The United States Department of Justice (USDOJ)/Drug Enforcement Administration (DEA) requires Security and Privacy Assessment & Authorization (SPAA) or Governance, Risk, and Compliance (GRC). This is a Request for Information (RFI). This is not a Request for Proposal (RFP) or Request for Quote (RFQ). This Notice in no way binds the Government to solicit or award a contract. No solicitation exists at this time and proposals are not being requested or accepted with this notice. Responses to this notice are not offers and cannot be accepted by the Government to form a binding contract. The information provided in this notice is subject to change and is not binding on the Government. Responders are advised that the U.S. Government will not pay any cost incurred in response to this RFI and all costs associated with responding will be solely at the interested party's expense. This RFI is being used as a Market Research tool for informational purposes and for preliminary planning purposes to identify potential sources that may possess the expertise, capabilities, and/or experience to perform the anticipated requirements. Interested vendors should respond and affirmatively indicate if requirements can be met as specified on an all or none basis, either individually (by vendor) or through teaming with other vendors. Please provide the following information: 1. Company name; mailing address; physical address; point of contact; telephone number; fax number; e-mail address; DUNS number; NAICS code; company business size (if small, indicate type); and if applicable: GSA Federal Supply Schedule, SIN number, and GSA contract number. 2. A tailored capability statement between one (1) and ten (10) pages that addresses the particulars of the market survey objectives listed and attached. To identify interest from Security and Privacy Assessment & Authorization (SPAA) or Governance, Risk, and Compliance (GRC) Vendors to modernize, streamline, and automate the DEA’s risk management, authorization and assessment, and FISMA monitoring requirements. To identify vendors who understand and comply with federal risk management framework guidelines and implement the ability to assess against NIST 800-53 controls To identify vendors with the ability to provide a proof of concept, test environment, or other capability to assess specific DEA use cases and data within the environment To identify vendors who utilize automation of federal SPAA and GRC requirements Prior Government contract work is not required for submitting a response under this RFI. Responding to this RFI is not a prerequisite for participation in any possible future competitive procurement for which a business is eligible to participate (if any is issued), but participation will assist the Government as to the extent of companies available for this procurement. Failure to respond or submit information in sufficient detail may result in a company not being considered a likely offeror. Respondents are advised that the Government is under no obligation to acknowledge receipt of the information submitted. Respondents will not be notified individually of the results of the Government assessments and should not anticipate feedback with regard to its submission. No proprietary, classified, confidential or sensitive information should be included in your response to this RFI. Responses will not be returned. All documentation shall become the property of the Government. The Government reserves the right to use any information provided by respondents for any purpose deemed necessary and legally appropriate, including using technical information provided by respondents in any resultant solicitation. The Government reserves the right to determine the method of acquisition and issuance of a possible solicitation based on the responses received for this notice. The Government's evaluation of the responses received will factor into the Government's determination whether any forthcoming solicitation will be conducted as unrestricted or sole source procurement. After a review of the responses received, a solicitation will be issued. Responses to this RFI will not be considered adequate responses in any resultant solicitation. Interested sources shall provide responses via email in softcopy form (electronically) in Microsoft Word compatible format on or before 10:00 AM ET (Eastern Time) April 14, 2023 Subject: Security and Privacy Assessment & Authorization (SPAA) to
[email protected]. Responses received after this date and time may not be considered in the Government's market research.