System Controls Audit Support Services

GSA Schedule Holder This Request for Information (RFI) has been posted on www.fbo.gov The U.S. Government Accountability Office (GAO), is conducting market research. This RFI is being used to determine the availability and capability of a GSA Schedule Holder that can provide information system (IS) controls audit support services related to the audit of the Schedule of Federal Debt for fiscal year 2011 with option years 2012 - 2015. The independent contractor will work with GAO to determine the nature, timing, and extent of testing to be performed based on the risk assessment. At the Bureau of the Public Debt (BPD) and certain Federal Reserve Banks (FRB), GAO requires a risk based approach to testing IS controls. GAO requires testing of the (1) IS controls identified by the GAO financial audit team as significant to the audit of the Schedule of Federal Debt, (2) the relevant business application controls in the application in which the IS controls operate that could impact the effectiveness of the IS controls, and (3) the general controls related to the systems in which the application operates and other critical control points in the systems or networks that could impact the effectiveness of the IS controls. In addition, GAO also requires testing of the (1) specific controls identified by the GAO financial audit team in the applications, (2) review the testing performed by the Treasury Office of Inspector General's (OIG) contractor of the IS controls identified by the GAO financial audit team, and (3) follow-up on prior year deficiencies. The independent contractor will have to undertake out-of-town travel to Parkersburg, WV and various locations for the FRBs. IS controls audit support services will be performed in compliance with GAO's financial audit methodology as set forth in the GAO/PCIE Financial Audit Manual (FAM) and with the GAO Federal Information System Controls Audit Manual (FISCAM). It should use the criteria in Office of Management and Budget (OMB) and National Institute of Standards and Technology (NIST) requirements, including specifically the standards referred to in NIST Special Publication 800-53 (SP 800-53), Recommended Security Controls for Federal Information Systems. The FAM provides a framework for performing federal financial statement audits in accordance with Generally Accepted Government Auditing Standards (GAGAS). In conjunction with the FAM guidance, the FISCAM provides a methodology for performing information system control audits in accordance with GAGAS. NIST is responsible for developing standards and guidelines, including minimum requirements, for providing adequate information security for all agency operations and assets. NIST SP 800-53 provides specific guidelines for selecting and specifying security controls for information systems supporting the executive agencies of the federal government. RFI may be used as a basis for a future solicitation and/or as a basis for more in-depth research about an organization's capability. GAO anticipates the award of a time and material price contract for this support. Capability packages must not exceed 10 pages. The capability package for this RFI is not expected to be a proposal, but rather statements and descriptions about the company's existing experience (and past performance) in the area of IS controls audit support services related to the audit of the Schedule of Federal Debt. Areas where a contractor does not have prior experience should be noted as such. If planning to team or subcontract, identify firm(s) and identify task(s) to be performed by subcontractor. In addition, please identify the SIN for your GSA Schedule contract and provide documentation as to how this requirement is within the scope of that SIN. NOTE: The government will not pay for the provision of any information nor will it compensate any respondents for providing this information. THIS NOTICE IS NOT A REQUEST FOR PROPOSAL AND IN NO WAY OBLIGATES THE GOVERNMENT TO AWARD ANY CONTRACT. GAO WILL NOT BE RESPONSIBLE FOR ANY COSTS INCURRED IN RESPONDING TO THIS ANNOUNCEMENT. The deadline for submitting capability statements (electronically) is November 3, 2010 by 12 pm EST via email to Larry Gooding at goodingl@gao.gov.