Request for Information (RFI) – Risk Management and Internal Control (RMIC) Support Services

Statement of Work (SOW) / Performance Work Statement (PWS)

To provide comprehensive support to the Defense Intelligence Agency (DIA) for maintaining, testing, and enhancing its Enterprise Risk Management (ERM) and Risk Management and Internal Control (RMIC) program. This support aims to ensure DIA's compliance with relevant DoD and OMB directives, including those related to Internal Control over Reporting (ICOR), Financial Reporting (ICOR-FR), Financial Systems (ICOR-FS), ERM, and payment integrity.

• Provide qualified personnel, methodologies, and management for DIA's RMIC assessment and testing activities across various DIA organizations, including highly classified and compartmented environments.

• Support DIA in conducting periodic risk assessments, identifying key risks, controls, and control owners.

• Develop draft test plans, test scripts, sampling methodology, and test schedules.

• Support the maintenance of DIA's risk profile and risk register, DoD-level enterprise risk profiles, GAO audit recommendation tracking, and top DoD management challenges.

• Perform design and operating effectiveness testing of internal controls across all RMIC domains, adhering to standards like GAO FISCAM and GAO FRM Framework. This includes entity-level controls, service provider controls, and cybersecurity controls.

• Document control gaps, exceptions, and deficiencies, classifying them as material weaknesses (MWs) or significant deficiencies (SDs), and conduct root cause analysis.

• Support the development and refinement of Corrective Action Plans (CAPs) and track their status.

• Assist in the preparation of the annual Statement of Assurance (SOA) and compile supporting documentation.

• Develop and maintain an internal control document library and utilize the Government-designated repository for all workpapers, evidence, logs, and deliverables.

• Establish and maintain a Quality Control (QC) program to ensure performance meets Government-approved methodologies and standards.

• The BPA has a 12-month base period with four (4) 12-month option periods.

• Individual call orders will specify their own Period of Performance within the BPA ordering period.

• Work is to be performed on-site at Government facilities in the National Capital Region (NCR) and/or other DIA locations as specified in the applicable call order. Remote performance is not authorized unless explicitly approved in writing by the Government.

• This is a non-personal services BPA. Contractor personnel shall perform as contractor employees and not be subject to Government supervision or control.

• Contractor personnel must possess and maintain a Top Secret clearance with Sensitive Compartmented Information (SCI) access (TS/SCI) prior to beginning performance. Additional access requirements may be specified at the call-order level.

• Contractor personnel shall use only Government-authorized information systems, networks, and software.

• Contractor personnel shall obtain and maintain appropriate facility access credentials (badges) and comply with all access control requirements.

• Key Personnel required at the BPA level include a Program Manager (PM) and a Risk Management and Internal Control (RMIC) Technical Lead, both requiring Government approval prior to performance.

• Specific qualifications for the PM and RMIC Technical Lead are detailed, including education, years of experience, and certifications.

Request for Information (RFI)

This RFI is a market research tool used by the Virginia Contracting Activity (VaCA) to gather information for a potential upcoming acquisition of Risk Management and Internal Control (RMIC) Support Services for the Defense Intelligence Agency (DIA). The government is seeking to understand industry capabilities for providing enterprise-wide ERM and RMIC support in highly classified environments. This RFI is not a solicitation, and no contract will be awarded based on responses. Responses will help shape acquisition strategy, refine technical requirements, and evaluate small business opportunities.

The RFI seeks information on contractor capabilities and experience in:

• Supporting DoD ERM and RMIC programs in accordance with DoDI 5010.40, OMB Circular A-123, and GAO Green Book.
• Supporting Supply Chain Risk Management (SCRM) programs.
• Supporting Fraud Risk Management (FRM) activities.
• Applying various standards and guidance (DoDI 5010.40, OMB Circular A-123, GAO Green Book, etc.).
• Developing and maintaining risk profiles and risk registers.
• Supporting DoD governance bodies.
• Utilizing ServiceNow's Integrated Risk Management (IRM) solution.
• Performing on-site work in TS/SCI environments.

VaCA expects to award a multi-year Blanket Purchase Agreement (BPA) to one or more sources. A draft Performance Work Statement (PWS) is provided as Attachment 1 and may be updated based on RFI feedback.

Respondents are requested to provide concise information addressing specific areas outlined in Section 5 of the RFI. The response due date is June 30, 2026, at 4:00 p.m. EST. Submissions should be emailed and limited to 15 pages, excluding attachments. Questions should be submitted by a specified date to the POC listed.

Small and large businesses are encouraged to respond. Specific questions regarding company size and socioeconomic status are requested.

• Performance is expected to require on-site work at DIA facilities and access to classified systems.
• Respondents should address their ability to support TS/SCI-cleared staffing and facility access.
• The government assumes no financial responsibility for costs incurred in responding to this RFI.
• Not responding does not preclude participation in any future solicitation.