Army Financial Management Proposal Compliance Gap Analysis

Acquisition vehicle / process

CSO procedures under DFARS 212.70; FAR Part 12 FFP contract(s); up to 3 phases (Solution Brief, Pitch, Proposal)

States submission is a Solution Brief response to FM&C_26_01 under AOS W9128Z-25-S-A002; includes ROM (FFP) and required sections (a)-(h)

Aligned on instrument type and Phase 1 intent

Submission deadline

13 APR 2026 1100 EDT; late submissions not evaluated

Submission Date listed as 13 April 2026 (no time)

Potential ambiguity: does not assert compliance with 1100 EDT receipt requirement

Submission method

Email to KO/CS POCs; no external links considered

States ‘without reliance on external links’ but does not state emailed to specified addresses

Add explicit statement of submission method/addresses used

Reseller preference

Resellers not desired; Gov interested in original provider; intermediaries must justify added value

States Meridian Arc is original developer and sole owner; no reseller dependencies

Strong alignment; supports evaluation preference

Scope focus

Integrate programming-budget-execution data; workflows; traceability; unified layer; no new systems

Positions as decision/workflow layer not replacing GFEBS/STANFINS/CFEMS etc.

Aligned framing to problem statement

Decision modeling & scenario analysis (UFR if-then)

Tools for if-then planning; UFR impacts/trade-offs

Scenario modeling with if-then branches tied to UFRs/offsets; side-by-side comparisons

Covered

Advanced visualization/dashboards

Leadership dashboards/visibility

Role-tailored dashboards; drill-down; leadership overviews

Covered

Predictive analytics

Forecast budget/execution trends

States predictive analytics can be enabled; transparent model reporting

Covered (high-level)

Automated alerts/notifications

Critical events/threshold alerts

Configurable alerts for obligation targets, variance, SLAs, funds control failures

Covered

Automated workflow routing/approvals

Automation replacing manual processes

Configurable workflow engine, routing by thresholds/attributes, validations

Covered

Congressional marks integration automated processing

Integrate marks from external systems with automated processing

Mentions Congressional marks ingestion workflow; milestone 4 includes it; lacks external source specifics

Partially Covered

Manage phase-out/sunset programs

Capability to manage phase-out activities and sunset programs

Not mentioned

Gap

Audit trail & compliance reporting

Audit trail and compliance reporting features

Strong audit logging/traceability; mentions compliance reporting and forensics; not explicit compliance report outputs

Partially Covered

Intuitive UI minimal training

Intuitive UI requiring minimal training

Claims streamlined UI and guided forms reducing training burden

Covered (asserted)

RBAC & customizable views

Role-based controls and customizable views

RBAC, role-based interfaces/views, entitlements

Covered

Mobile accessibility for leadership approvals

Mobile access for review/approval

Responsive web design; mobile-optimized approvals subject to policy

Covered (conditional)

Collaborative features

Cross-functional coordination features

Commenting, annotations, RFI attached to records

Covered

Cybersecurity compliance; desired existing ATO at IL; FedRAMP High/DoD IL5/IL6 desired

Existing ATO at required IL for full capability or core extendable; FedRAMP High or DoD IL5/IL6 highly desired

States FedRAMP High; DoD IL5-aligned deployments for other customers; lacks explicit existing DoD ATO at IL5/6 and authorizing authority details

Partially Covered

(a) Title Page includes all fields

Offeror name, call title, date, POC name/title/email/phone/address, call reference number; if SAM-registered include CAGE/UEI; clearly identify call

Includes Offeror Name, Call title, Project #, AOS #, Submission date, POC name/title/email/phone/address, CAGE, UEI; clearly references call

Fully Met

(b) Executive Summary (1 page limit)

Provide exec summary of offeror and solution

Provides solution and approach summary; describes platform and implementation overview

Fully Met (content)

(c)(i) Unique technical aspects, relevance, innovation; address problem statement & required attributes

Explain unique aspects; relevance; innovation/capability; highlight how addresses problem and required attributes

Detailed sections: integration, governance, trace ledger, workflows, modules, scalability, auditability

Fully Met

(c)(ii) Capabilities, scalability, benefits; feasible/achievable technical approach; team expertise

Describe capabilities/benefits; feasibility; team expertise and experience

Provides scalability to 5,000 users/39 locations; phased approach; team composition (domain/data/security/product)

Fully Met

(c)(iii)(a) Current authorization status (Impact Level & authorizing authority), FedRAMP/DoD PA

Identify existing ATOs (Impact Level & authorizing authority), FedRAMP authorizations, DoD Provisional Authorizations

States ‘FedRAMP High authorization’ and ‘DoD IL5-aligned architecture’ for other customers; does not clearly specify Impact Level for any existing ATO in DoD environment nor name an authorizing authority for DoD; for FedRAMP mentions AO documented in repository but does not name AO

Partially Met

(c)(iii)(b) Authorization timeline w/ major milestones

Provide realistic timeline and approach for achieving Army ATO incl. milestones (controls, docs, assessment, decision)

Provides detailed 30-day workshop; month 3 draft SSP/ICD; month 6 readiness review; month 9 assessment; month 12 authorization decision support

Fully Met

(c)(iv) Pilot vs development; identify TRL; path to maturity if developmental/adapted

Indicate pilot/demonstration of existing tech vs development; identify TRL; discuss maturity path if needed

States existing commercial solution; TRL 9; configuration not development; demonstrations within 6/12 months

Fully Met

(d) ROM (1 page) with breakout; milestone-tied; assumptions

ROM must breakout pricing; tie to milestones; annotate assumptions

Provides total $18.9M and 5 milestones with $ amounts; assumptions stated

Fully Met

(d) Notional schedule (1 page) with major tasks/milestones; assumptions

Provide project schedule; annotate assumptions

Provides month 0-12 task breakdown; two demos by month 6 and full by month 12; assumptions included

Fully Met

(e) IP statement/disclosures w restrictions; DFARS 252.227-7017(d) may be used

Identify IP and restrictions on Gov use

Provides commercial software at private expense; license rights; config artifacts unlimited rights (with caveats); commits to DFARS assertion table in Phase 3

Fully Met (though strengthen with explicit 7017(d) table now if possible)

(f) Non-Gov Advisor NDAs only as applicable; provide copies if executed

Include NDAs if applicable

States none identified; will coordinate if later; no NDAs attached

Fully Met

(g) OCI analysis and mitigation (as applicable)

Perform OCI analysis; describe methodology; if conflicts provide mitigation plan; if none provide affirming statement

Provides FAR 9.5-based methodology and ‘no actual/potential OCIs’ statement; monitoring process described

Fully Met

(h) Change mgmt, training, support

Not explicitly required in 6.1.1 list but referenced to include sections (a-h) in one submission

Provides change impact assessment, comms plan, training formats, tiered support

Fully Met

RA-SIDM-1

Must integrate with/extract/write to as applicable: CPROBE

Explicitly lists CPROBE; baseline ingestion milestone includes CPROBE; mentions writeback where authorized

Partially Met (writeback scope not specific)

RA-SIDM-2

Integrate/extract/write: IRMIS

Lists IRMIS for integration; no specific plan, interface method, or demonstration scope for IRMIS

Partially Met

RA-SIDM-3

Integrate/extract/write: P&R FORMs

Lists P&R FORMs; no specifics on extract/writeback/format handling

Partially Met

RA-SIDM-4

Integrate/extract/write: PMRT/CCAR

Lists PMRT/CCAR; no specifics

Partially Met

RA-SIDM-5

Integrate/extract/write: GFEBS

Explicitly lists; milestone includes GFEBS ingestion; discusses execution/obligations and funds status; writeback ‘where authorized’

Partially Met (needs explicit writeback use-cases or state read-only)

RA-SIDM-6

Integrate/extract/write: STANFINS

Lists; milestone includes one legacy system STANFINS or CFEMS; batch or near-real-time modes

Partially Met (conditional selection; writeback not specified)

RA-SIDM-7

Integrate/extract/write: CFEMS

Lists; milestone includes one legacy system STANFINS or CFEMS; discussed as prioritized

Partially Met

RA-SIDM-8

Integrate/extract/write: ASARS

Lists ASARS ‘where applicable’; no specifics

Partially Met

RA-SIDM-9

Must integrate with additional systems later identified

States can integrate; modular connectors; ‘additional system integrations’ in roadmap

Fully Met

RA-SIDM-10

Must be existing commercial solution; TRL 8+

States mature commercial platform; production deployed; TRL 9

Fully Met

RA-SIDM-11

Must consolidate data into unified analytical environment

States unified analytical environment; ingestion pipelines; governed analytical layer

Fully Met

RA-SIDM-12

Must maintain data integrity and traceability from source systems

Describes lineage tags, source/time/IDs, cryptographic hash; source-to-decision-to-execution traceability

Fully Met

RA-SIDM-13

Must achieve approved Army ATO prior to production deployment

States ATO required prior to production; proposes RMF/ATO approach

Fully Met

RA-FUNC-1

Must enable creation/management of spend plans using programming data

Detailed spend plan creation from programming baselines; 6-month demo track

Fully Met

RA-FUNC-2

Must provide workflow management across programming/budget/execution

Configurable workflow engine across lifecycle; routing rules; approvals

Fully Met

RA-FUNC-3

Must track fund movement and execution at subcommand level

Funds movement ledger; reconciliation to authoritative execution signals; 6-month demo

Fully Met

RA-FUNC-4

Must support funds control module functionality during execution

Describes funds control checkpoints; purpose/time/amount checks; exceptions/waivers

Fully Met

RA-FUNC-5

Must support UFR workflow capability

End-to-end UFR submission/triage/scoring/adjudication; month-12 capability

Fully Met

RA-FUNC-6

Must provide decision codification & traceability throughout lifecycle

Structured decision records (who/what/when/why/data/policy); linked to elements/transactions

Fully Met

RA-MOD-1

Modular architecture allowing selective implementation

Explicit modular platform; selective module deployment; shared core services

Fully Met

RA-MOD-2

Add/modify modules without disrupting core functionality

Versioned APIs; shared metadata; UI composition; does not disrupt core/ATO controls claim

Fully Met

RA-MOD-3

Scalable architecture for future needs

Elastic services; roadmap; config per command; scale beyond 5,000

Fully Met

RA-TD-1

Demo spend plan capability within 6 months of award

States 6-month demos include spend plan creation/management

Fully Met

RA-TD-2

Demo funds tracking/management within 6 months of award

States 6-month demo includes subcommand funds tracking/ledger

Fully Met

RA-TD-3

Demo remainder of functional capabilities within 12 months of award

States full functional demos by 12 months; milestone 4

Fully Met

RA-TD-4

Deployable to Army-wide users at completion of above dates

States ‘Army-wide deployment readiness’ aligned to ATO milestones; deployment readiness contingent on ATO approval

Partially Met (contingency language; clarify what “deployable” means absent ATO)

RA-TRN-1

Role-based training in at least two formats; train-the-trainer; min 60 days post-deployment training support

Commits to instructor-led + self-paced; train-the-trainer; at least 60 days post-deployment training support

Fully Met

RA-TRN-2

Provide user manuals/admin guides/quick reference in Gov-editable formats; updated each release

Commits to Gov-editable docs; user/admin/quick refs; updated each release

Fully Met

RA-TRN-3

Tiered support with defined response times during business hours

States tiered operational support with defined response times during business hours

Fully Met (but lacks explicit SLA numbers)

RA-CM-1

Change impact assessment for user groups/processes/systems

Describes structured change impact assessment and deliverables

Fully Met

RA-CM-2

Stakeholder communication plan and templates

Provides tailorable comms plan with templates and cadence recs

Fully Met

Authorization status specificity

FedRAMP High mentioned, but current authorization status requirement asks to specify Impact Level and authorizing authority for existing ATOs/authorizations; DoD IL5 statement is ‘aligned’ not clearly ‘authorized’; FedRAMP AO not named

Evaluators may judge current authorization status insufficiently substantiated; desired attribute emphasizes existing ATO/IL

High

System-by-system writeback clarity

Requirement says ‘integrate with, extract data from, and write to as applicable’ for named systems; proposal uses conditional language (‘where authorized’) without mapping which systems are read-only vs writeback and what transactions

Could be assessed as incomplete integration commitment; writeback is explicitly required ‘as applicable’ and is often scrutinized for ERPs

Medium

Deployable Army-wide at 6/12-month points

Proposal states deployment readiness contingent on ATO approval; solicitation requires deployable to Army-wide users at completion of dates

If Government interprets ‘deployable’ as operational fielding (not just readiness), conditionality may be viewed as hedging

Medium

Congressional marks integration details

Mentions marks ingestion workflow but no external system/source, data format, validation approach, or automation specifics

Desired attribute; also required module listed in problem statement bullets—weak detail may reduce technical merit score

Medium

Phase-out/sunset program management

No mention of phase-out/sunset programs capability

Explicit desired attribute; omission may reduce desirables scoring

Low-Medium

Tiered support response times not quantified

States ‘defined response times’ but no SLA metrics (e.g., P1/P2)

Not strictly required to quantify, but helps show compliance and maturity

Low

Submission compliance statements (validity, SAM, email delivery)

Solicitation states solution briefs valid 180 days; SAM registration required for award; emailed to specific POCs; proposal does not explicitly confirm 180-day validity nor email submission method

Could be administrative risk; while not always scored, can affect compliance checks

Low-Medium

Add a ‘Current Authorization Status’ sub-table listing: (1) FedRAMP package name; (2) FedRAMP impact (High) and authorizing official name/agency; (3) any DoD ATOs held (system name/boundary), Impact Level (IL4/IL5/IL6), authorizing organization, and whether full capability or core components; (4) scope limitations and inheritance approach

Hosting/Security section + ‘Current Authorization Status’ section

Closes High-risk gap on Section 6.1.1(c)(iii)(a) and Desired cyber authorization attribute

Reduces evaluator uncertainty; strengthens cyber maturity and reuse claims

Provide an ‘Integration & Writeback Matrix’ per required system (CPROBE, IRMIS, P&R FORMs, PMRT/CCAR, GFEBS, STANFINS, CFEMS, ASARS): data domains, interface method (API/file/ETL), frequency (batch/near-real-time), writeback supported Y/N, and example transactions; state assumptions and constraints

Integration section + Appendix-like table inside page limits if possible

Strengthens Required Attribute ‘integrate/extract/write’; mitigates conditional language

Improves compliance readability; supports technical merit and feasibility

Clarify interpretation of ‘deployable Army-wide’ by explicitly stating what will be operationally usable at month 6 and month 12, and what is contingent on Government ATO decision vs contractor delivery (e.g., ‘capability technically deployable; production use upon ATO’)

Schedule/ATO sections

Addresses RA-TD-4 ambiguity

Prevents perceived non-compliance; aligns expectations with RMF realities

Expand Congressional marks ingestion description: identify expected sources (e.g., data feeds, formats), mapping/validation steps, workflow automation, and auditability; include example of mark-to-program/budget impact trace

Functional capabilities / Modular modules section

Improves coverage of desired attribute; strengthens required module bullet in problem statement

Higher technical merit; demonstrates concrete automation

Add a short paragraph on ‘phase-out/sunset program management’ describing how FinWeave represents program lifecycle states, routes approvals, and preserves traceability for sunset decisions

Functional capabilities or desired attributes subsection

Closes explicit desired attribute gap

Improves desirables scoring with minimal text

Quantify support response times (example SLAs) and escalation tiers; indicate coverage hours and how incidents are handled in coordination with RMF/continuous monitoring

Training/Support section

Strengthens Training requirement (tiered support with defined response times)

Signals operational maturity; reduces ambiguity

Add compliance/admin statements: (1) Solution Brief valid for 180 days; (2) Offeror will maintain/obtain SAM registration prior to award; (3) submission method complies (emailed to KO/CS addresses)

Title page footnote or submission cover note

Addresses Section 5/6.1.1 admin instructions risk

Reduces administrative noncompliance concerns