LSC_OIG_RFP_for_LSC_Grantees_IT_Vulnerability_Scans-_FINAL.pdf

Request for Proposals For

LSC Grantees Information Technology Vulnerability Scans

September 8th 2015

Office of Inspector General Legal Services Corporation

3333 K St, NW Washington, D.C. 20007

Inquiries should be directed to:

Mrs. Magali Khalkho Director of Management Operations mk@oig.lsc.gov mailto:mk@oig.lsc.gov

TABLE OF CONTENTS

Page

1. Purpose

2. Background

3. Scope

4. Objectives

5. Contractor Qualifications

6. Place of Performance

7. Option years

8. Timeline, Performance, and Deliverables

9. Inquiries

10. Proposals

11. Confidentiality

12. Instructions to Prospective Offerors

13. Proposal Evaluation

14. Review Process

15. Certifications

APPENDIX A. Contractor Travel Reimbursement Policy

1. Purpose

With this Request for Proposal (RFP), the Office of Inspector General (OIG) seeks to select an Information Technology (IT) consulting firm to perform security scans of selected LSC grantees’ IT systems under a fixed price contract with two option years. As a quasi-federal non-profit entity that funds legal services to low-income individuals throughout the United States, LSC qualifies for GSA, non-profit, and charitable rates. This Request for Proposal (RFP) is not subject to the Federal Acquisition Regulation (FAR).

2. Background

The Legal Services Corporation (LSC) is the single largest funder of civil legal aid for low-income Americans in the nation. Established in 1974, LSC operates as an independent 501(c)(3) nonprofit corporation that promotes equal access to justice and provides grants for high-quality civil legal assistance to low-income Americans. LSC distributes more than 94 percent of its total funding to 134 independent nonprofit legal aid programs with nearly 800 offices spread across the USA and its territories.

The LSC Office of Inspector General (OIG) operates under the Inspector General

Act. The OIG has two principal missions: to assist management in identifying ways to promote efficiency and effectiveness in the activities and operations of LSC and its grantees; and to prevent and detect fraud and abuse. Within their different statutory roles, the OIG and Management of LSC share a common commitment to improving the federal legal services program and increasing the availability of legal services to the poor.

3. Scope

Neither the LSC nor its grantees are subject to the Federal Information Security Management Act of 2002 (FISMA), but the Office of Inspector General recognizes the criticality of secure organizational IT systems and the need to provide better security guidance to LSC grantees. LSC grantees have been victims of security breaches in recent years and LSC has only provided minimal guidance to them to prevent or alleviate threats or attacks. This project contemplates conducting vulnerability scanning of systems to identify and evaluate risks, potential network vulnerabilities, and security control effectiveness both externally and internally for selected LSC grantees and providing reports detailing results and suggested corrective actions.

Part 1 - Using Nessus vulnerability scanner, the contractor will perform an assessment of external vulnerabilities of the public-facing Internet protocol addresses of the selected grantees in accordance with best practices as promulgated by National Institute of Standards and Technology (NIST). Suggested guidance such as NIST Special

Publication 800-30, revision 1, Guide for Conducting Risk Assessment and any other appropriate guidance in the NIST 800 series will be used to conduct the assessment.

Part 2 - Using an industry standard vulnerability scanner, the contractor will travel to grantee locations to conduct internal vulnerability systems scans in accordance with best practices as promulgated by National Institute of Standards and Technology (NIST).

Suggested guidance such as NIST Special Publication 800-30, revision 1, Guide for Conducting Risk Assessment and any other appropriate guidance in the NIST 800 series will be used to conduct the assessment.

The project requires that the contractor conducts scans at a minimum of 5 and up to

15 grantees (internal and external vulnerabilities scans) in the 1st year of the contract.

A summary report will be issued for each grantee detailing risk findings

(vulnerability, likelihood of risk occurrence, impact severity, and risk level) as well as recommended corrective actions as a result of both the internal and external scans.

The OIG is also requesting a yearly summary report compiling findings for all the grantees that were assessed.

4. Objectives

The objectives of performing the security scans are:

• To determine the general level of the LSC grantee IT systems security and identify vulnerabilities that could subject their systems and data to compromise and/or destruction.

• To determine whether grantees are in compliance with IT security best practices.

• To make recommendations to grantee management and identify minimum security requirements that would reduce or mitigate the identified risks.

5. Contractor Qualifications

The contractor will have in-depth knowledge and experience performing IT security vulnerability assessments and dealing with Information Technology security best practices including standards and guidelines published by the National Institute of Standards and Technology and other relevant sources including but not limited to Federal Government sources.

6. Place of Performance

External scans will be performed from the contractors’ offices and internal scans at grantees locations.

7. Option years

The OIG contemplates entering into a contract with one to two option years for the work described in this RFP. Each option year, if exercised, will include between 5 to 15 grantee’s security scans.

8. Timeline, Performance, and Deliverables

The contractor shall perform the following:

A. Orientation/ Kick-off Meeting

Ten (10) business days after the contract award, the contractor shall meet with the OIG and conduct an orientation briefing. The contractor will introduce key staff and will explain their roles. This meeting will establish the lines of communication between the OIG and the contractor and assure a common understanding of the contract requirements and objectives. The OIG will provide a list of the initial five (5) grantees that will be reviewed under part one (external vulnerability scans of systems) and part two (internal vulnerability scans of systems) of the project as a testing phase.

The orientation meeting will take place at the OIG offices, 3333 K Street NW, Washington DC, 20007 or by phone at a date and time mutually agreed upon by both parties.

B. Work Plan

No more than thirty (30) business days after contract award the contractor will provide a comprehensive work plan describing at a minimum:

• A project plan to conduct the external and internal vulnerability scans of the selected grantees.

• Detailed steps for accomplishing the plan submitted under Section 12.A of this RFP including:

o The methodology and tools used to conduct the scans, access (credentials, IP addresses) and other possible requirements required to perform the work.

o A schedule of milestones for each phase of the assessment.

• A listing and the roles of staff assigned to the assessment.

• Any agreed upon departures from the project plan submitted in response to Section 12.A.

C. Travel

The OIG expects all 5 to 15 assessments to be completed over a twelve-month period according to a specific schedule agreed upon at the time of contracting. The OIG will facilitate the scheduling of site visits by informing each grantee that it has been selected for an IT security assessment. The Contractor will be responsible for making final scheduling arrangements for on-site work and receiving prior approval for travel from the OIG. See Appendix A for Contractor Travel Reimbursement Policy.

D. Project Communication

Throughout the project duration, the contractor shall:

• Provide preliminary schedules of the grantees to be scanned both internally and externally so the OIG can notify the grantee of the upcoming assessment.

• Provide routine updates of schedule of site visits conducted to the OIG project manager so the OIG can notify the grantee of the upcoming assessment and obtain necessary credentials and other information necessary to perform the scans.

• Provide regular progress briefings to the OIG project manager.

• Accommodate questions from the LSC OIG regarding the work performed, accomplishments, any significant identified delays or problems.

E. Deliverables

Individual grantee internal and external scan report:

• Within 10 days of completion of the scans of a grantee (internal and external), the contractor will provide a summary report of both scans describing all findings in a functional narrative for the particular grantee and recommendations for security improvements.

Management Analysis report:

• The contractor will identify, on the basis of all scans performed for the contract year, a functional narrative of the common security issues identified and minimum security requirements that may require the attention of grantees’ and LSC’s management in a summary report. The report will be submitted after the 5 to 15 scans are performed.

9. Inquiries

Inquiries concerning this effort should be directed to Magali Khalkho, at mk@oig.lsc.gov. All inquiries and responses will be e-mailed to all prospective Offerors by the OIG.

10. Proposals

Each Offeror will submit an electronic copy of their proposal to Magali Khalkho at mk@oig.lsc.gov. To be considered, the proposal including certifications must be received no later than 5PM Eastern Time on September 29th, 2015. The OIG reserves the right to consider late proposals or exclude timely proposals from consideration for any reason. The OIG may, at its discretion, extend the respond date and expand the list of eligible firms or publicly post this RFP. All costs incurred in the creation of a proposal are the responsibility of the Offeror. The selection of the successful firm is scheduled to be made by October 26th, 2015. Upon conclusion of final negotiations with the successful firm, all Offerors will be notified electronically of the OIG choice.

11. Confidentiality

The contractor will keep all information which is obtained or otherwise reviewed as a result of the contract, in the strictest confidence. The contractor will acquire no possessory or proprietary interests in such information. All work products under the contract are the property of the OIG. The contractor will not disclose to anyone outside the OIG any information concerning the work under the contract unless prior written approval is obtained from the OIG. The contractor will immediately notify the OIG, in the event that it determines or has reason to suspect a breach of any of these requirements or restrictions, and will provide subsequent written notification as soon as possible.

mailto:mk@oig.lsc.gov

12. Instructions to Prospective Offerors

Proposals should be submitted on the most favorable terms, from both technical and price standpoints, that the Offeror can propose. Each Offeror in its proposal shall, at a minimum, include the following:

A. Project Plan and Approach:

The Offeror shall describe in detail its understanding of the work to be performed, including a plan with milestones, methodology and schedule for performing the vulnerability assessments (both internal and external scans) of grantees’ systems.

B. Prior Experience:

The Offeror shall describe its prior experience performing Information Technology Risk assessments applying NIST standards and guidelines, and other applicable IT security best practices.

The Offeror will list and describe current and/or previous clients served. The Offeror will provide the current name, address, and telephone number of at least three (3) specific references the Offeror has served either currently or in the past three years; preferably those were one or more of the project team members provided the same or similar services as requested herein.

C. Staff Qualifications:

The Offeror shall describe the qualifications, certifications and relevant experience of staff to be assigned to this contract. The Offeror shall submit resumes of staff to be assigned, including descriptions of education, position in the firm, years and types of experience and professional certifications. The proposal shall demonstrate that the proposed staff has knowledge and prior experience with IT security best practices for non-profits and governmental organizations and performing risk assessments of IT systems.

D. Price:

• Base Price:

The Offeror will provide a uniform fixed price per assessment (external and internal scans and individual grantee report) conducted as described in this RFP, excluding travel expenses, a firm fixed price for the final summary report, and the total proposed price for the full scope of the work up to 15 grantees assessments. The OIG intends to have 5 to 15 vulnerability assessments performed under the contract exclusive of options, but if for unforeseen reasons that number should change, the OIG will pay on a per-assessment basis for assessments actually performed. While the OIG intends to enter into a fixed price contract, the Offeror’s price proposal should contain, at a minimum, the estimated number of hours per grantee assessment including planning, on-site and off-site work, and reporting to allow for a full evaluation of the price. The Offeror will also provide number of hours and hourly rates by professional classification. Travel expenses will be paid on a reimbursable basis by the OIG consistent with its policy. Personnel travel time will not be reimbursed under this policy. See Appendix A.

The Offeror is expected to provide a best estimate based on the information provided at this time. The Offeror will also identify any conditions that might increase or reduce the cost of the proposed services. In no event will the OIG pay more for completion of the project than the maximum specified in its contract with the successful Offeror.

• Option Price:

The OIG would prefer to enter into a contract with option years. Recognizing, however, that some Offerors may not be comfortable entering into a contract with two option years, the OIG is willing to consider proposals that include only one option year. The Offeror shall include with its proposal option prices per assessment for each yearly option.

E. Page Limitations:

The proposal (exclusive of appendices) should be no longer than 10 pages.

Resumes may be included in an appendix.

F. Certifications:

The Offeror must sign and include as an appendix to its proposal the enclosed certifications.

All or some portion of the information supplied in the proposal of the winning Offeror will become part of the formal contract.

13. Proposal Evaluation

Evaluation of each proposal will be based on the following criteria. Furthermore, the Office of Inspector General will use a Best Value source selection to select the most advantageous offer.

A. Project Plan and Approach:

The OIG will assess the Offeror's understanding of the work to be performed under the contract, and its proposed project plan to complete the risk assessment.

B. Prior Experience:

The OIG will assess each Offeror’s prior experience conducting IT risk assessment preferably using NIST standards and guidelines, and other applicable IT security best practices.

C. Staff Qualifications:

The OIG will evaluate the qualifications of the staff to be assigned to the assessment. This will be determined from the proposal and resumes submitted. The evaluation criteria will include: education, position in the firm, years and types of experience, continuing professional education and certifications and applicability of prior projects.

D. Price:

• Base Price

The OIG will assess the fixed price per assessment and the total proposed price for which the Offeror proposes to perform the work.

• Option Price

The OIG will assess the firm fixed price per assessment that the Offeror proposes for option years to the contract. At a minimum, this assessment will consider value to the OIG, the number of option years proposed, and the impact the option year proposal would have on the OIG’s administration of its program.

E. Certifications:

Certifications must be signed and included as an attachment to the proposal.

F. References:

After the OIG has made a preliminary determination regarding an Offeror with whom it may contract, it will contact and assess the references of that firm.

14. Review Process The OIG will review all proposals and may decide to narrow the pool of Offerors to those who are the most competitive. The OIG may, at its discretion, request presentations by or meetings with Offerors in that narrowed pool, to clarify or negotiate modifications to the Offerors' proposals. Moreover, the OIG may, at its discretion, engage in a process of negotiated contracting to arrive at the final terms of an agreement, but the OIG reserves the right to make an award without further discussion of the proposals submitted.

Therefore, proposals should be submitted initially on the most favorable terms, from both technical and price standpoints, the Offeror can propose.

15. Certifications

A. The individual signing certifies that he/she is authorized to contract on behalf of the Offeror and to make these Certifications.

B. The individual signing certifies on behalf of the Offeror that the prices quoted in this proposal have been arrived at independently, without consultation, communication, or agreement with other Offerors for the purpose of restricting competition or price fixing.

C. The individual signing certifies on behalf of the Offeror that he/she has read and understands all of the information in this Request for Proposal and appendices and that his/her proposal reflects the truth based upon their understanding of these documents.

D. The individual signing certifies on behalf of the Offeror that the Offeror will not subcontract any portion of the work without advance approval of the OIG.

E. The individual signing certifies on behalf of the Offeror that the Offeror, including any individuals to be assigned to the project, does not have a record of substandard work and has not been debarred or suspended from doing work with any Federal, state or local government.

F. The individual signing certifies on behalf of the Offeror that the Offeror is an Equal

Opportunity Employer and does not discriminate in hiring, employment or activities because of race, color, religion, sex, age, national origin, disability, or any other basis prohibited by law.

Dated: ________________________________

Offeror's Firm Name: ____________________________________________

Signature of Offeror's Representative: ___________________________________

Printed Name and Title of Individual Signing: ____________________________________

APPENDIX A. Contractor Travel Reimbursement Policy

Contractor Travel Reimbursement Policy

I. Purpose

This policy governs the OIG’s reimbursement of travel costs incurred by OIG contractors.

II. Reimbursable Travel Expenses

When a contract calls for reimbursement of travel expenses, the OIG will reimburse (1) the cost of airplane tickets or other appropriate mode of transportation and (2) the cost of necessary lodging, provided the costs claimed by the contractor are reasonable. In such cases, the OIG will also pay (3) a per diem payment for each traveler as determined below. The OIG will not reimburse other travel costs except as described below.

To be reimbursable, travel expenses must be reasonable and necessary to complete the work contemplated by the contract. The expenses must represent the lowest available rates for accommodations of the sort ordinarily used in the contractor’s field of business. The OIG will not reimburse travel costs when the location of the work to be performed under the contract is within 50 miles of the contractor’s offices and/or the traveler’s place of residence. If personal and business travel are combined, the traveler and/or contractor is responsible for any additional transportation cost; LSC will only reimburse the cost of business travel.

A. Mode of Transportation

Travel is to be completed by means of transportation most beneficial to the OIG and the traveller considering cost, time, and other pertinent factors. Travel by common carrier is presumed to be the most advantageous method of transportation and must be used when reasonably available. The OIG will not pay for first class or business class travel unless it is documented that no other options are available. The OIG will reimburse baggage fees based on the requirements of the carrier. Rental cars expenses must be pre-approved. The OIG will not reimburse for rental car insurance other than that minimally required by law or for expenses arising out of any damage to a rental car. If a personal automobile is used, reimbursement for mileage will be available at the IRS established rate, currently 51 cents per mile. See http://www.irs.gov.

The cost of buses, streetcars, subways and taxicabs incurred in connection with out-of-town travel are reimbursable provided they are reasonable as defined in this policy.

The OIG will not reimburse taxi expenses to and from restaurants. If a personal automobile is reasonably used as transportation to and from an airport or the terminal http://www.irs.gov/ of origin, the OIG will reimburse parking costs. The total reimbursement for mileage to and from that airport or terminal and parking is limited to the cost of the same travel by taxi.

B. Lodging

Lodging expenses are reimbursable when reasonable and incurred in connection with out-of-town travel. While the contractor may not be eligible for GSA rates, the OIG will use those rates as one factor when evaluating the reasonableness of lodging expenses.

Lodging expenses may exceed the GSA rate and still be deemed reasonable.

C. Per Diem

The OIG will reimburse meals at a per diem rate as specified in Chapter 5, Part III.D of

LSC’s Administrative Manual. Per diem rates are available on the GSA website at http://www.gsa.gov/portal/content/101518.

D. Other Allowable Expenses

For purposes of this policy, the term “other allowable expenses” shall refer to baggage fees, reasonable and necessary taxi fees, mileage to and from a principal mode of transportation, airport or terminal parking fees, reasonable internet connectivity at a place of lodging to the extent that other access is not available, and similar items, as limited by other sections of this policy.

E. Non-Reimbursable Expenses

Expenses that will not be reimbursed include the following:

(1) Alcoholic beverages and entertainment;

(2) Laundry, dry cleaning, and pressing;

(3) Travel insurance;

(4) Parking fines;

(5) Charges incurred because of indirect travel for personal reasons;

(6) Gratuities and tips paid to potters, waiters, bellboys, and hotel maids inside the lodging facility;

(7) Nonproductive time related to official travel to and from one’s out-of-town destination;

(8) Any charges, fees, or other associated costs related to the making of reservations or other accommodations for travel; and

(9) Similar expenses.

http://www.gsa.gov/portal/content/101518

III. Authorization of Travel

Excepting emergency situations and expenses qualifying as “other allowable expenses,” the OIG will only pay travel costs that are preapproved. The contractor will submit proposed travel costs using the attached Travel Request Form at least three weeks in advance of travel to the

Administrative Manager1. If the proposed costs are reasonable and consistent with this policy, the Administrative Manager will forward the Travel Request Form to the Project Manager with a recommendation for approval. To the extent he or she agrees with the recommendation, the

Project Manager will sign the Travel Request Form. The Project Manager’s signature indicates approval. Once signed, a copy will be forwarded to the contractor via email by the

Administrative Manager. Other allowable expenses, defined in Section II.D of this policy, need not be submitted for preapproval provided they are reasonable.

When the field work under an OIG contract necessitates changes in preapproved travel plans, the contractor shall inform the Administrative Manager of the changes as soon as possible. If the change occurs before scheduled travel, the contractor shall submit updated approval requests. Emergency travel expenses, defined to include unforeseeable travel costs that arise in the course of business travel, will be reimbursed if they are reasonable and consistent with this policy. In such emergencies, the contractor will submit details of the change and a justification by email to the Administrative Manager at the earliest date possible.

Official travel by independent contractors of the OIG outside the contiguous 48 states of the

United States must be approved in advance by the Inspector General.

IV. Submission and Payment of Travel Expense

The contractor will submit a Travel Expense Report for each instance of travel to the

Administrative Manager with supporting documentation, including receipts for transportation, lodging, and fees associated with Other Reimbursable Expenses. It is recommended that the traveller keep a record of all expenditures to be used in the expense report. The contractor will specify the number of full and partial days of travel for each traveller. All Travel Expense

Reports must be signed and returned within 15 days of the conclusion of the travel.

Travel Expense Reports will be reviewed by the Administrative Manager. Where the OIG determines that the full claim is not adequately supported or reimbursable, it will communicate its determination to the contractor as soon as possible and allow the contractor to provide additional documentation. Any corrected Travel Expense Report must be returned for processing within 10 days.

The Administrative Manager will determine which expenses are allowable (based on the contractor’s submitted Expense Report form and supporting documentation) and indicate his or

Should the needs of a particular contractor dictate that it gives shorter notice; the OIG will be amenable to establishing a shorter deadline on a per-contract basis.

her determination on a copy of the contractor’s reimbursement form. The Project Manager will then review the submission, indicate approval or disapproval by notation and signature, and, if approved, forward the package to the Comptroller of LSC for payment. The OIG has the final authority to determine whether claims are reimbursable under this policy.

V. GSA Rates

The OIG is not entitled to use the GSA rates for airplane tickets where those tickets will be used by contractors or other persons not employed by LSC.

VI. Applicability of LSC’s Travel Policy

To the maximum extent possible, the OIG will interpret consistent with the LSC Travel policy contained in Chapter 5 of LSC’s Administrative Manual. Use of LSC’s travel Policy as an interpretive guide is not, however, intended to establish an employer employee relationship between the OIG and a traveler employed by or working at the direction of a contractor.

Travel Request Form

FROM: (Contractor Name) _____________________________________

(Contractor Address) ____________________________________

PROJECT: _________________________________________________

AUTHORIZING OFFICIAL: _____________________________________

AUTHORIZING SIGNATURE: ___________________________________ DATE: ________________

TRAVELER NAME: ___________________________________________

PURPOSE OF TRAVEL: _____________________________________________________________________

Dates of Travel

Departure City & State

Arrival City & State

Departure Time

Carrier & Flight/Train #

Fare Other Fees

Approval (Initialize)

Total: $ $

Total Fares and Fees: $ _______

Booking Agent: _______________

Fare & Fees Confirmed Through (Date):

Optional

Name and Locations of Hotel No. of Nights Cost Per Night

Total Per Trip $ _______

Rates Confirmed Through (Date):

Optional

Rental Car Company City & State No. of Days Vehicle Type Total Cost

Total: $ _______

Rates Confirmed Through (Date):

Optional

Other Requirements: _______

LEGAL SERVICES CORPORATION

TRAVEL EXPENSE REPORT

TRA\/ELER'S NAME: •SEND REIMBURSEMENT TO:l-----------------1

GRANTEE#:

OEPTCODE#:

TRIP PURPOSE:

STARTDATE:r--1

ENO OATE:c=J

•TELEPHONE:!-----------------~

EMAIL(NON-LSC EMPLOYEES):L--------- -------.-J

·sTART LOCATION:f----------~

'DESTINATION:.__-----------'

(PART Al REIMBURSABLE EXPENSES: , 2

DATE DETAIL OF EXPENSES (Code) TRANSPORT M&IE

TOTAL REIMBURSABLE EXPENSES $0.00 $0.00

(PART BJ VISA BILLING (LSC Card Only)•

TOTAL LSC CREDIT CARD EXPENSES $0.00 $0.00

{PART Cl DIRECT BILLING EXPENSES:

TOTAL DIRECT BILLED EXPENSES $0.00 $0.00

EXPLAHAllON FOR UNUSUAL EXPENSES:

(PART Cl SIGNATURES AND SUMMARY I CERTFY TMAT THIS EXPENS!: REPORT IS TRUE A.HD CORRECT TO THf Bf.ST OF MY KNOWLEOGe.

TRAVELER'S SIGNATURE DATE

APPROVING SIGNATURE DATE

LSC-8509 REVISED 06110

3 4 5

LODGING TAXES OTHER TOTALS

$0.00 $0.00 $0.00 $0.00 $0.00 $0.00 $0.00 $0.00 $0.00 $0.00 $0.00 $0.00 $0.00 $0.00 $0.00 $0.00 $0.00 $0.00

$0.00 $0.00 $0.00 $0.00

$0.00 $0.00 $0.00 $0.00 $0.00

$0.00 $0.00 $0.00 $0.00

$0.00 $0.00 $0.00 $0.00 $0.00

$0.00 $0.00 $0.00 $0.00

TRAVEL EXPENSE (Parts A & C) $0.00

LESS CREDIT CARD EXPENS~Part B) $0.00 LESS DIRECT BILLED EXPENSE (Part C) $0.00

SUBTOTAL DUE TRAVELER $0.00

LESS TRAVEL ADVANCE $0.00

TOTAL DUE TRAVELERl(LSC)" $0.00 lntarnal Approvals: _..:.:ln..:.:il::;;ia::.:l::.s ---=D=-at=e'---

Travel Coordinatorl

• Required Field Accounts Payable Coordinatort------1-----1

Accounting SupervlsorL.. _ __ __. ____ .-J •• If the amount due travel Is negative please attach a check with this report.

Per Diem Locator WebsKe»>» http"/lwww,gsa.gov/portal/category/100120

EXPENSES:

Code

1 MIL

1 AIR

1 TIF

BAG

TRN

CAR

PRK

GAS

CAB

MIE

LOG

TAX

CA

SKF

INF

Descriotion

MILEAGE

AIRFARE

TICKET FEES

BAGGAGE FEES

TRAIN

CAR RENTAL

PARKING

GASOLINE

CAB FARE W/ TIP

MEALS & INCIDENTALS

LODGING

TAXES

CASH ADVANCE

BANK FEES

INTERNET FEES

DEPARTMENTS:

Code Description 1010 Board of Directors 1110 Executive Office 1210 Le<ial Affairs 1310 Gov't Relations 1411 Financial Services 1412 Human Resources 1611 Program Perfonnance 1512 Information Manaaement 1613 Compliance 1610 Comptroller 1810 Information Technology 3130 Inspector Genera I

2124/2011

ADMINISTRATIVE MANUAL

CHAPTERS

BUSINESS TRAVEL

PART III-SUBSISTENCE AND OTHER EXPENSES, EXCLUDING

TRANSPORTATION EXPENSES

D. AUTHORIZED MEAL REIMBURSEMENTS

Except as provided, reimbursement for meals is based on the GSA Per Diem guidelines for standard meal allowances. However, if an individual is on travel status for part of a day, either on the day of departure or day of return to the traveler's home or office, the standard meal allowance is pro-rated as follows:

M&IE ALLOWANCE

When travel is: Your allowance is:

Less than 12 hours* Reimbursement up to $30 l upon presentation of receipts More than 12 hours less than 24 hours* 75 percent of the applicable

M&IE

24 hours or more The day of 75 percent of the applicable on departure M&IE

Full days of travel 100 percent of the applicable

M&IE

The last day of 75 percent of the applicable travel M&IE

*No meal reimbursement will be provided within the Washington, DC Metro Area, except by approval of the Chief Administrative Officer.

Anytime a meal is furnished to a traveler by a host or hotel, it is the traveler's responsibility to reduce the daily per diem following the table below, which is based on the GSA reductions and which is updated annually by GSA:

5 - 8

M&IE $39 $44 $49 $54 $59 $64

Breakfast. ..................... 7 8 9 10 11 12 Lunch ......................... 11 12 13 15 16 18 Dinner . . .......... . ........... 18 21 24 26 29 31 Incidentals ... . . ...... . ... .. .. 3 3 3 3 3 3

There is no meal allowance when all three meals are provided; however, the incidentals for each day will be reimbursed.

When traveling between cities while on official travel, the per diem is paid based on where the traveler spends the night. Daily itemization of meal expenses is not required when the requested reimbursement is based on the per diem.

Per Diem rates change October 1 each year and are seasonal in some areas. Refer to http://www.gsa.gov under Travel Resources to check Per Diem Rates for the current per diem and for an up-to-date breakdown of the meal offset when meals are provided by a host; refer to www.gsa.gov/mie.

The Comptroller is authorized to waive the maximum meal rate when circumstances indicate that additional allowances are necessary and appropriate for the conduct of LSC business. A waiver of the maximum meal rate must be requested in advance of travel. The Comptroller will return a copy of the approved request or an explanation of the denial. Failure to obtain the requisite approval will result in the traveler being reimbursed at the established per diem rate. When authorization is approved to have meals reimbursed on an actual basis for one day or multiple days while on a trip, itemization of meal expenses and receipts are required.

For the Office of the Inspector General (OIG) staff, the Inspector General is the authorizing authority for waivers.

5-9