Software Solutions for Documentation and Reporting of Enterprise Risk Management, Enterprise Architecture, and Capital Planning and Investment Control Data

REQUEST FOR INFORMATION SOFTWARE SOLUTIONS FOR DOCUMENTATION AND REPORTING OF ENTERPRISE RISK MANAGEMENT, ENTERPRISE ARCHITECTURE, AND CAPITAL PLANNING AND INVESTMENT CONTROL DATA. BBG50-18-RFI-0039sb THIS IS A REQUEST FOR INFORMATION (RFI) ONLY. This RFI is issued solely for information and planning purposes. It does not constitute a Request for Proposal (RFP) or a promise to issue an RFP in the future. This RFI does not commit the U.S. Government to contract for any supply or service whatsoever. The Broadcasting Board of Governors (BBG) is not at this time seeking proposals and will not accept unsolicited proposals. All, who respond to this RFI, are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this RFI. All costs associated with responding to this RFI will be solely at the Interested Party's expense. Not responding to this RFI does not preclude participation in any future RFP if any is released. The BBG is conducting market research in anticipation of a future requirement. BBG is seeking information to ascertain if there are firms available who are capable of a providing Software Solutions for Documentation and Reporting of Enterprise Risk Management Enterprise Architecture and Capital Planning and Investment Control Data. This RFI is being issued to identify a single, comprehensive, integrated solution that exists today, which can meet Federal documentation and data reporting requirements for Enterprise Risk Management (ERM) program in compliance with OMB Circular A-123, and an Enterprise Architecture (EA) and Capital Planning and Investment Control (CPIC) program in compliance with the Clinger-Cohen Act of 1996, Federal Information Security Modernization Act (FISMA) of , OMB Circulars A-11, and A-130, among others. All responses to this RFI will be reviewed to assess the capabilities for Software Solution for Documentation and Reporting of Enterprise Risk Management, Enterprise Architecture and Capital Planning and Investment Control Data. Those who are interested must demonstrate how they would facilitate BBG's anticipated program comprehensive integrated solution that exists today, which can meet Federal documentation and data reporting requirements for an Enterprise Risk Management (ERM) program in compliance with the Clinger-Cohen Act of 1996, Federal Information Security Modernization Act (FISMA) of 2014, OMB Circulars A-11, and A-130, among others. With regard to ERM, the software must have embedded ISO 31000 suite, COBIT-5, GTAG and the current FISMA 2017 NIST-Cybersecurity Framework (NIST-CSF). CPIC, the software must provide the ability to manage an investment from initial conception through termination. Additionally, the software must serve as a single data collection point, report to OMB, and serve as a repository for CPIC information. EA, the software must have data modeling and visualization capabilities to illustrate the relationship between the various domains of EA, to include but not limited to, business architecture, data/information architecture, applications architecture, technology architecture, and security architecture. The software must also illustrate the relationships between the domains and the agency. Any visuals, including dashboard views, musts be based on empirical data. The empirical data must be retrievable and viewable from the dashboard view so that users can understand EA at a high level, but also have the ability to conduct a deep dive analysis, if required. The preferred software solution will have easily configurable workflows, Active Directory integrated single sign-on, user access controls, approvals, etc. Metadata should be consistent throughout the software suite. Additionally: 1) the solution must have current FedRAMP Certification. 2) the Vendor must have all proprietary rights and agreements and licenses for the solution. The Government will not purchase separate 2nd or 3rd party licenses to use the software. 3) If the solution is Software as a Service (SaaS), any Service Level Agreement (SLA) must contain a current risk assessment of the site and/or sites where Government data will reside and/or to which it will be moved. This includes but is not limited to a risk assessment of geographic area, facility, room power, environment controls/room, pathways/cable installation, fire suppression, physical security, maintenance and cleaning, space planning and requirements, and human capital management and oversight. BBG anticipates an initial requirement for 15 user licenses, with two additional administrative licenses (if applicable to the vendor's software solution). The solution should be predefined and required no customizing coding. If customized coding is required, it should be minimal and included in the price of the solution. The entire solution must provide security that meets Federal Information Processing Standard (FIPS) 140-2. BBG requires a seamless and integrated enterprise solution that is compatible with and runs on Windows Operating Systems. As part of your 5 page response, please complete the following table: Questions Responses PLEASE SEE ATTACHMENT FOR CHART