Request for Information for OIG Management Information System

GENERAL INFORMATION: This is a Request for Information (RFI). This RFI is not a request for proposals; therefore, responses to this notice will not be considered offers and cannot be accepted by the Government to form a contract. Parties that respond to this RFI are advised that the U.S. Nuclear Regulatory Commission (NRC) will not pay for any information or administrative costs incurred in response to this RFI; all costs associated with responding to this RFI will be solely at the submitting party's expense. Not responding to this RFI does not preclude participation in any future Request for Proposal, if any is issued. If a solicitation is released, it will be synopsized on the Federal Business Opportunities (FedBizOpps) website. It is the responsibility of the potential offerors to monitor these sites for additional information pertaining to this requirement. PURPOSE OF THIS NOTICE: NRC seeks information to determine the commercial availability and technical capabilities of qualified and responsible sources to provide a Commercial-Off-The-Shelf (COTS) solution(s) currently being utilized by any OIG within the US Federal Government for one or more of the Office of the Inspector General (OIG) program areas described in this RFI. Because business requirements of Federal Government Inspectors General are governed by common standards, we are seeking solutions currently used by other OIG offices. The information that NRC gathers from this RFI and related market research is for planning purposes only and may be used to assist the NRC in planning an acquisition strategy if a new acquisition is deemed appropriate by NRC. BACKGROUND: Congress established the NRC OIG through the 1988 amendment to the Inspector General Act of 1978. Established as permanent, independent, nonpartisan, and objective overseers, Inspectors General are tasked with combating waste, fraud, and abuse within the Federal Government and its programs. In 2014 the OIG was also established as the Inspector General for the Defense Nuclear Facilities Safety Board (DNFSB). OIG is conducting market research to identify potential available commercial solutions that it may procure in the future to improve the efficiency and effectiveness of our current on premise commercial solution to support our audit, investigation, and management support program areas. Our current OIG Management Information System (OIGMIS) has been in production since 2004 and utilizes customized COTS applications operating on an IBM Domino 9 platform. OIG will consider on-premise and Software-as-a-Service (SaaS) solution(s) that include an overarching MIS comprised of audit, investigations, and a correspondence and ticketing tracking applications, or individual application(s), i.e., vendors could recommend one or more applications in their response. COMMON REQUIREMENTS: The recommended solution(s) should provide the following capabilities common to all OIG program areas. Ability to store electronic content in a variety of formats, such as documents, images, videos, audio files, etc. Ability to organize and categorize related information (e.g., by audit, allegation, investigation/case, ticket, etc.) Ability to distinguish items by status (e.g., in process vs. issued audits, open vs. closed cases, open vs. closed tickets) and other key elements (e.g., by staff assigned, team, etc.). Ability to assign and re-assign staff to projects and teams. Ability to provide a work queue and notifications to users of work assigned, upcoming and overdue milestones/due dates, etc. Ability to support multiple authors, maintain versions, and collaborate in real-time. Ability to support supervisory review and comment and to lock documents to prevent changes after documents are approved. Ability to support archival of data with functionality to restore archived data. Need capability to report from archived data. Ability to support record retention policy. Digital signatures to document concurrence/approval and capture relevant details, such as user name, date, and time. Robust search capability for searching data elements and attachments. Robust reporting capability that includes standard and ad hoc reports, allows user entered parameters, data export, and facilitates the development of OIG's Semiannual Report to Congress, Annual Performance Report, quarterly performance metrics, and other statistical reports. Role-based dashboards to monitor workload and key performance indicators. Role-based security that allows for easy to establish and manage user access, provides read-only and/or edit access to authorized content, and limits access to Personally Identifiable Information (PII). Ability to correlate and distinguish records associated with NRC and/or DNFSB. Ability to support Freedom of Information Act (FOIA) requests, eDiscovery, and OIG and National Archives and Records Administration (NARA) records management requirements. Ability to configure the application(s) to meet OIG requirements, preferably with limited support from the contractor. Configuration includes defining the data elements, processes, business rules, workflows, notifications, forms, reports, pick lists, and dashboards required by each OIG program area. User access via a thin client, such as a web browser. Ability to provide all necessary technical assistance to support implementation, migrate data, and train users transitioning from the current system to the new product(s). If a hosted solution is recommended: Ability to fully support the new solution(s), including data backup and recovery, patch management, disaster recovery and continuity of operations (COOP). Ability to support users and monitor, track, and resolve issues encountered while they use the system to support their daily operations. Ability to provide FEDRAMP-certified cloud hosting at a moderate impact level, including FIPS 140-2 compliant encryption of data in transit and at rest. Ability to extract all data from off-premise cloud at no additional cost, if applicable. Ability to handle slow or latent connections through VPN or remote connections. Compatible with Windows 10 and higher. Compatible with Microsoft Office 365 products. Compliant with Section 508 of the Rehabilitation Act of 1973 accessibility standards. INVESTIGATION REQUIREMENTS: The OIG investigations program processes approximately 175 allegations and 40 cases per year. There are approximately 20 users of the current applications, NRC Magnum and DNFSB Magnum. The recommended investigations support solution should provide the following minimum capabilities. Ability to log allegations of potential wrong-doing received from the OIG Hotline and other sources and select the appropriate disposition for the allegation, such as refer to management, create an investigative case, and refer to audit. Ability to track key information about allegations and cases, such as subject, alleger name, date received, allegation/case number, source, case type, potential violations, associated strategic goal, associated program office, and associated strategic actions and OIG identified agency management challenges. Ability to automatically assign allegation and case numbers, and determine if the allegation/case is associated with NRC or DNFSB by the number. Ability to assign staff to allegations and cases. Ability to correlate an allegation(s) to a case. Ability to plan, manage, and document all aspects of an allegation or case, such as milestones, case plan, interviews, memos to file, subject profile, management review and approval of associated documents, subpoenas, etc. Ability to restrict access as needed, e.g., to cases presented to a grand jury. Ability to track allegation and case referrals, including referrals to agency management, to other agencies and organizations, and referrals for prosecution. Ability to track administrative, civil, and criminal results of an allegation or case. Ability to identify and track FOIA requests associated with an allegation or case, including maintaining responses. Ability to track and report time and expenses associated with an allegation or case, and Law Enforcement Availability Pay (LEAP) hours worked per bi-weekly pay period. AUDIT REQUIREMENTS: The OIG audit program issues approximately 30 audit reports per year. There are approximately 40 users of the current applications, NRC AutoAudit and DNFSB AutoAudit. The recommended audit support solution should provide the following minimum capabilities. Ability to support risk-based planning, including quantifying risk in the audited area, and the development of an annual audit plan. Ability to track key information about an audit, such as strategic goal, program office, strategic actions, and management challenges. Ability to plan, manage, and document all aspects of an audit, such as audit milestones, electronic workpapers, point-to-point linking of supporting evidence/workpapers to the audit report, and management review and approval of workpapers and other documents. Ability to support and document multiple levels of review, comment, and sign-offs (e.g. preparer, peers, supervisors). Ability to identify changes made after supervisory review. Ability to support independent review and verification of cross-indexed references of all statements of fact in draft and final audit reports, such as visual cues to indicate evidence is supportive, reviewer tools for feedback and sign-off, ability to track progress of independent referencing, ability for audit team to see and respond to reviewer comments, and ability to identify changes to the audit report following the independent review. Ability to distinguish between NRC and DNFSB audits. Ability to track audit findings and recommendations, such as current status, the agency office responsible for the next action, and history of actions taken to close recommendations. Ability to schedule audits and assign staff. Ability to track and report time and expenses associated with an audit. Ability to track audit staff training and progress in meeting Continuing Professional Education (CPE) training requirements. MANAGEMENT SUPPORT REQUIREMENTS: The management support program processes approximately 100 pieces of correspondence per year and from them creates approximately 50 tickets requiring further action. There are approximately 6 users of the current application, the Correspondence Control Log. The recommended Management Support solution should provide the following minimum capabilities: Ability to log and maintain copies of incoming and outgoing OIG correspondence. Ability to track key information about the correspondence, such as addressee name and organization, sender name and organization, correspondence date, received date, and keywords/categories. Ability to create a ticket(s) for further action from correspondence, assign staff, establish due date, etc. Ability to manage and document actions taken on tickets, such as timeliness of actions, whether further action or a response is required, Ability to correlate correspondence to related items (e.g., incoming, outgoing, tickets, responses). Ability to identify correspondence and tickets that are related to performance measures, such as OIG regulatory review activities. QUESTIONS FOR RESPONDENTS: In order for NRC to learn about current marketplace offerings and capabilities, the NRC requests that each response include the following, at a minimum. Please correlate the response to the question number. Business Information Unique Entity Identifier (e.g., DUNS number). Organization name. Organization address. Type of organization with respect to NAICS 541519 (i.e., other than small business, small business, 8(a), woman owned small business, service disabled veteran-owned small business, veteran-owned small business, HUBZone small business, etc. Please also provide that same information with respect to NAICS 423430 and for NAICS 511210. See FAR Subpart 2.101,Definitions, for definition of various types of business entities.). Organization Point of contact, phone and email address for the response to this sources sought notice. The Organization's own GWAC Contract Number(s) (if applicable) (i.e., GSA FSS, NASA SEWP, NITAAC). Solution Capabilities, Hosting, and IT Requirements Does your organization currently sell a hosted, COTS solution that meets some or all of the OIG program area requirements described above? If so, please provide a description of the solution, identifying the OIG program area(s) and common and program area requirement(s) it supports. Please provide commercial and government pricing information, and indicate whether the solution: is available for purchase on one or more GSA Federal Supply Schedule (FSS) contracts and/or Government wide Acquisition Contract(s) (GWAC) (provide contract information), and is available for purchase on an open market basis. If your organization's solution can be run on-premise, please provide the information requested above and also describe the information technology requirements for its operation on-premise. OIG Customers Does your organization currently provide your solution(s) to any Offices of Inspectors General? If so, describe the solutions provided and provide points of contact, including telephone and email addresses of individuals who can verify the capabilities/experience identified in the responses. Did your OIG customers migrate data from an existing application? Customization and Updates Please describe your process for customizing and updating your recommended solution to meet NRC OIG requirements, including initial software configuration, change requests after the system is in production, and associated costs. Also please provide an estimate of how long it might take to customize and implement your recommended solution. Support Services Please describe the support services your company provides to customers, including all associated costs. Also describe the support OIG would be responsible for providing. For example, do you have a hotline for end users to call with questions or should such issues be resolved by or through a central OIG POC? Please identify how often your product is updated and patched and the services you provide to support data migration. Training and Documentation Has your organization developed training materials, user and administrator guides, and/or conducted training courses in conjunction with the implementation of the solution described above? If yes, please explain the products and services provided for end users and OIG administrators, including all associated costs. At this time, NRC is researching the market to find out what is available in the marketplace. Any information vendors can provide will be helpful. SUBMISSION REQUIREMENTS: Interested firms responding to this sources sought must provide a capability statement demonstrating their experience, skills, and capability to fulfill the Government's requirements for the above. The capability statement shall be in sufficient enough detail, but not exceed 20 pages, so that the Government can determine the experience and capability of your firm to perform the requirements specified. HOW TO RESPOND TO THIS REQUEST FOR INFORMATION NOTICE: To submit a response to this RFI, please do so by e-mail to jerry.purcell@nrc.gov, with a courtesy copy to heriberto.colon@nrc.gov by the response date and time specified in this notice. Responses should be submitted in a format that is readable by Office 365 Word or Excel and/or Adobe.pdf format.