AVAS Project--Request comments from Industry

In accordance with the Internal Review Directorate Fiscal Year 2009 Work Plan, performance audits were conducted to review compliance with system access control requirements and determine if internal controls surrounding the systems access were adequate to prevent unauthorized access and did they provide for separation of duties between functions. The audit focused primarily on processes and controls over granting and maintaining systems access for a vendor pay system, an accounting system, and a payment/collection system. The results of those audits identified two weaknesses related to (1) ensuring the System Authorization Access Request (SAAR) forms were properly completed before granting system access, and (2) establishing/maintaining effective controls to compensate for the lack of separation of duties for users with update capabilities to multiple systems or excessive access levels. Currently, DD2875 forms for various system accesses are processed manually. In response to the findings referenced above, DFAS has created a draft Statement of Objectives (SOO) that seeks to hire a vendor who possesses a COTS workflow software package, and have the vendor configure their software to solve the material weaknesses identified in the audit reports. What DFAS is seeking in this RFI is Industry's assessment and insight as to whether the draft SOO accomplishes this goal. We ask for Industry to review the draft SOO and understanding what we are attempting to accomplish, provide comments and suggestions on ways to alter, change or improve the SOO.