This is a request for information. The Department of State (DOS) is soliciting information for a commercially available risk management automated decision support software application/system that embodies a rigorous quantitative method for identifying critical risks to the Department of State?s information management systems and data. At a minimum, the system should enable rigorous cost-benefit analysis that facilitates selection of the most cost-effective mitigation options for critical risks. The product should also enable prioritization of risk management actions, optimize data back-up programs and provide documentation of selected options. Ideally, the product should include a reference database of current threats (which is updated frequently), that the Department will use to save time and effort conducting risk analysis projects, ensuring significant threats are not overlooked. The product should require minimal training, and provide a context-sensitive ?Help? file system that will assist State Department personnel in using the product and making technically sound risk management decisions. The product must be capable of operating in a Windows-based computing environment. This notice is for planning purposes only. If satisfactory responses are received, a solicitation may be issued for a firm fixed price type contract. Business firms are invited to submit appropriate documentation, literature, brochures and references that support their possession of the required specialized experiences with the above requirement. Responses shall be submitted to U.S. Department of State, Attn: Ms. Ann Dixon, 301 4th Street, SA-44, Room 767, S. W., Washington, D.C. 20547, or by electronic mail to
[email protected]. (Request that the name of the firm be stated in subject line of e-mail message). Responses must include the following: 1) name and address of firm; (2) size of business; (3) if minority owned, woman owned or Veteran owned; (4) if HUBZone business; (5) technical capability. The Department wishes to research, and review the software applications to determine which will meet all the compliance requirements outlined by OMB and generally follow the guidance set forth in the National Institute of Standards and Technology (NIST) Special Publication 800-30: ?Risk Management Guide for Information Technology Systems.? This synopsis is for information and planning purposes only and is not to be construed as a commitment by the Government. This is not a solicitation announcement nor a Request For Proposal and a contract will not be awarded from this announcement. No reimbursement will be made for any costs associated with providing information in response to this announcement and any follow-up information requests. Respondents will not be notified of the results of any evaluation. It is requested that all information be forwarded No Later Than March 17, 2003.