findings to appropriate officials, and to take necessary actions - Maintain a log of NCIC and III transactions for a minimum of three (3) years - Provide reports aligned with the requirements of CJIS compliance - Administer audit program for a minimum of three (3) years - Monitor and measure program on an ongoing basis to ensure its objectives are being achieved - Transition audit program to TSA/LEICS at any time upon request with a minimum one-year changeover without any penalties to ensure complete personnel training TSA is interested in the following information: 1. Provide a CJIS audit tool, develop an audit program, and provide training to personnel. Meet all the requirements listed. Submit a thorough description, and limit it to no more than 5 pages. Include a Rough Order of Magnitude (ROM) cost. 2. The timeframe it will take to implement the audit tool, develop an audit program and to provide training. 3. The business size status (small, large) of your company. 4. Existing contract vehicles (GSA MAS, etc.) your company has. 5. Please note: All contractors doing business with the Federal Government must be registered in the System for Award Management (SAM) database. Send your response/capability statement to guy.galloway@tsa.dhs.gov with the subject line - CJIS Audit Tool. For technical questions on the specifications, contact Joy-Ann Eastmond email joy-ann.eastmond@tsa.dhs.gov. This Sources Sought Notice is issued solely for informational and planning purposes only and is not a solicitation. A Government requirement for this requirement may be developed, and a contract may or may not result. This notice does not constitute a commitment by the Government. All information submitted in response to this announcement is voluntary, and the Government will not pay for information requested nor will it compensate any respondent for any cost incurred in developing information provided to the Government. The Government may request additional information as a result of responses received. Contractors are encouraged to provide sufficient detail for the Government to ascertain whether or not the product and services described meet the requirements.