R -- Privacy Program and Systems Review

SUBJECT:Request for Information (RFI) for a Privacy Program and Systems Review DESCRIPTION: GSA is looking for companies with a proven track record of performing the following tasks: (A) a review of the agency's technology, practices and procedures with regard to the collection, use, sharing, disclosure, transfer and storage of information in identifiable form;** (B) a review of the agency's stated privacy and data protection procedures with regard to the collection, use, sharing, disclosure, transfer, and security of personal information in identifiable form relating to agency employees and the public; (C) a detailed analysis of agency intranet, network and Websites for privacy vulnerabilities, including-- (i) non-compliance with stated practices, procedures and policies; and (ii) risks for inadvertent release of information in an identifiable form from the website of the agency; and (D) a review of agency compliance with the Act (Public Law 108-447, section 522). **identifiable form is consistent with Public Law 107-347, the E-Government Act of 2002, and means any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means. Section 522, (d), of the Consolidated Appropriations Act of 2005, states that at least every 2 years, each agency will perform an independent review of the agency's privacy program, procedures, and systems to A)ensure the agency's description of the use of information in an identifiable form is accurate and accounts for the agency's current technology and its processing of information in an identifiable form; B)measure actual privacy and data protection practices against the agency's recorded privacy and data protection procedures; C)ensure compliance and consistency with both online and offline stated privacy and data protection policies; and D)provide agencies with ongoing awareness and recommendations regarding privacy and data protection procedures. The Act tasks the Inspector General to utilize contractor support through a recognized leader in privacy consulting, privacy technology, data collection and data use management, and global privacy issues to perform this review. If your business has performed privacy reviews that are similar the description listed above, please provide the following in your response: 1. Estimated price range for this work, 2. Ballpark estimate of the time it would take to perform this type of review, and 3. What type of information, other than a copy of the agency policy and procedures and system Privacy Impact Assessments (PIAs), you would need to perform this work. The work will take place in the Washington, DC metro area and we estimate the following types and numbers of systems will need to be reviewed: Personnel - 2 Procurement - 2 Product/Service Sales - 3 LAN - 1 Interested parties should comment within 15 calendar days from posted date. The Government plans to issue the RFP and award a firm fixed priced contract by August of FY2006. Only electronic responses will be accepted. SAMPLE RESPONSE OUTLINE The following is a suggested outline for a response to this RFI. This outline is intended to minimize the effort of the respondent and structure the responses for ease of analysis by the government. Nevertheless, respondents are free to develop their response as they see fit. Section 1 - General Vendor Information and Corporate Expertise 1. General Vendor Information: 1.1. Name of Vendor 1.2. Company Address 1.3. City, State, Zip Code 1.4. Vendor Representative/Contact/Phone Number 1.5. RFI # 1.6. Date of submission 2. Corporate Expertise 2.1. Briefly describe your company, your products and services, history, ownership, financial information, and other information deemed relevant. 2.2. Describe any projects your company completed that are conceptually similar to this RFI including the following information: - How the project was similar and different - Management and Operations approach - Duration of Project - Risks of Project - Relevant Lessons Learned 2.3. Include any comments on the structure of the requirements for a formal RFP response. Section 2 - Solution Specific Questions 1. Have you performed a review of a privacy program in a government agency? If so, what laws, OMB guidance, best practices, etc. did you apply? 2. For the systems review portion of the task: a.Would you employ any type of tools to test how privacy data is vulnerable? b. If you employ any type of tools to test how privacy data is vulnerable, would you use more than one tool? c. If you employ any type of tools to test how privacy data is vulnerable, what platforms, operating systems, and/or programming languages does the tool work with? 3. What information and documentation would you need the Government to provide to you at the start of the contract to help make this an expedient effort? Section 3 - Additional Materials Please provide any other materials, suggestions, and discussion deemed appropriate. QUESTIONS Please submit any questions you have, in writing, to the Point of Contact listed in the Contact Information section. Disclaimer: This notice is for informational purposes only and does not constitute a solicitation or Request for Proposal/Request for Quote. This notice is not to be construed as a commitment by the Government to contract for services. Please be advised that the Government will not pay for any information provided as a result of this notice and will not recognize or reimburse any cost associated with any RFI submission. The vendor should identify any proprietary information in their RFI responses. Proprietary materials will neither be distributed nor discussed with any other vendor. The use of information submitted to the Government as a result of this RFI will be at the discretion of the Government. The Government will not provide comments to any vendor's submission. However, responses to the information submitted may be reflected in the final Statement of Work. CONTACT INFORMATION The following is the Point of Contact (POC) for this RFI Daryl Hawkins Please submit responses via e-mail in Microsoft Office format by 5:00 PM on May 30, 2006, to the POC at: Daryl.Hawkins@gsa.gov. You may also submit supplemental hardcopy materials such as brochures, etc. (5 copies each) to the POC. Copies should be sent to the attention of Mr. Daryl Hawkins at 1800 F Street, N.W., Room G-33, Washington, Dc 20405.