Active EME Draft Terms and Conditions Sections H and I.docx

Section H – Special Contract Requirements

H.1 Educational Conferences

As a result of this contract, and at no additional cost to the Government, the contractor shall provide up to six slots in any educational conferences it may offer to clients as part of the normal contract cost. This would include the cost of related meals offered as well as education materials provided to all participants as part of the formal conference program. Non-training or non-educational activities offered at the conference including, but not limited to, golf, fishing, tours, entertainment, etc., shall not be included, as PBGC can neither pay for nor may individual employees accept these items in these circumstances. PBGC will pay for its own travel, lodging, per diem, and other subsistence expenses (e.g., if meals are not offered to all attendees as part of the conference) for attendees at such conferences. PBGC will advise the Offeror of its acceptance or declination of such slots offered at educational conferences.

H.2 Research and Services Available to Clients

The contractor shall have or acquire within six months of contract award, an ERISA fidelity bond, with the PBGC as a loss payee, in the minimum amount of $5,000,000 with a maximum deductible of $1,000,000 per claim. The bond shall cover, at a minimum, losses due to dishonest or fraudulent acts by the contractor. Proof of the existence of such a fidelity bond shall be provided to PBGC immediately upon its acquisition and then annually thereafter.

The contractor shall have errors and omissions coverage, and any other fiduciary coverage in the minimum amount of $10,000,000 with a maximum deductible of $1,000,000 per claim. The policy shall cover, at a minimum, losses caused by errors, omissions, or negligent acts of the contractor. Proof of the existence of such a policy shall be provided on an annual basis as part of contract performance.

H.3. Consideration

In the event the contractor is not able to make a timely and satisfactory replacement of personnel, or if the performance of contracted work is affected negatively under any scenario, contractor shall work with the CO to develop an equitable remedy (fair to both parties). Such remedies may include a decrement to a scheduled payment or other innovative method where both parties receive consideration.

Consideration generally requires two elements: 1) something must be given that the law regards as a sufficient legal value for the purpose – either benefit to the seller or a detriment to the buyer, and 2) that benefit or detriment of legal value must be dealt with by the parties as the agreed upon price or exchange for the promise – there must be a bargained-for exchange. The requirement for consideration does not require that what is relied upon for consideration be of equivalent value to the promise; the consideration need only have some value. The Government authority to agree to the terms of equitable remedy rests with the CO. The agreement to the remedy must be executed via bilateral modification and the contracting file must be properly and comprehensively documented.

H.4 Contractor Performance Assessment Reporting Systems (CPARS)

Past performance information is relevant for future source selection purposes. It includes, but is not limited to, contractor’s record of conforming to contract requirements and to standards of good workmanship; contractor’s adherence to contract schedules, including the administrative aspects of performance; contractor’s history of reasonable and cooperative behavior and commitment to customer satisfaction; and generally, contractor’s business-like concern for the interests of the customer.

Interim evaluations may be performed on the contract. FAR 42.1502 (h) can assist with improving contractor’s marginal performance and identifying any major deficiencies.

H.5 Fidelity Bond and Insurance

The contractor shall have or acquire within six months of contract award, an ERISA fidelity bond, with the PBGC as a loss payee, in the minimum amount of $5,000,000 with a maximum deductible of $1,000,000 per claim. The bond shall cover, at a minimum, losses due to dishonest or fraudulent acts by the contractor. Proof of the existence of such a fidelity bond shall be provided to PBGC immediately upon its acquisition and then annually thereafter.

The contractor shall have errors and omissions coverage, and any other fiduciary coverage in the minimum amount of $10,000,000 with a maximum deductible of $1,000,000 per claim. The policy shall cover, at a minimum, losses caused by errors, omissions, or negligent acts of the contractor. Proof of the existence of such a policy shall be provided on an annual basis as part of contract performance.

H.6 Disaster Recovery

The Offeror shall have and maintain a disaster recovery plan, which includes critical business operations, computer systems, and telecommunications. The plan shall be tested and/or updated annually. The Offeror shall provide a copy, or summary thereof, of the annual test results to the PBGC within 30 calendar days of the completion of the test (Section C – Statement of Work, Schedule and Milestone Dates - Deliverable 9). If the plan is revised, a copy, or summary thereof, of the revised plan shall be provided to PBGC within 60 calendar days of the completion (Section C – Statement of Work, Schedule and Milestone Dates - Deliverable 10).

The disaster recovery plan shall include, but not be limited to, the following:

1. Emergency response procedures, including:

a. Step-by step instructions identifying explicit techniques to be used for responding to various emergency situations;

b. Identification of disaster recovery teams; and

c. An organizational chart and list of key personnel responsible for performing the disaster recovery actions as well as the priority of duties and lines of authority.

2. Backup site activation procedures which identify:

a. Backup site location; and

b. Backup site activation processes.

(If the backup site is operated by an organization other than the Offeror, a copy of the Alternative Site Processing Agreement shall be provided to the PBGC within 30 days after being added to the plan or at the same time as the current and/or revised plan whichever is earlier. Backup site activation procedures shall contain a list of key personnel and the recovery team(s) they support.)

3. Primary site recovery procedures, including:

a. Instructions for accomplishing salvage operations;

b. A replacement acquisition strategy for hardware, software, telecommunications, etc.;

c. Facility reconstruction plans; and

d. Identification of personnel supporting the primary site recovery and the team(s) they support.

4. Primary site reactivation/normalization, including:

a. Procedures to ensure a smooth transition from the alternative processing site to the primary site; and

b. A list of teams performing the various functions and the personnel assigned to those teams.

H.7 Operating Constraints

The Offeror shall be responsible for immediate notification to the PBGC of significant changes in personnel, ownership, resources, or firm direction. The Offeror shall discharge its duties under this contract solely in the interest of the PBGC with the care, skill, prudence, and diligence under the circumstances then prevailing that a prudent person acting in like capacity and familiar with such matters would use in the conduct of an enterprise of like character and with like aims. Moreover, the Offeror shall utilize best practices of the investment industry, such practices to include but not limited to the standards issued by the Chartered Financial Analyst (CFA) Institute.

H.8 Risk Management & Transaction Cost Analysis Support

The Offeror shall distribute monthly electronic holding and transaction reports to third party risk management systems providers and T-cost consultants (See Section C – Statement of Work 7.0).

· The reports support the Investment Risk Management System (IRMS). These reports are provided to the IRMS provider.

· Currently PBGC utilizes two Transaction Cost Analysis (TCA) providers, one for Foreign Exchange (FX) and one for equities and fixed income. Offerors must provide quarterly transactions reports to an FX TCA provider. For commingled fund investments, PBGC relies on the Offeror’s reporting for equity TCA but may require reports to a third party TCA provider in the future.

H.9 Organizational Conflict of Interest

If a contractor has performed, is currently performing work, or anticipates performing work that creates or represents an actual or potential OCI, the contractor shall immediately disclose this actual or potential OCI to the PBGC CO in accordance with FAR Subpart 9.5. The nature of the OCI may involve the prime contractor, subcontractors of any tier, or teaming partners.

H.10 Section 508 Compliance Requirements

Unless the Government invokes an exemption, all Electronic and Information Technology (EIT) products and services provided shall fully comply with Section 508 of the Rehabilitation Act of 1973, per the 1998 Amendments, 29 U.S.C. 794d, and the Architectural and Transportation Barriers Compliance Board’s EIT Accessibility Standards at 36 Code of Federal Regulations (CFR) 1194. The contractor shall identify all EIT products and services provided, identify the technical standards applicable to all products and services proposed, and state the degree of compliance with the applicable standards. Additionally, the contractor shall clearly indicate where the information pertaining to Section 508 compliance can be found (e.g., Vendor’s or other exact web page location). The contractor shall ensure that the list is easily accessible by typical users beginning at time of award.

(Remainder of the page intentionally left blank)

Section I – Contract Clauses

I.1 52.209-7002 Handling PBGC Data

The contractor shall administer a monitoring process to ensure compliance with the provisions of this clause and shall notify PBGC within 60 minutes of discovery, in writing, in the event that the contractor determines or has reason to suspect an incident impacting the confidentiality, integrity, or availability of PBGC data.

(1) In such situations, the contractor shall notify the PBGC Service Desk by telephone (202-326-4000, ext. 3999) and, thereafter, the contractor shall immediately e-mail the PBGC Service Desk (desk.service@pbgc.gov) and also shall send a copy of the e-mail message to the COR or to the Point of Contact for an Interagency Agreement, as appropriate.

(2) If the incident involves, or may involve, Sensitive Information, the contractor shall also immediately e-mail the PBGC Privacy Office (Privacy_Breach@pbgc.gov).

(3) The contractor shall designate and identify an individual who will be responsible for the notifications required under this paragraph and who shall be responsible to receive responses from the COR or the PBGC Chief Privacy Officer. Report of an incident, including a breach of PII, by itself, shall not be interpreted as evidence that the contractor or subcontractor failed to provide adequate safeguards for PBGC data.

The contractor shall:

(1) Conduct a full investigation of any security incidents and privacy breaches,

(2) Provide written updates regarding the investigation in accordance with a schedule set by the agency, and

(3) Notify, and provide a copy of the incident or breach report to, the agency, in writing, when the contractor closes the incident/breach.

In addition, the contractor shall provide full access and cooperation, including, but not limited to, inspection, investigation, and forensic analysis, to facilitate an investigation and resolution of any security incidents and privacy breaches and when appropriate to the circumstances, shall implement immediate corrective actions to contain and prevent a recurrence.

The contractor and subcontractor shall maintain the capability to:

(1) Determine what PBGC data was or could have been accessed and by whom;

(2) Construct a timeline of the breach to the extent possible;

(3) Determine the methods and techniques used to access PBGC data; and Identify the initial attack vector, if applicable.

I.2 52.237-7004 Training and 52.237-7005 Information Security Training

The Contractor personnel performing work related to Information Technology (IT) Security shall complete all information security and privacy awareness training every fiscal year within the contract period of performance. CORs shall ensure continual contractor compliance with the Security and Privacy Awareness annual training and requirements. This will include the annual Rules of Behavior acknowledgement requirement. The COR shall coordinate with the Contractor for any additional IT training required to support this contract.

1.0.1.1 Ensure that any subcontractor(s) of outsourced services (e.g. IT infrastructure, print/mail, tax form production, check image storage/retrieval) involving sensitive PBGC data, comply with the IT Security requirements of the Custodian Bank.

1.0.2 Provide an annual Service Organization Controls (SOC) 1 Type 2 Report on Controls at a Service Organization Relevant to User Entities’ Internal Control over Financial Reporting in accordance with Statement on Standards for Attestation Engagements (SSAE) No. 18 and a cover memo including the information specified at section 3.4.2.3 below.

1.0.2.1 If internal controls for Custodian Bank services are covered under different SOC 1 reports within the Custodian Bank’s organization (e.g. different business units), then SOC 1 reports for each business unit handling PBGC data are required.

1.0.2.2 If the Custodian Bank utilizes any sub-service organizations (e.g. subcontractors, joint ventures, etc.) to provide services under this contract, the SOC 1 reports for each sub-service organization that handles PBGC sensitive data (e.g. outsourced IT operations, print/mail vendors, check image vendors, etc.) are required.

1.0.2.3 With each SOC 1 report, include a cover memo summarizing the following key elements of the report.

(a) The Custodian Bank’s external auditor’s assertions as to whether or not:

(i) The controls described by management were designed and implemented for the period of the report,

(ii) The controls are suitably designed to provide reasonable assurance that the control objectives are met if they are operated effectively and the client and sub-service organizations applied the controls contemplated in the design, and the controls tested (together with the client and sub-service organization controls) were those necessary to provide this reasonable assurance.

(iii) Any exceptions/deviations noted by the external auditor, management’s response, and a description of the relevance of the exceptions to PBGC.

(iv) How any scope limitations noted by the auditor relate to PBGC’s requirements under the contract.

(v) Management’s assertions as to whether or not:

(a) The description fairly presents the system made available to PBGC during the period,

(b) The description includes details of changes to the system relevant to PBGC, and

(c) The controls were suitably designed and operated effectively.

(d) Any changes in Complementary User Entity Controls relevant to PBGC since the prior year.

(e) Any changes in sub-service organizations relevant to PBGC since the prior year.

1.0.3 Support PBGC audits and inspections.

1.0.3.1 Audits include, at a minimum:

(a) The annual financial statement audit conducted by PBGC’s Office of the Inspector General (OIG) and/or its contractor,

(b) The annual IT audit conducted by PBGC’s OIG and/or its contractor, and

(c) U.S. Government Accountability Office (“GAO”), U.S. Office of Management and Budget (“OMB”) or other federal agency audits.

1.0.3.2 Respond to written request(s) from PBGC regarding inquiries made by PBGC’s OIG requesting documentation, meetings, interviews, etc. throughout the fiscal year.

1.0.3.2.1 Provide detailed feedback regarding issues that need to be clarified or proposed deadlines that cannot be met no later than the fifth business day after receipt of the Provide by Client (“PBC”) list and by the fifth business day after each subsequent update to the PBC list or by mutually agreed upon alternatives for those dates, and

1.0.3.2.2 Deliver the document, meeting, interview in accordance with the deadlines established within the PBC list.

1.0.3.3 Make knowledgeable Custodian Bank (including subcontractors) personnel available for live and/or telephone interviews and/or videoconferences with auditors on topics clearly articulated by auditors. Provide a brief overview of the topic and answer auditor questions.

1.0.3.4 Review and provide feedback for potential audit findings (Notice of Finding Recommendation – NFR) no later than the third business day following receipt of the potential finding.

Provide support for the PBGC’s third party risk management system by providing data related to the Revolving Fund to the risk system provider in an agreed upon format. The U.S. Bureau of Public Debt is the custodian for the Revolving Funds and a direct electronic feed will not be available. The PBGC will retrieve holdings information from the Bureau of Public Debt and provide it to the contractor for loading into the contractor’s bookkeeping system. The contractor will provide revolving fund holdings information, along with all other pertinent PBGC holdings information, to PBGC’s risk management system provider.

(Remainder of the page intentionally left blank)