Enterprise Risk Management (ERM) Software

Amendment No. 1 is issued to post answers to questions for this RFI. BBG Answers to Questions Received Regarding RFI No. BBG50-RFI-17-00019 ERM Software 1. Can you please provide background and more detail on how BBG currently manages both their ERM processes and reporting? Response: The Agency has not yet established its ERM program. 2. What are the top five challenges within your current ERM program? Response: The main challenge is to achieve overall organizational commitment to begin ERM and for BBG Management to issue authority and direction on how to proceed. 3. What tools are used to manage your current ERM program and implementation? Response: N/A - we have not established ERM 4. What are the desired tools or data sources to integrate with the proposed ERM solution? Will these integrations be one time or ongoing? Response: Our intent is to begin with a basic "one-time" tool to get the program growing and depending on much success and commitment we get, grow it as necessary. 5. What is your current process for assessing risks among your critical IT assets? Response: All "manual" documentation is maintained in a Sharepoint site. 6. What is BBG's risk assessment methodology? How does BBG query business and technology owners to identify potential risks? Response: BBG intends to establish a methodology in compliance with OMB Circular A-123. The software must have embedded ISO 31000 suite, COBIT-5, GTAG and the current FISMA-CSF components. 7. Is incident management a critical component and if so, how is BBG currently managing incidents? Response: BBG has no global incident management system related to ERM. The Footprints application is used to manage local IT help desk issues. 8. Can you please describe the areas of cost reduction that you expect from a fully implemented ERM solution? Response: We hope to use ERM to draw attention to duplication of systems and functions across the different networks of the BBG. 9. How does BBG currently track issues? Response: The BBG does not currently track ERM/Network-wide issues. See question 7 for local issues. 10. Does BBG have centralized risk and control registers? Response: No. 11. Can companies from Outside USA can apply for this? (like,from India or Canada). Response: This is a Request for Information (RFI), and all interested firms may respond; however, companies must be registered in SAM. 12. Would we need to come over there for meetings? Response: This is an RFI, and those who are interested must submit a written response to the questions in the RFI for review by BBG. 13. Can we perform the tasks (related to RFP) outside USA? (like, from India or Canada). Response: There are no tasks to perform. Please see answer to Question No. 12 above. 14. Can we submit the proposals via email? Response: No proposals are required. This is not an RFP. This is an RFI. See answer to Question No. 12 above. // End of Questions and Answers ______________________________________________________________________