In addition, if the FDIC determines contract services are essential in the event of an emergency or business continuity event, the statement of work or statement of objectives must include: Footnote: 6 The APM includes a descriptive list of inherently governmental functions and services and actions that are not inherently governmental functions. This list of inherently governmental functions is derived from the FAR (48 C.F.R. The FDIC requires support across the entire IT application lifecycle including: creation (requirements, design, development, testing, deployment), configuration, integration, migration, enhancement, support, maintenance, operations, decommissioning, and other associated services for all FDIC owned applications, either in use today or deployed Many of the procurement controls contemplated in the OMB Policy Letter exist within the FDICs current acquisition policies and guidance, without the specific designation of critical functions. Under the FDICs Acquisition Policy Manual (APM), certain functions are so essential to the performance of government responsibilities that they may not be outsourced, namely the performance of inherently governmental functions.3 When contracted services fall short of inherently governmental functions but are closely aligned with them, the FDIC is responsible for building in enhanced controls and management oversight in the design and administration of relevant support contracts. | The source did not mention this item. Procured Blue Canopy Services Deemed to Be Critical Functions of the FDIC, 1. PDF FDIC Contracting Awards - Federal Deposit Insurance Corporation The FDIC took prompt action to address the OIGs recommendations regarding the lack of independent assessments of Blue Canopys services, and the OIG closed those recommendations in 2019. The FDICs Chief Financial Officer Organization, Office of Risk Management and Internal Controls guidance titled, Enterprise Risk Management Standard Operating Procedure (May 2020), states that the FDIC currently assesses all risks facing the Agency, including inherent and residual risks, and considers existing control mitigations that reduce inherent risks. The FDIC Risk Inventory acknowledged the risks associated with these cybersecurity and privacy support services, including a potential cyber-attack on the FDICs systems and a security incident involving Personally Identifiable Information. The interactive forecast dashboard statistically predicts when contracts will be signed. Recommendation 8: Identify missing or insufficient controls in the BOAs and task orders for Managed Security Services Provider and Security and Privacy Professional Services, and implement appropriate corrective actions or compensating controls. Wisconsin Department of Employee Trust Funds PO Box 7931 Madison WI 53707-7931 1-877-533-5020 (toll free) Fax 608 -267 4549 Proposed Amendment to FDIC Bank Option Contract February 9, 2021 Page 2 Staff recommends the Board amend the FDIC bank option contract (ETJ0050) as shown to provide an interest rate floor of 15 basis points. This table presents managements response to the recommendations in the report and the status of the recommendations as of the date of report issuance. sharing sensitive information, make sure youre on a federal Therefore, our report correctly concludes that the Blue Canopy contracts provided limited coverage of the contractors obligations and responsibilities similar to those recommended in the FDICs Financial Institution Letter. By May 2021, the FDIC expects to transition information security and privacy program services to multiple service providers by awarding additional task orders under the BOAs. For 2019, Blue Canopy services comprised 38.3 percent ($16.2 million) of the FDICs annual operating expenses for Information Security ($42.3 million). Request for Information on FDIC Official Sign and Advertising 3. Footnote: 9 The OCISOs mission is to develop and maintain Agency-wide information security and privacy programs that support the mission of the FDIC. According to the GSA, the Federal government uses the reported data to measure and assess the impact of Federal procurement on the nations economy, learn how awards are made to businesses in various socioeconomic categories, understand the impact of full and open competition on the acquisition process, and address changes to procurement policy. The services provided under this contract included an annual technical security assessment, vulnerability management, annual Federal Information Security Modernization Act of 2014 (FISMA) self-assessment,13 continuous controls assessment, privacy program (support services),14 security engineering and technical assistance, and internal controls. Ultimately, absent specific policies and procedures on this process, DOD may lack assurance that it retains enough government employees to maintain control over these important functions. vV7fW/EA'%2 )$BxNg\Hs#m$q_Cr-FbU{O`may+r"A1yq0.@]/;~>q!@;0~}=fn` %t(]/ For example, if not managed and supervised prudently, the agency may: Footnote: 1 According to FDIC Directive 1500.6, Continuity of Operations (COOP) Program (November 2019), Essential Functions are a subset of government functions that are determined to be critical activities. The Chief Information Officer Organization (CIOO) recently issued an Acquisition Planning Guide that outlines the contracting process from start to finish for customers in need of IT goods and services, and provides clear and consistent expectations for stakeholders. Anchorage Closes In on FDIC Crypto Custodian Deal, Documents - CoinDesk This ongoing oversight of the Blue Canopy contracts and the reconsideration of the underlying acquisition strategy for the services are key components of the procedures highlighted as best practices by the OIG in its audit and demonstrate the control asserted and maintained by the FDIC over these services. In particular, Federal employees must be able to understand the agencys requirements, formulate alternatives, manage the work product, monitor the contractors used to support the Federal workforce, and adequately mitigate the potential impact on mission performance if contractors were to default on their obligations. The policy letter adopted the definition of an Inherently Governmental Function based on the established statutory definition in the Federal Activities Inventory Reform Act (FAIR Act),15 and it eliminated variations of this definition found in other documents. )% oYki|Wl{)9hg3(EV{Ih`f=aegasg`c$.hY+ R#@P-0to 1P$C@"WWG5mMsW>ne7#dMyrhkJY-~&tMWkZQG--+d7_#VZ {++Ojb~S+yKoBm#%G8@5p>Wwl)Ng=H]5~,SP"q,1sM/e,1@ vD2Hf3u,2G}H7[]f#[x2 NIST S.P. Reviewed the FDICs policy and procedures, including: o FDIC Acquisition Policy Manual (August 2008); o Acquisition Procedures, Guidance and Information (January 2020) document; and. The OIG report, The FDICs Implementation of Enterprise Risk Management (EVAL-20-005) (July 2020), assessed the FDICs implementation of Enterprise Risk Management against relevant criteria and best practices. Previously, we found that the FDIC had hired Blue Canopy to assess the same IT security controls that it had designed and executed. The FDIC did not perform a procurement risk assessment for Critical Functions obtained from Blue Canopy during the procurement planning process. FDIC Total Awards by Socio Economic Categories January 1 -December 31, 2020 $80 $90 $90.0 $70 $58.9 $60 $50.1$20 $30 $40 $50 $45.4 $10 $0 Percent of Total FDIC Awards: $4.5 $8.0 8(a) HubZone $10.8$4.1 Veteran OwnedServiceWomen OwnedSmallMinority OwnedMWOBDisabledDisadvantagedVeteran OwnedBusiness In particular, the FDIC may not ensure that it has an adequate number of employees with the appropriate training, experience, and expertise to oversee the procurements of Critical Functions. The Program Office is responsible for determining its procurement needs and initiating the acquisition process by submitting a procurement request to DOAs ASB. The FDIC is committed to recruiting and retaining the most qualified employees in the labor market, and maintaining diversity in management, employment, and business activities. In 2009 and 2010, the services obtained were overseen by the FDICs Division of Information Technology. Browse our extensive research tools and reports. Recommendation 1: Incorporate the provisions of OMB Policy Letter 11-01 guidance into the FDIC Acquisition Policy Manual (August 2008) and Acquisition Procedures, Guidance and Information document (January 2020). ; Expected Completion Date: June 30, 2022; Monetary Benefits: $0; Resolved-a - Yes or No: No; Open or Closed-b: Closed; Row 9: ; Rec. Managed services and digital transformation company Digital Management, LLC has been awarded a $256 million managed services task order with the Federal Deposit Insurance Corporation. A breach or disruption in these services could impact the security, confidentiality, integrity, and availability of FDIC information. If the FDIC does not manage the risks associated with Critical Functions prudently, it may: Become over-reliant on a third party to achieve its mission and conduct operations; Fail to control the Agencys mission and operations; Create inefficiencies through increased cost and decreased operational effectiveness; Fail to identify and evaluate alternative courses of action; Fail to provide independent judgments and informed oversight; and. Best Practices for Identifying Planned and Procured Critical Functions, 3. history, career opportunities, and more. Upon completion of the corrective actions and before closing the recommendations, we will review the FDICs actions to ensure that the revised acquisition process includes guidance for identifying planned procurements of Critical Functions and implementing heightened contract monitoring for Critical Functions. To report allegations of waste, fraud, abuse, or misconduct regarding FDIC programs, employees, contractors, or contracts, please contact us via our Hotline or call 1-800-964-FDIC. along with its implementing and supplementing document entitled The oversight manager ensures that the contractor delivers the required goods or performs the work according to the contract and the delivery schedule, monitors the expenditure of funds, and approves invoices. Accordingly, institutions should establish and maintain an effective risk management process for initiating and overseeing outsourced operations. 2i/y/v&ki35$PRr#{ GsN7?Zv|R@$"'* OMB Policy Letter 11-01 advises certain agencies that they should ensure that Federal employees perform and/or manage Critical Functions to the extent necessary for the agency to operate effectively and maintain control of its mission and operations. 6) Determine the contract structure during the solicitation and award process for the procurement of a Critical Function. Ultimately, this situation represents an increased operational risk to the FDIC and a potential risk management failure where the risk has not been identified, measured, monitored and reported, and mitigated. FDICs Execution and Oversight of the Blue Canopy Contracts. documentation of laws and regulations, information on Awarded Contract Dollars by Division During Calendar Year 2017. Footnote: 37 A Contract Management Plan is a plan developed by the Contracting Officer and the Oversight Manager that documents the joint administration approach to performing oversight activities for complex contracts for services. However, the FDIC did not make the determination that Blue Canopy provided essential or critical services, even though the Agency dedicated more than 38 percent of its IT security budget to Blue Canopy services. Phase 1: Procurement Planning - Program Office and DOA Acquisition Services Branch report to the FDIC Board the planned acquisition of a Critical Function, and provide a procurement risk assessment and management oversight strategy (including planned contract structure and cost effectiveness analysis). When procuring Critical Functions, agencies considered (or, considered as a best practice) cost effectiveness analysis, which included analyzing the appropriate mix of Federal employees and contractors and rebalancing, as needed. Industry Standard. A lock Examples of Personally Identifiable Information include an individuals full name, Social Security Number, drivers license, medical information, or home telephone number. [Text box - Prior OIG report. Some of the risks are associated with the underlying activity itself, similar to the risk faced by an institution directly conducting the activity. According to the FDICs Financial Institution Letter titled Third-Party Risk Guidance for Managing Third-Party Risk (FIL-44-2008) (June 2008), the key to the effective use of a third party in any capacity is for management to appropriately assess, measure, monitor, and control the risks associated with a contractual relationship. The FDIC has also recently implemented new acquisition initiatives to further improve vendor management, contract oversight, and to reduce the number of non-competitive awards. Procurement Planning - Program Office performs a procurement risk assessment for the planned acquisition of a Critical Function, which includes performing a cost effectiveness analysis. Awarded Contracts 2021 - TargetGov TargetGov It is an independent government corporation created by Congress to maintain stability and public confidence in the nation's banking system. (vYh/G6y:@G*2/) cards. Footnote: 2 GAO reported that [b]est business practices refer to the processes, practices, and systems identified in public and private organizations that performed exceptionally well and are widely recognized as improving an organizations performance and efficiency in specific areas.. Appendix 1 Objectives, Scope, and Methodology, 1. These initiatives focus on awarding competitive, multiple-award basic ordering agreements (BOAs) and smaller, more competitive task orders. sharing sensitive information, make sure youre on a federal Recommendation 12: Report to the Board about the Procurement Risk Assessments, Management Oversight Strategies and contract provisions that address identified risks for planned Critical Functions during the procurement planning phase of the acquisition, for its consideration.
Gary Payton Sons Names,
Dora License Renewal Login,
Kegan Anthony Kline Father,
Articles F