Policy and Procedure Management System

1. Introduction

The Court Services and Offender Supervision Agency (CSOSA or “the Agency”) is conducting market research in accordance with FAR Part 10 to identify potential sources capable of providing a Policy and Procedure (P&P) Management System.  CSOSA is seeking to acquire a Policy and Procedure Management system. This system will serve as the agency’s single source of management for all directives and guidance documents. It will help ensure that policies are consistent, up to date, and easily accessible across the Agency.

This Sources Sought Notice is issued for informational and planning purposes only and does not constitute a solicitation. Responses will not be considered as proposals or offers.

2. Purpose

The purpose of this notice is to:

• Identify capable vendors that can meet the Agency’s requirements
• Determine the availability of small businesses and socioeconomic categories
• Assess industry capabilities and commercial solutions
• Support acquisition planning and strategy development

3. Requirement Overview

CSOSA seeks a commercially available solution to serve as the Agency’s single authoritative system for managing all policies, procedures, directives, and guidance documents.

The system must enable:

• Centralized policy management
• Standardization and consistency of directives
• Enterprise-wide accessibility
• Compliance, auditability, and reporting

4. General System Requirements

4.1 IT Security & Architecture

The system shall:

• Be FedRAMP authorized or support SaaS and on-premises deployment models
• Align with Microsoft Azure / Entra ID
• Support PIV / Single Sign-On (SSO)
• Provide role-based access control (RBAC)
• Support data portability and migration

4.2 Administrative & Functional Capabilities

The system shall provide:

• Advanced workflow automation, including parallel and conditional routing
• Automated policy lifecycle management
• Compliant archiving with immutable, read-only history
• Workflow assignment based on document type or template selection
• Employee collaboration capabilities (e.g., discussion boards)
• Policy attestation and knowledge check functionality
• Reporting and dashboards at:
  • Workflow stage level
  • Individual user level
  • Program office level
• Full audit trail of system activity
• Integration capability with Microsoft Office 365 and related tools such as FS Pro
• User-friendly interface (UI/UX)
• Closed-domain AI capabilities for:
  • Intelligent search
  • Identification of inconsistencies or missing content
• Minimal IT dependency post-implementation

5. Policy and Procedure Management Lifecycle Requirements

The system shall support a four-stage Policy and Procedure (P&P) lifecycle, which is timeline-driven and includes flexible workflows based on document type and review requirements.

Lifecycle Stages

1. Development (S.1)
2. Review (S.2)
3. Approval (S.3)
4. Maintenance (S.4)

The system must support:

• Multiple workflow variations
• Substage-level timelines and task dependencies
• Full or abbreviated review processes

5.1 Development (S.1) Requirements

The system shall:

• Support template creation or import
• Automatically assign workflows based on document type/template
• Provide role-based permissions (author, collaborator, etc.)
• Manage substage-specific timelines
• Allow:
  • Suspension or extension of substages
  • Reassignment of authors and collaborators
• Provide automated notifications based on substage timelines
• Require completion of tasks to transition to Review (S.2)

5.2 Review (S.2) Requirements

The system shall:

• Support substage-specific workflows with timeline and/or task completion requirements
• Allow multiple workflow variations with differing timelines
• Enable:
  • Assignment of individuals or groups per substage
  • Addition or removal of reviewers
  • Removal of substages when applicable
• Provide role-based task access
• Support automated notifications
• Accommodate multiple formal review tracks
• Require completion of tasks to transition to Approval (S.3)

5.3 Approval (S.3) Requirements

The system shall:

• Provide automated notification to designated signatories
• Notify authors upon approval
• Require final approval prior to publication

5.4 Maintenance (S.4) Requirements

The system shall:

• Generate automated notifications based on recertification/review due dates
• Allow document owners to review and update policies
• Support approval of updated documents with revised effective dates

6. Vendor Response Requirements

Interested vendors shall submit a capability statement (not to exceed 10 pages) that includes:

1. Company Information
   • Company name, address, UEI, and CAGE code
   • Business size and socioeconomic status
2. Technical Capability
   • Description of the proposed solution
   • Alignment with the requirements outlined above
   • Hosting model (cloud, on-premises, hybrid)
3. Relevant Experience
   • Experience providing similar systems
   • Past performance references
4. Security & Compliance
   • FedRAMP status or capability
   • Security approach
5. Integration Capability
   • Experience integrating with Microsoft environments
6. Rough Order of Magnitude (ROM)
   • Estimated pricing structure (licenses, implementation, maintenance)

7. Submission Instructions

• Responses shall be submitted electronically in PDF format. Responding firms shall not provide a generic capabilities statement. Response must describe how your product is aligned with the requirements described in this Sources Sought.

• Maximum length: 10 pages
• Submission deadline: April 23, 2026, at 7:00 PM EDT
• Email: Valerie.wallace@csosa.gov
• Subject Line: Sources Sought – Policy Management System

8. Disclaimer

This Sources Sought Notice is issued solely for information and planning purposes and does not constitute a solicitation. The Government does not intend to award a contract based on responses to this notice and will not reimburse any costs incurred in responding.