1605TA-24-N-00008.pdf

REQUEST FOR INFORMATION 1605TA-24-N-00008

The U.S. Department of Labor (DOL) is issuing this Request for Information (RFI) in order to obtain industry input on a requirement for the procurement of (1) collection, processing, and dissemination of Government data, (2) support of stakeholders (filers, third-party software, and Government), and (3) management services to support the Office of the Chief Information Officer (OCIO), Business Applications Services (BAS).

Support will be in the following areas:

• Annual Rollover Baseline Changes to operate the system for each processing year and to “rollover” in preparation for succeeding processing year

• Advanced Search Features on filings

• System Maintenance activities such as system patching, system updates, etc.

• Contact Center Operations to respond to calls, emails and web inquiries. Includes Chatbot support and user satisfaction analysis

• Program ISO and Support to maintain designated level of system security compliance

• Program Management to maintain a stable management presence for all contractor work activities

• Quality Assurance to establish and maintain a software quality program through all phases of the system development life cycle

• Quality Control to provide an independent quality control unit to measure and report on all performance standards defined in the contract

• Software and License Agreements necessary to support the EFAST2 solution

• Travel, as needed, to support training and Third-Party Developer Conference activities

• Internet Filing Acceptance Service (IFAS) to operate and maintain a high-performance, high-availability, and fully automated service for use by Third Party software

• Performance Monitoring of all system components

• Web Content Management to support a workflow for approved content changes

• Change Management using DevSecOps methodologies

• Third Party Developer Conference to plan and communicate EFAST2 changes

• Non-recurring Rollover Changes to support legislative changes

The anticipated North American Industry Classification System (NAICS) code for this requirement is 541512, Computer Systems Design Services.

The work to be performed under this contract action will be performed at the contractor’s facilities or remotely.

Regardless of location, Contractor employees must employ appropriate safeguards and comply with any and all applicable DOL and Federal polices, specification/requirements, and procedures related to Personally Identifiable Information (PII), security, network, data, and communications.

INSTRUCTIONS TO RESPONDENTS

• Review the Performance Work Statement (PWS).

• Submit your response within the designated response time of this RFI.

• Responses should include the following information:

1. Please detail your organization’s experience in managing and maintaining a forms processing application like EFAST 2 with minimal failures and with annual requirements changes (updates to data elements and validation checks). (provide URL as appropriate)

2. Please provide detailed experience in developing and managing applications similar to EFAST 2 with technologies such as Java, JSF, Angular, IBM IIB, IBM DataPower & Oracle RDS in AWS cloud and handling and securing PII and Federal Tax Information data.

3. Please detail your organization’s experience with the annual forms development lifecycle and its relation to annual system changes, validation changes and requirements implementation for applications like

EFAST2.

4. Please provide detailed experience of developing, interpreting, and maintaining requirements specifications in multi-agency environment and providing requirements to 3rd Party Software Developers to integrate their products with an application similar to EFAST 2.

5. Please detail your organization’s experience providing contact center support for a filing application similar to EFAST2 handling an average of 60 calls/day with increased volume during peak filing months (average 189 calls/day).

6. Please detail your organization’s experience of maintaining both a public and government search option for a filing application similar to EFAST2 which renders data in OMB approved form format for past years and allows for filing search for any past years.

7. Indicate if your services can be provided on a Firm Fixed Price (FFP) basis.

8. If applicable, list all Governmentwide Acquisition Contracts (GWAC) and / or General Services Administration (GSA) Multiple Award Schedule (MAS) contracts held: Army Chess, STARS III, NASA SEWP, etc. Please specify the specific group / category of the contract(s). For example, if you have a National Aeronautics and Space Administration, Solutions for Enterprise-wide Procurement contract (NASA SEWP), please indicate all contracts held: Group A, B, C and/or D.

9. Indicate if you are a Small Business or Other than Small Business. If Small Business, please indicate all

Small Business designation(s). E.g. Small Disadvantaged, Veteran-Owned Small Business (SDVOSB).

Interested parties that believe they have the bona fide capability to offer suitable services should submit sufficient information demonstrating their capability to meet our needs (specifically addressing the elements above) no later than 3:00 PM, Eastern Daylight Time (EDT) on October 11, 2024.

DOL Contract Specialist: Keator.Jeremy.B@dol.gov

Please direct all communications and RFI responses regarding this requirement solely to the above point of contact.

An award will not be made as a result of responses to this RFI announcement. The capability packages for this RFI are not expected to be quotations, but rather statements regarding the company's existing experience in relation to the areas specified in the PWS. Capability packages must not exceed 25 pages and must be submitted via email.

This notice is a RFI and, as such, is for informational and planning purposes only. This is not a solicitation announcement for quotes or proposals and the Government will not award a contract from this announcement. The agency will not reimburse contractors for any costs associated with providing information in response to this announcement or any follow-up information requests. The agency will not accept any telephone calls or requests for a bid package or solicitation at this time. At this time, no solicitation exists. In order to protect the integrity of any future procurement that may arise from this announcement, DOL will not provide information regarding technical points of contact. The agency will not make appointments for capability presentations.

The Government will use responses to this notice to make appropriate acquisition decisions. DOL will not formally answer questions received in response to this request for information. We will review questions received against the existing requirement and use them to further clarify inconsistencies or unclear needs.

mailto:Keator.Jeremy.B@dol.gov

Draft-Performance Work Statement (PWS)

For

ERISA Filing Acceptance System II (EFAST2) Operations and Maintenance for the U.S. Department of Labor, Office of the Chief Information Officer (OCIO), Business Applications Services (BAS)

PART 1

General Information

Description of Services/Introduction:

The contractor shall provide all personnel, equipment, tools, materials, supervision, and other items and non-personal services necessary to operate and maintain a public-facing filing program as defined in this Performance Work Statement, except as Specified in section C-3 as government furnished property and services. The contractor shall perform to the standards in this contract action.

Background:

The U.S. Department of Labor (DOL) mission is to foster, promote, and develop the welfare of wage earners, job seekers, and retirees of the United States; improve working conditions; advance opportunities for profitable employment; and assure work-related benefits and rights.

The Employee Retirement Income Security Act of 1974 (ERISA) and provisions of the Internal Revenue Code generally require the administrator of an employee benefit plan to submit an annual report (the Form 5500 series) describing the plan’s financial status and operations. The Form 5500 series is sponsored by multiple federal agencies that work together to enforce ERISA provisions and other statutes designed to protect the retirement benefits of the nation’s workers. Form 5500 filings are the principal source of information for the DOL Employee Benefits Security Administration (EBSA), Internal Revenue Service (IRS), and Pension Benefits Guaranty Corporation (PBGC) concerning the operations, funding, and investments of more than 800,000 pension and welfare benefit plans. This information is essential to the three agencies’ enforcement of ERISA and policy formulation programs and is important for other federal agencies such as the Bureau of Economic Analysis, Congress, and the private sector in assessing employee benefit, tax, and economic trends and policies. These plans cover over 140 million private sector workers, retirees, and dependents and hold over $11 trillion in assets.

In the late 1990s, DOL/EBSA, the Internal Revenue Services (IRS) and the Pension Benefits Guarantee Corporation (PBGC) were charged with automating the Form 5500 process which resulted in the development of the EFAST program and the first iteration of the EFAST system. The EFAST system was designed primarily to process Form 5500 filings submitted on paper through optical scanning recognition technology. While the EFAST system met the Government’s needs, technology quickly improved.

In the early 2000s, the partnering agencies contracted with a private-sector vendor to perform a major overhaul to the EFAST system to incorporate technological advances and to create additional efficiencies in the submission process. The redesigned EFAST system, known as EFAST2, accepts electronic submission of Form 5500 filings through web services and provides a web-based solution with near-instantaneous transparency of Form 5500 filings to both the public and private sector. EFAST2 began pre-processing activities on July 1, 2009.

Today, EFAST2 accepts electronic submission of the Form 5500 series as well as Form 5558 and Pooled Plan Provider filings. The private-sector vendor provides ongoing operations and maintenance of the system as well as user support.

The current system is designed with a cloud-native approach and resides in a FedRAMP-authorized environment, operating on AWS infrastructure. Many EFAST2 components are licensed and utilized along a consumption model.

The EFAST2 System High-Level Architecture is shown in Figure 1.1 and the EFAST2 System Boundary is shown in Figure 1.2.

Figure 1.1. EFAST2 System High-Level Architecture

Figure 1.2. EFAST2 Boundary

Objectives:

1. Maintain a comprehensive and secure system for filing Form 5500 series filings and associated forms.

2. Create and maintain draft and final versions of annual Government forms, schedules, and instructions based on Government specifications.

3. Provide public filers with the ability to fill out, validate, edit, sign, submit, and amend completed forms.

This ability shall be through free web-based software provided by the contractor (IFILE) and through support of third-party software.

4. Create and maintain specifications for third-party software products and provide outreach to third- party software providers. Support, test, and certify third-party products to ensure compatibility and integration.

5. Create and maintain the Data Element Requirements (DER) document, PDF and XML versions.

6. Control production to ensure all filing submissions successfully complete processing.

7. Provide automated web responses and email acknowledgement messages to filers following receipt of every filing submission.

8. Process and store data for at least 1.1 million filings annually in multiple formats based on different forms and form years. Deliver and present filtered data and information to filers, Government agencies, and stakeholders.

9. Provide Contact Center, helpdesk, and tiered support that explain how to file, troubleshoot common filing errors, answer frequently asked questions, and transfer escalated questions/concerns to Government agencies.

10. Ensure the system is compliant with the DOL Cybersecurity Policy Portfolio (CPP) and NIST 800-53.

11. Implement system improvements based on policy, management, and e-Government directives and initiatives.

12. Minimize costs of peak processing times by automating scaling in cloud-based technologies.

13. Provide the Government with real-time access to monitor operations including quality control, system performance, cost, and contact center data.

14. Conduct and coordinate testing to minimize impact to mission applications.

Scope:

This work involves (1) collection, processing, and dissemination of Government data, (2) support of stakeholders (filers, third-party software, and Government), and (3) management services.

The scope of this work is for the Contractor to deliver the EFAST2 system while meeting the preceding objectives.

The scope of the work includes the following:

• Annual Rollover Baseline Changes to operate the system for each processing year and to “rollover” in preparation for succeeding processing year

• Advanced Search Features on filings

• System Maintenance activities such as system patching, system updates, etc.

• Contact Center Operations to respond to calls, emails and web inquiries. Includes Chatbot support and user satisfaction analysis

• Program ISO and Support to maintain designated level of system security compliance

• Program Management to maintain a stable management presence for all contractor work activities

• Quality Assurance to establish and maintain a software quality program through all phases of the system development life cycle

• Quality Control to provide an independent quality control unit to measure and report on all performance standards defined in the contract

• Software and License Agreements necessary to support the EFAST2 solution

• Travel, as needed, to support training and Third-Party Developer Conference activities

• Internet Filing Acceptance Service (IFAS) to operate and maintain a high-performance, high-availability, and fully automated service for use by Third Party software

• Performance Monitoring of all system components

• Web Content Management to support a workflow for approved content changes

• Change Management using DevSecOps methodologies

• Third Party Developer Conference to plan and communicate EFAST2 changes

• Non-recurring Rollover Changes to support legislative changes

The detailed requirements of EFAST2 may be refined adaptively over the course of the effort to continuously meet specified user needs. User needs will be prioritized based on business value and technical dependencies.

Period of Performance:

The period of performance shall be for one (1) Base Period of 12 months and four (4) 12-month option periods.

The government reserves the right to extend the term of this contract action at the prices set forth in Section B in accordance with the terms and conditions contained in clause 52.217-9 entitled, “Option to Extend the Term of the Contract”.

General Information

1.6.1 Quality Control:

The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is the means by which he assures himself that his work complies with the requirement of the contract. As a minimum, the contractor shall develop quality control procedures that address the areas identified in Technical Exhibit 1, “Performance Requirements Summary”. After acceptance of the quality control plan, the contractor shall receive the Contracting Officer’s acceptance in writing of any proposed change to his QC system. The QC Plan is to be delivered as indicated in Technical Exhibit 2, Deliverables Schedule.

The contractor’s quality control program shall operate and maintain quality control procedures to identify, prevent, and ensure non-recurrence of defective services. As a minimum, the contractor shall operate and maintain quality control procedures that address the areas identified in Technical Exhibit 1, “Performance Requirements Summary”. In support of the Government’s production control objective, the Quality Control Procedures shall detail automated and manual reconciliation procedures to ensure no data is lost between or within any processes, applications, services, or functions. The QC procedures shall identify and define vital indicators for immediate corrective action. These indicators shall provide real-time triggers to alert the Contractor early that a performance standard is in danger of being missed. The QC procedures shall detail steps to be followed when a defect or non-compliance is found or a vital indicator is triggered. It shall define how and when such issues are reported to the Government, what actions will be performed by the Contractor and when, and under what circumstances the Contractor will require Government or other outside direction prior to implementing corrective or remedial actions. The contractor shall update the procedures on an ongoing basis to incorporate changes or refinements to processing or quality control procedures.

The contractor’s quality control program shall measure, monitor, and report quality of all major processing functions using industry best practices for sampling and quality control such as ANSI/ASQC Z1.4-2003 and ANSI/ANSQ Z1.9-2003. Audits for independent monitoring of processing actions shall be a combination of recurring scheduled periodic audits, and special audits initiated by the contractor or at the request of the Government to examine specific areas of system performance or processing, or to detect and monitor resolution of perceived or identified system problems.

The contractor shall include a signed statement from its quality control program of system performance measured in accordance with the methodology specified in Technical Exhibit 1.

The contractor’s quality control program shall provide a Quality Control Briefing at which the performance results for that period will be presented to the Government. In addition to presenting the quality control statistics for each quarter, the Contractor shall work in conjunction with the Government to identify special topics to be presented based on relevant processing activities. Such topics could include, but are not limited to analysis of Contact Center calls, filing volumes, edit test errors, third-party software issues, schema validation failures, web traffic, etc.

1.6.2 Quality Assurance:

The government shall evaluate the contractor’s performance under this contract action in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.3 Government Remedies:

The Contracting Officer shall follow FAR 52.212-4, “Contract Terms and Conditions-Commercial Items” or 52.246-4, “Inspection of Services-Fixed Price” for contractor’s failure to perform satisfactory services or failure to correct non-conforming services.

1.6.4 Recognized Holidays:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Juneteenth Day Christmas Day Independence Day

The schedule of Government holidays is provided for information purposes only. While the Contractor is not required to operate in accordance with the Government’s holiday schedule, it is recommended that the Contractor implement this schedule (with the exceptions of New Year’s Day and Columbus Day) to facilitate effective communication and operations of EFAST2.

Due to peak filing times in mid-October of each year, EFAST2 operations must be supported, and the contact center staffed with live customer service agents on Columbus Day.

Due to annual forms rollover release the morning of January 1 each year, EFAST2 functions and releases must be supported and tested on New Year’s Day.

The Contractor is not typically required to perform services on these days. However, due to software release schedules, the contractor may be required to work on recognized holidays. In such circumstances, advance approval must be provided by the COR/CO.

1.6.5 Hours of Operation:

The contractor is responsible for conducting performance between 8AM to 5PM, Eastern Time Monday thru Friday, except Federal holidays or when the government facility is closed due to local or national emergencies, administrative closings, or similar government directed facility closings. The contractor must at all times maintain an adequate work force for the uninterrupted performance of all tasks defined within this statement of work when the government facility is not closed for the above reasons. The Contractor shall ensure that the Contact Center is adequately staffed to handle the anticipated volume of calls during contact center hours of operation. When hiring personnel, the contractor shall keep in mind that the stability and continuity of the work force are essential.

Telecommuting or “work at home” is not authorized under this contract action unless determined by the Contracting Officer’s Representative (COR).

1.6.6 Place of Performance:

The work to be performed under this contract action will be performed at the contractor’s facilities or remotely.

Regardless of location, Contractor employees must employ appropriate safeguards and comply with any and all applicable DOL and Federal polices, specification/requirements, and procedures related to Personally Identifiable Information (PII), security, network, data, and communications.

The Contractor shall limit work performed under this resulting Contract to locations within the continental United States (lower 48 states and Washington, DC).

The Contractor may be required to travel during the performance of this contract. Contractor is to follow all FAR rules and regulations and GSA Travel Regulation. Travel requests must be approved by the COR in advance.

Contact Center agent shall have the ability to work remotely and relocate to a different geographical location in the case of a disaster.

1.6.7 Type of Contract:

The government anticipates award of a Time and Materials (T&M) contract.

1.6.8 Security Requirements:

Cybersecurity requirements are specified in Technical Exhibit 4 – Cyber Security Clauses. The contractor shall maintain the confidentiality, integrity, and availability of EFAST2 at the Moderate Baseline Security Category level of compliance.

Physical Security.

The contractor shall be responsible for safeguarding all government property provided for contractor use.

Key Control.

The contractor shall establish and implement methods of making sure all keys/key cards issued to the contractor by the government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the contractor by the government shall be duplicated. The contractor shall develop procedures covering key control that shall be included in the Quality Control Plan. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the Contracting Officer.

Lost Keys In the event keys, other than master keys, are lost or duplicated, the contractor shall, upon direction of the Contracting Officer, re-key or replace the affected lock or locks; however, the government, at its option, may replace the affected lock or locks or perform re-keying. When the government, the total cost of re-keying or the replacement of the lock, performs the replacement of locks or rekeying or locks shall be deducted from the monthly payment due the contractor. In the event a master key is lost or duplicated, the government and the total shall replace all locks and keys for that system cost deducted from the monthly payment due the contractor.

Key Use The contractor shall prohibit the use of government issued keys/key cards by any persons other than the contractor’s employees. The contractor shall prohibit the opening of locked areas by contractor employees to permit entrance of persons other than contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the Contracting Officer.

Conservation of Utilities.

The contractor shall instruct employees in utilities conservation practices. The contractor shall be responsible for operating under conditions that preclude the waste of utilities, which include turning off the water faucets or valves after using the required amount to accomplish cleaning vehicles and equipment.

General security requirements The Contractor shall maintain the confidentiality, integrity, and availability of EFAST2. In general, the security program shall include the following activities:

• Maintain the designated level of security compliance (Moderate Baseline Security Category)

• Create, implement, and maintain security policies and procedures for security of computer systems, telecommunications/Internet connectivity, data, personnel, and system administration

• Enforce security controls on and during the system design, system testing, system implementation, system maintenance, and system disposal

• Control logical access and ensure physical access is controlled

• Correct or mitigate security defects and deficiencies

• Inform all subcontractors that the subcontractors are also required to meet the security requirements described herein

• Support Government-sponsored Security Compliance Reviews, security inspections, tests, assessments, audits, and evaluations

Non-Disclosable Information EFAST2 may include Controlled Unclassified Information (CUI). The following information is considered CUI:

• Personally Identifiable Information (PII) submitted by filers. This includes filer authentication data, Form 5500-EZ filings, Form 5500 and 5500-SF filings filed by one- participant plans, and sensitive information deemed to be erroneously submitted by filers as identified by DOL (e.g., social security numbers, dates of birth, bank account numbers, etc.).

• Information from “in-process” filings saved on IFILE but not yet submitted.

• Proprietary or detailed identifying information regarding the inner workings of the EFAST2 system (e.g., IP addresses, network diagrams, operating system details, etc.).

• Security documents such as the System Security Plan, Configuration Management Plan, Contingency Plan and Incident Response Plans.

• Additionally, the information collected on the Form 5558 is considered Federal Tax Information (FTI).

The Contractor shall protect the confidentiality of all CUI and FTI by restricting access to confidential information on a least privilege basis. The Contractor shall establish controls to preclude inadvertent or intentional disclosure of CUI or FTI information to other than authorized persons and the use of CUI or FTI information for purposes other than specified under this contract. The Contractor shall also impose controls to prevent employees from viewing CUI or FTI information other than that necessary to complete the employee’s assigned work. The Contractor shall minimize the risk of employees browsing Form 5500 and schedule data in accordance with the Taxpayer Browsing Protection Act. The Contractor’s plans for physical and data security shall be part of the management controls. The Contractor shall use operational controls, such as monitoring of live phone calls or reviewing of filings, to monitor the protection of CUI or FTI information.

Any non-disclosable or Government Official Use Only information made available to the Contractor shall be used only for the purpose of carrying out the provisions of this contract and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the contract.

Disclosure to anyone other than an officer or employee of the Contractor or a subcontractor shall require prior written approval of the COR. Requests to make such disclosure shall be addressed to the COR.

Disclosure of any such information, by any means, for a purpose or to an extent unauthorized herein, may subject the offender to criminal sanctions imposed by 18 U.S.C. Sections 641 and 3571. Additionally, it is incumbent upon the Contractor to inform its officers, employees, and subcontractors of the penalties for improper disclosure imposed by the Privacy Act of 1974, PL 93-579, 5 U.S.C. 552a. Specifically, 5 U.S.C.

552a (i)(1), which is made applicable to Contractors by 5 U.S.C. 552 (m)(1), provides that any officer or employee of a Contractor who, by virtue of his employment or official position, has possession of, or access to, agency records that contain individually identifiable information, the disclosure of which is prohibited under the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. Upon discovery of a possible improper disclosure of non-disclosable data by a Contractor or subcontractor employee or any other person, the individual making the observation or receiving the information shall inform the Contractor’s project manager, who shall contact the COR.

Security Assurance, Compliance Reviews, and Inspections The Contractor shall provide assurance in the form of evidence and convincing arguments that EFAST2 integrates and enforces Federal, NIST, and DOL security policies. The Contractor shall provide evidence that the set of controls that enforce security are operating as intended within the scope of EFAST2 requirements. Evidence shall be in the form of documentation, interviews, and tests, as appropriate, and shall be provided at the request of the Government.

The Contractor shall ensure all applicable technologies used will meet recommended security configurations using configuration checklists contained in the NIST National Checklist Program Repository.

Technologies that do not have a NIST equivalent checklist shall use an approved and agreed-upon security configuration checklist for the baseline configuration.

The Government plans to utilize independent third-party assessors to review the Contractor’s provided evidence on a continuous monitoring basis. The Contractor shall permit and support the assessments and cooperate with the assessors. The Contractor shall submit requested documentation, as needed and upon request by Government officials, auditors, or other Government representatives. The Contractor shall permit inspections of the Contractor’s facility, system configurations, and environments to ensure a secure operation and protection of Federal information processed by the systems and operations.

On the basis of such security assessments and inspections, the Government may require specific measures in cases where the Contractor is found to be non-compliant with contract requirements. The Contractor shall implement such measures as soon as possible without additional cost to the Government. The Contractor shall correct defects uncovered and shall permit and support additional reviews as necessary to confirm actions taken to correct defects.

The Contractor shall also support security inspections conducted by Government auditors or other Government representatives, as designated by the COR. The Contractor shall permit inspections of the EFAST2 facility, system configuration, and operating environment to ensure a secure operation and protection of Federal information processed by EFAST2. In the event the system is identified for an Inspector General (IG) or other Federal audit, the Contractor shall assist the Government in providing support upon request during the audit processes (i.e., providing supporting evidence, ad- hoc reports, interviews, documentation, etc.). This includes providing any necessary access to files captured, stored, or processed within architecture utilized by the Contractor in meeting the requirements of this contract even in the event those portions of the architecture are managed/operated by a subcontractor.

Commercial Off-The-Shelf Software The Contractor may use a combination of commercially available software and custom developed software.

The commercially available software shall have been developed by major software vendors, be widely used, and be actively supported by the developer or other third parties. When selecting among competing commercial off-the-shelf (COTS) software products, the Contractor shall choose software and versions that are free from known security vulnerabilities, FedRAMP certified products are preferred. The chosen COTS software shall reflect the standard commercial practice of industry. The Contractor shall consult available security checklists or recommendation guides in selecting secure product configurations and parameter settings. The Contractor shall follow NIST Special Publication 800-36, Guide to Selecting Information Technology Security Products, and NIST Special Publication 800-35, Guide to Information Technology Security Services.

Any custom software for EFAST2 shall be developed in compliance with the standards for major application development in Technical Exhibit 4.

After assembling the COTS and custom software elements, the Contractor shall undertake a thorough and methodical search for ways by which the security of the integrated system might be undermined. The Contractor shall remedy any vulnerability found in a timely manner.

Telecommunications It is critical that security measures be taken to protect the telecommunication links. The Contractor shall configure its routers to restrict traffic through the routers to only that needed for data dissemination access.

This shall include filtering secure IP connections to only allow IP subnets from Government locations where the Government access system clients exist. This shall also include filtering all network port activity except that port on which the Government access system client operates. The Contractor shall design the Government access system to transmit data using a secure protocol in accordance with RFC 2818, HTTP over TLS, where applicable, that is:

• Encrypt all transmissions between the client and host systems.

• Configurable to be compatible with standard firewall hardware/software.

Boundary Protection The Contractor shall define the EFAST2 security boundary. Third-party systems/services that contain, or could potentially contain, EFAST2 CUI or perform a critical function for EFAST2 or are critical components of EFAST2 should be considered within the EFAST2 security boundary. The Contractor shall implement system protections to protect the EFAST2 security boundary as a first line of defense against malicious and inappropriate access. As part of the System Security Plan deliverable, the Contractor shall describe the security boundary and explain the methods employed to protect the system at the boundary. The Contractor shall follow NIST SP 800-47, Security Guide for Interconnecting Information Technology Systems; NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems; and related standards.

Additionally, the contractor shall define EFAST2’s authorization boundary. The EFAST2 authorization boundary incorporates all information systems that facilitate the same business mission/objective (i.e. the filing service, and all supporting components), reside in the same general operating environment, and are under the direct control of the system’s authorizing official.

The authorization boundary is a critical component associated with the NIST Special Publication (SP) 800-37, Guide for Applying the Risk Management Framework (RMF) to Federal Information Systems and Office of Management and Budget (OMB) circular A-130, Managing Information as a Strategic Resource.

The Contractor shall provide information as needed for the Government to complete Memoranda of Understanding (MOU) and/or Interconnection Security Agreements (ISA) for interconnection or data sharing between EFAST2 and the different Government agencies. The information supplied by the Contractor shall comply with MOU and/or ISA requirements described in the DOL Cybersecurity Policy Portfolio (CPP) and

NIST SP 800-47.

All resources within the defined system security boundary shall be open to inspection and audit by the Government and must meet all security standards as defined in this section. Shared devices, outsourced services, and resources outside of the security boundary shall also be open to review by the Government.

Incidents and Breaches The Contractor’s EFAST2 system design shall ensure continuous protection: that is, the security enforcement mechanisms of the system shall operate to protect the system at any time. The security enforcement mechanisms shall be protected against attempts to circumvent or disable their operation.

The Contractor shall document and implement its policies and procedures to follow in the event the protection is breached. The Contractor shall follow NIST Special Publication 800-86, Guide to Computer and Network Data Analysis: Applying Forensic Techniques to Incident Response, and NIST Special Publication 800-83, Guide to Malware Incident Prevention and Handling.

The incident handling procedures shall be consistent with the requirements of the DOL Cybersecurity Policy Portfolio (CPP). All EFAST2 security incidents must be reported in accordance with procedures established by the DOL Cybersecurity Policy Portfolio (CPP) and delivered to the COR. The reporting procedures also apply to the theft or destruction of physical assets if they cause, or could potentially cause, the loss or compromise of data, as well as physical breaches. The Contractor shall include training on user responsibilities with respect to incident handling as part of the computer security awareness training provided to all new Contractor and subcontractor employees and annually to all employees.

If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function or to be effective, the discoverer shall immediately call the situation to the attention of the other party through incident reporting procedures in the SSP.

Fraud and related activity in connection with computers, by any means, may subject the offender to criminal sanctions imposed by 18 U.S.C. Section 1030. Additionally, it is incumbent upon the Contractor to inform the Contractor’s officers, employees, subcontractors, and system users of the penalties for computer fraud imposed by 18 U.S.C. 1030.

System Component Disposal and Contract Termination When storage media are transferred or no longer usable or required, the Contractor shall ensure that residual magnetic, optical, or electrical representation of data that has been deleted has been fully sanitized and cannot be retrieved and reconstructed. Hard copy media (for example, paper printouts, printer and facsimile ribbons, drums, and platens) and electronic or soft copy media (for example, bits and bytes contained in hard drives, random access memory, read-only memory, disks, memory devices, telephones, mobile computing devices, networking equipment) must be properly disposed, cleared, purged, or destroyed per NIST SP 800-88.

The contractor shall provide signed certification of equipment sanitization, and support Government staff in the verification of sanitization and removal of hardware from the Contractor site.

Security Progress Report The Contractor shall report the Contractor’s efforts in identifying, assessing, prioritizing, and monitoring the progress of security efforts, vulnerabilities, and corrective actions for fixing or mitigating security weaknesses found in the EFAST2 system, operations, or operating environment.

This security progress report shall include a listing of security incidents and their resolution, vulnerabilities discovered and actions taken to mitigate them, plans for significant changes to the security controls or features of the system, and other significant security activities. It shall also include a running list of open security issues, with recommendations for action.

The security progress report shall demonstrate that the Contractor has reviewed vulnerabilities and audit trails, identified security issues from their reviews, and describe the Contractor’s action(s) on those security issues. The Contractor shall promptly report serious defects or deficiencies to appropriate supervisory and/or security personnel for follow-up action and shall not wait to report them in the security progress report. The Contractor shall follow NIST Special Publication 800-92, Guide to Computer Security Log Management and OMB Memorandum 03-19, Reporting Instructions for the Federal Information Security Management Act and Updated Guidance on Quarterly IT Security Reporting.

The Contractor shall report the status of personnel clearance in the security progress report, including the following information: staff member's name, title, function on the project, employee’s start date, MBI application submission date, status of MBI approval (full or temporary), MBI clearance approval date, and MBI clearance expiration date.

The Contractor shall create, manage, and report security Plans of Action and Milestones (POAMs) in accordance with OMB Memorandum 02-01, Guidance for Preparing and Submitting Security Plans of Action and Milestones.

Security Documentation The Contractor shall document a formal System Security Plan detailing the security policies, procedures, and controls required for EFAST2, as required by NIST SP 800-18, Guide for Developing Security Plans for Federal Information Systems, and the DOL Cybersecurity Policy Portfolio (CPP). The Contractor’s SSP shall include the below specified attachments:

• Information Security Policies and Procedures

• Rules of Behavior

• Information System Contingency Plan

• Configuration Management Plan

• CIS Workbook

• Separation of Duties Matrix

• Asset and Supplier Inventory (including BOM)

• Control Implementation Statement

• Patch and Vulnerability Management Plan

• Change Control Board (CCB) Charters

• Configuration Management (CM) User Guide

The System Security Plan shall address all security controls moderate baseline and as specified in NIST Special Publication 800-53, Recommended Security Controls for Federal Information Systems and any additional controls needed to maintain EFAST2 security. The Contractor shall implement all security controls as prescribed by NIST and shall report to and seek approval from the COR for any deviations from NIST 800-53. To provide assurance that the implemented controls are operating as intended, the Contractor shall follow NIST SP 800-53A, Guide for Assessing the Security Controls in Federal Information Systems.

The System Security Plan shall also provide all application identification and personnel information, as described in NIST SP 800-18.

The Contractor shall update security documentation, not just the System Security Plan, to reflect major system changes, incident reports, newly discovered vulnerabilities, or weakness mitigations. In addition to the System Security Plan document itself, the Contractor shall provide information at EBSA’s request to support EBSA’s documentation needs. This includes input regarding but not limited to the below items:

• Security incident and vulnerability advisories and alerts received from the Department of Homeland Security and the DOL Computer Security Incident Response Capability.

• Interconnection Security Agreements

• Data calls

Restricted Application Access The Contractor shall provide users with restricted web-based access to various applications. Depending on needs, some users may require the ability to write to certain applications while in other instances, applications may only require read-only access. The Contractor shall implement those applications such that they are able to accept such modifications by specific Government users. The Contractor shall ensure Contact Center personnel and other Contractor support staff such as the quality assurance specialist have the ability to query and obtain filing information needed to perform their functions.

1.6.9 Special Qualifications:

The contractor is responsible for ensuring all employees possess and maintain all required certifications used in the execution of this contract action.

1.6.10 Post Award Conference/Periodic Progress Meetings:

The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The Contracting Officer, Contracting Officer’s Representative (COR), and other government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings, the Contracting Officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.6.11 Contracting Officer’s Representative:

A COR will be delegated separately.

1.6.12 Key Personnel:

The following personnel are considered key personnel by the government: Senior Program Manager, Senior Principal Systems Engineer, UX Manager, Quality Assurance Specialist, Information Security Manager and Release Manager.

The contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the Contracting Officer. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract action. The contract manager or alternate shall be available between 8a.m. to 5p.m ET, Monday through Friday except Federal holidays or when the government facility is closed for administrative reasons. Qualifications for all key personnel are listed below.

The Contractor shall assign fully trained staff possessing the skills necessary to carry out the functions specified in the contract, including management, technical, production, security, financial, contact center, and other necessary tasks. The Contractor shall be responsible for all recruiting, hiring, training, supervising, managing, and retention to develop and retain staff possessing the required skills necessary to carry out the functions specified by the contract.

The Contractor shall ensure that essential tasks will be accomplished, and operations will continue uninterrupted despite the protracted absence of personnel. In this context, "protracted" shall mean a period greater than one month as, for example, in the event of resignation, serious or extended illness, or accident.

The positions identified below are considered by the Government to be key personnel, full time dedicated to the work in this PWS, and essential for the successful completion of all work assigned under the contract:

TITLE

Senior Program Manager Senior Principal Systems Engineer UX Manager Quality Assurance Specialist Information Security Manager Release Manager Technical Operations Manager System Test Manager Software Configuration Manager Development Project Manager

All changes in key personnel will require the written approval of the COR/CO. Prior to adding or replacing key personnel, the Contractor shall supply, for the Government’s review: a description and justification of the change, resumes, a crosswalk of replacement key personnel’s qualifications to contractual qualifications for the position, and a transition plan describing the timing and training plan for the replacement staff. The Government must approve the replacement candidate in writing before he/she can start work.

DOL does not intend to approve any changes in key personnel within the first one hundred eighty (180) calendar days following contract award.

The Government will evaluate the key personnel resumes in relation to the qualifications and experience requirements of the labor category. The Subcontractors are not excluded from this process and must supply resumes for the Government’s review prior to any additional or replacement key personnel being assigned to the contract. Two years of specialized experience may be substituted for one year of academic requirements.

1.6.12.1. Senior Program Manager

The Senior Program Manager is responsible for managing the complex EFAST2 program on behalf of the contractor, often bridging functional/organizational lines. They direct daily staff and task activities to meet government and contractor objectives. They supervise assigned technical and administrative staff, including subordinate managers. They assure quality of products, services, and deliverables, including participating in reviews, audits, and site visits. They serve as a liaison with the DOL COR/PM to coordinate activities, negotiate tasks, and solve problems. They are responsible for coordinating and monitoring subcontractor activities and for meeting the performance, schedule, and budget needs of this contract.

The following are special qualifications and experience for the position:

• Undergraduate college degree from an accredited college or university in a course of study related to the requirements…