Inactive

The purpose of this modification is to provide the follow Qs&As pertaining the Compliance Integration Planning and Preparation (A2.0) PWS: 1. On page 19 of the PWS, it states: "The Contractor shall be... The purpose of this modification is to provide the follow Qs&As pertaining the Compliance Integration Planning and Preparation (A2.0) PWS: 1. On page 19 of the PWS, it states: "The Contractor shall be an American Institute of Certified Public Accountants (AICPA) and in good standing with the Public Company Accounting Oversight Board (PCAOB) in order to insure appropriate technical knowledge and provide the required expertise, staff support, and other resources necessary to assist ISRM with meeting requirements defined in section 5." The sentence is a bit confusingly worded, can you explain what the AICPA and PCAOB requirements mean in the context of this project? Is this saying that we as prime contractors must be CPAs, or employ CPAs as Key Personnel? The prime contractor and/or its subcontractor shall provide CPAs in support of this effort. In order to evaluate the level of compliance from an IT security perspective using auditing standards used under FMFIA, staff will need to be CPAs with experience in these types of audit environments. PWS Section 4.4, Key Personnel, will be updated to included CPAs. 2. What is the relevance of the American Institute of Certified Public Accountants (AICPA) to this scope of work? The project requires the integration of compliance capabilities already in place across VA and prepares VA to address RMF strategies during assessments. The internal Cybersecurity Risk Management (CRM) team in the Information Security Risk Management (ISRM) office conducts assessments at VA facilities and on VA systems to understand the audit worthiness of a site. These assessments are used to understand the level of compliance under both under FISMA standards and under the Federal Managers Financial Integrity Act (FMFIA) or as part of the financial statement audit. In order to evaluate the level of compliance from an IT security perspective using auditing standards used under FMFIA, staff will need to be CPAs with experience in these types of audit environments. 3. Option Task Three specifies that it may be exercised up to three times in the base and two times in each option period, but Option Tasks One and Two don't specify how many times they will be exercised. How many times will Option Tasks One and Two be exercised? Optional Tasks One and Two may be exercised once per period of performance.