R -- Risk Assessment Management Solutions

REQUEST FOR INFORMATION (RFI)RISK ASSESSMENT MANAGEMENT SOLUTIONS (RAMS) BACKGROUND The General Services Administration (GSA) has initiated preliminary activities toward the establishment of a Multiple Award Schedule (MAS) for personal data solutions that assist federal agencies with compliance under the following: - OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information - OMB Memorandum M-07-04, Use of Commercial Credit Monitoring Services Blanket Purchase Agreements (BPA) - OMB Memorandum M-01-05, Guidance on Inter-Agency Sharing of Personal Data ? Protecting Personal Privacy - OMB Memorandum dated September 20, 2006, Recommendations for Identity Theft Related Data Breach Notification - Identity Theft Task Force Memorandum dated September 19, 2006, Identity Theft Related Data Security Breach Notification Guidance - The Privacy Act of 1974 (5 U.S.C. ? 552a) - Health Insurance Portability and Accountability Act of 1996 (P.L. 104-191) - State and local laws regarding the safeguarding of personally identifiable information (PII) and personal health information (PHI) - The E-Government Act of 2002 - The Federal Information Security Management Act of 2002 - OMB Circular A-130, Security of Federal Automated Information Resources - M-03-18 OMB memorandum for Heads of Executive Departments and Agencies - Implementation Guidance for the E-Government Act of 2002 OBJECTIVE GSA is issuing this Request for Information (RFI) in order to gain a better understanding of the commercial practices that govern information security and the safeguarding of personally identifiable information (PII) and protected health information (PHI). INFORMATION SOUGHT GSA has developed a proposed catalog of commercial services that assist agencies in complying with the regulations and laws outlined above (see Background). The following services are intended to focus on total solutions rather than individual disciplines: Credit Monitoring Services: Services include the full range of credit monitoring services, from basic to comprehensive. The tasks involved in credit monitoring services include but are not limited to the following: - Monitoring of all three national credit bureau reports - Monitoring of a single national credit bureau report - Fraud alerts - Monitoring of credit information in order to detect early signs of fraudulent activity and identity theft - Customer care - Identity theft insurance (as allowed by applicable State statutes) - Fraud resolution and assistance for affected individuals - Credit risk assessments - Credit freeze - Social Security Number monitoring - Credit card monitoring Independent Risk Analysis Services: Services include a review of all PII and/or PHI compromised by a data breach for trends and unusual patterns. The circumstances surrounding the breach are investigated to determine whether it appears to be incidental, accidental or targeted. The breached data itself is analyzed to determine if there is any current evidence of organized misuse. The analysis will ultimately provide a determination as to the probability that breached data may be used to harm the individuals whose data has been compromised. The tasks involved in independent risk analysis include but are not limited to the following: - Metadata analysis - Pattern analysis - Risk analysis - Data breach analysis and response - Privacy impact analysis - Statistical analysis - Data structure development - Probability analysis that breached data has been used to cause harm - Determining the level of risk for potential misuse of sensitive information - Certification of opinion regarding misuse of compromised data - Investigation of circumstances surrounding breach - Development of a risk mitigation plan Independent Validation and Verification (IV&V) Services: Services include third party testing critical to the detection and elimination of defects, before users ever experience them. The validation of technologies, programs, and processes for the safeguarding of PII and PHI. The verification component tests technologies, programs, and processes to ensure they work as intended and expected in safeguarding PII and PHI. Creation of compliance privacy policies and safeguarding guidelines and processes, planning and implementation, education on regulatory compliance, risk management, cost/benefit reviews, and the exploration of verification and authentication strategies and technologies for the safeguarding of PII and PHI. Accreditation and Certification Services: Services include assessment of the effectiveness and readiness of critical of technologies, programs, and processes needed to safeguard PII and PHI, evaluation of functions and continuous monitoring that assesses a subset of the management, operational, and technical controls used to safeguard information, baseline analysis and documentation of existing infrastructure, policies, and procedures needed to safeguard PII and PHI, and analysis of vulnerabilities and the metrics to measure risks associated with safeguarding PII and PHI. It also includes the review of current privacy policies and safeguarding guidelines, maintenance and demonstration of compliance, review of regulatory impact on administrative, technical, and physical safeguarding of PII and PHI. Data Breach Analysis Services: Data breach analysis looks across multiple industries to detect patterns of misuse related to a specific data loss. The breached file is continuously monitored over a period of weeks, months, or years. Data breach analysis can distinguish misuse resulting from a breach from misuse due to other reasons. It can provide the locations of potential misuse for further law enforcement action. It can also provide a listing of consumers likely to be fraud victims. RFI INSTRUCTIONS Responses shall include the company name, physical address, email address of a designated vendor representative, applicable NACIS codes, and answers to the following questions: 1. What are the specific capabilities needed to provide the proposed commercial services? How are these proposed requirements currently being met by industry? 2. Do the proposed descriptions accurately capture the scope of these PII and PHI related services? If not, how should they be changed? 3. Please specify applicable laws, statutory requirements, and professional standards concerning the outlined commercial services. 4. Are there relevant complementary services that should be incorporated into existing proposed services or included as separate offerings within this proposed MAS? 5. What are the commercial pricing practices for these services? Are the proposed services normally performed under Fixed Price (FFP/FPIF), Time and Materials (T&M), Cost type (CPFF/CPIF/CPAF), or a combination of these pricing structures? 6. Are there any proposed service areas that should be considered for a total set-aside designation? 7. Are there specific limitations applicable to providing the outlined commercial services to federal agencies? 8. Would you be willing to participate in future market research efforts, e.g. focus groups, industry forums, etc.? 9. What is the annual sales volume your company has generated for each proposed service? POINT OF CONTACT Vendors shall submit the above information via email, not later than 9:00 AM, Eastern Standard Time, Thursday, November 15, 2007. Responses shall not exceed eight (8) single-sided, Times New Roman 12-pitch font, double-spaced pages. Responses shall be submitted to Lidet Makonnen at Lidet.Makonnen@gsa.gov and Stephanie Cooke at Stephanie.Cooke@gsa.gov. PUBLIC RECORDS AND REQUESTS FOR CONFIDENTIALITY Any document submitted that contains confidential information must be marked on the outside as containing confidential information, and each page upon which confidential information appears must be marked as containing confidential information. The confidential information must be clearly identifiable to the reader wherever it appears. COPYRIGHTS By submitting a response, the vendor agrees that the government may copy the response for purposes of facilitation of review or to respond to requests for public records. The vendor represents that such copying will not violate any copyrights in the materials submitted. CONTENT OF RESPONSES Responses should be based on the material contained in this RFI and any other relevant information the vendor thinks is appropriate. Responses will not be returned. COST TO VENDORS The government is not responsible for any costs incurred by a vendor that are related to the preparation of a response to this RFI. NO OBLIGATION TO ISSUE REQUEST FOR PROPOSAL (RFP) The issuance of this RFI does not obligate the government in any way to issue an RFP for the services described in this RFI. This RFI is for informational purposes only.