Revised_Solicitation_2031JW20Q00002_Financial_Management_Systems_Support_and_Maintenance.pdf

Request for Quote - Financial Management Systems Maintenance and Support

OCC Solicitation No. 2031JW20Q00002

1.0 GENERAL

The contractor shall furnish all technical, management, supervision, labor, materials, and any other support necessary to provide the services as described in the Statement of Work (SOW).

The NAICS code for this requirement is 541519: Other Computer Related Service. This is a

Small Business Set-Aside consistent with FAR 19. This solicitation will be conducted streamlined procedures, in accordance with FAR 12.6 and 13.5 procedures.

2.0 LINE ITEM DESCRIPTION

The Contractor shall furnish all management and labor support services necessary to perform technical maintenance and support of the Office of the Comptroller of the Currency’s (OCC)

Financial Management (FM) Systems as described in PART II-SOW.

3.0 PRICING

The contract will be Firm-Fixed-Priced (FFP). Services shall be performed at a fixed price per month basis. The fixed monthly rates specified herein shall include all overhead, fringe benefits, general and administrative expenses, and profit for the successful performance of all specified services. Prices are required for all contract line item numbers (CLINs). The Purchase

Order will consist of a base period and four one-year option periods. The option periods will be exercised at the sole discretion of the Government consistent with FAR 52.217-9. The following table shall be used to provide pricing.

SECTION I - SUPPLIES OR SERVICES AND PRICES/COSTS

3.1 PRICING TABLE

CLIN

PERIOD OF

PERFORMANCE

QTY

UNIT

MONTHLY

PRICE

EXTENDED

AMOUNT

Base Year – Maintenance and Support

02/01/2020-01/31/2021

MO

1001 Option Year 1-

Maintenance and Support

02/01/2021-01/31/2022

12 MO

2001 Option Year 2-

02/01/2022-01/31/2023

3001 Option Year 3-

02/01/2023-01/31/2024

4001 Option Year 4-

02/01/2024-1/31/2025

TOTAL OF ALL CLINs:

1.0 BACKGROUND

The Office of the Comptroller of the Currency (OCC) was established in 1863 as a bureau of the Department of the Treasury. It is responsible for regulating and supervising the national banking system. The OCC charters, regulates and examines approximately 2,200 national banks and 52 federal branches and agencies of foreign banks in the United States. The OCC's nationwide staff of examiners conducts on-site examinations of national banks and provides sustained supervision of bank operations. Its mission is to ensure a safe, sound and competitive national banking system that supports the citizens, communities and economy of the United States.

The OCC is a non-appropriated federal financial regulatory bureau of the Department of the Treasury with approximately 3,900 permanent employees. The OCC is headquartered in Washington, DC and has four (4) district offices with locations in

Dallas, TX, Denver, CO, Chicago, IL and New York, NY.

2.0 PURPOSE

The purpose of this SOW is to request technical support services for the OCC’s

Financial Management (FM) Systems. This is a non-personnel services contract.

The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the contractor who, in turn, is responsible to the

Government.

FM Systems include the core financial management system, $MART, which supports the OCC’s operations. $MART includes Oracle PeopleSoft version 9.2 modules for General Ledger, Accounts Payable, Accounts Receivable, Requisitions, Purchase Orders, Asset Management, and Commitment Control, to include the repair, design, development or update of existing and new interfaces, or custom system functionality.

The financial management system also interfaces with other systems and organizations such as PRISM, CitiBank’s CitiDirect System, Invoice Processing

Platform (IPP), National Finance Center (NFC), System for Award Management

(SAM), US Bank, and Pay.gov.

3.0 SCOPE

The contractor shall provide technical services to support Operations and

Maintenance (O&M) activities related to FM Systems and its interfaces. These functions include:

SECTION II – STATEMENT OF WORK

• Performing updates, enhancements and code changes, and testing patches and upgrades in all environments.

• Maintaining a stable system thereby minimizing end user disruption

• Supporting end-user requests through System Help Reports (SHR’s)

• Working with OCC Database Administrators (DBAs) to complete upgrades to current versions of PeopleSoft whenever they are available and a decision to upgrade has been made by the OCC COR.

• Implementing and documenting structured and disciplined processes and initiatives as directed and approved by the OCC COR.

• Adhering to Information Technology Services (ITS) operational standards such as configuration management, Systems Development Life-Cycle (SDLC) tools and procedures, and development strategies to obtain compliance.

• Supporting other functionality currently in, or integrated with, the Oracle

PeopleSoft environment (e.g., Retiree Billing, Travel and Expense

Reimbursement, Conference Expense Form, Help Desk, Expense Reports

Online (ERO), OCC’s Time and Attendance System (e-TIME)).

• Building and supporting current and new interfaces and data exchanges to internal and external systems or processes

• Accounting and process support as it relates to Oracle PeopleSoft

Financials/Supply Chain Management (FSCM) for the federal government.

• Providing technical and data analytics support for business process improvement initiatives.

• Functional accounting, technical programming/troubleshooting and process support as it relates to Federal financial reporting, data element and validation requirements, and required reporting to the Department of

Treasury (e.g. Treasury Information Executive Repository (TIER), Government Wide Treasury Account Symbol (GTAS) Adjusted Trial

Balance System, DATA Act, OMB Circular A-136, OMB Circular A-123).

• Provide technical and analytical support for identifying discrepancies between PeopleSoft and internal and external systems i.e., DATA Act, Payroll, Pay.Gov.

4.1 TASKS

4.1.1 General

The contractor shall provide technical services to support O&M activities related to

FM systems. These functions include:

• Performing analysis of issues and identifying the root cause of FM system problems in order to correct and avoid them in the future

• Performing test planning, environment preparation, test execution, and documentation activities as necessary to support OCC’s Disaster Recovery program.

• Monitoring the operations of FM Systems, addressing issues as they arise, and modifying documentation as changes occur in OCC’s infrastructure and data formats from external providers.

• Monitoring daily system assurance reports and addressing data anomalies as they arise.

• Assisting OCC's Financial Management team in addressing edit and validation warnings and errors for month-end reporting to TIER, and DATA Act, and subsequent reporting in GTAS.

• Assisting OCC in efforts to adhere to OMB Circular A-136.

• Performing testing, reviewing, and documentation activities as necessary to support internal or external reviews and audits (OMB Circular A-123/Audit

Findings, CFO Act, FFMIA, FISMA) activities relative to FM Systems.

• Providing end user Help Desk Support on an “as needed” basis to the FM Business

Solutions or Accounting teams. The contractor shall provide transaction/reimbursement processing support, which includes assisting end users when they encounter issues when processing transactions in $MART.

• Supporting the Financial Management Business Solutions or Accounting teams in processing adjustment transactions or emergency fixes.

• Assisting the FM Business Solutions or Accounting teams with analysis of data anomalies.

• Providing subject matter expertise on Federal accounting transactions to assist in troubleshooting and resolving transactional issues that occur in the financial system.

• Assisting end users with preparation for the year-end closing during the period of performance, as well as preparation of the next fiscal year set- up.

• Providing support to the FM Business Solutions or Accounting teams with any issue resolution.

• Supporting end users in loading high volumes of transactions in an automated fashion (e.g., spreadsheet uploads).

• Providing reporting support for nVision (web and client server), PeopleSoft Query, Crystal Reports, SQR Reports, and PeopleSoft Business Intelligence

Tools.

• Support Oracle PeopleSoft built-in reports and dashboards as well as developing custom queries for external reporting and dashboard tools.

• Building views and queries for FM Data Warehouse efforts

• Documenting and following up on all $MART, e-TIME and peripheral technical architecture systems issues to facilitate issue resolution. Log is required to be maintained in an Excel spreadsheet

• Managing system updates as they relate to DATA Act implementation and compliance.

• Monitoring, researching, analyzing, and providing resolution on DATA Act Corrective

Actions.

• Providing end user with TIER/Award file support to ensure timely submission of

Treasury deliverables.

• Support any other Government wide or FM strategic initiatives involving or relating to FM systems and data.

• Provide overall technical and functional support for the responsibilities listed in the

(Section 13.0: Guidance and Related Systems).

In addition, Financial data from $MART is used in monthly, quarterly, and annual financial statement and reporting deliverables to OCC management and the Department of Treasury

(Treasury). As such, the data and reports contained in and generated by $MART is subject to annual audit by the Treasury’s Office of Inspector General. Offerors must possess a comprehensive knowledge of authoritative guidance and applicable laws and regulations related to Federal financial management currently in place and any enacted throughout the project duration. Section 13.0: Guidance and Related Systems provides a listing of applicable guidance and related systems.

4.1.2 Financial Systems Operations & Maintenance

The contractor shall provide technical support for updates to the $MART application modules required to address system issues and implement minor enhancements (via the

Change Control Board).

The contractor shall provide planning and testing support when OCC DBAs deploy

Oracle PeopleSoft / PeopleTools / WebLogic Maintenance Packs, periodic and critical patches and fixes to ensure the system platform remains as current as possible on the

Oracle PeopleSoft software. These periodic patches and fixes include the maintenance of the Oracle PeopleSoft platform and hosted application functions.

The appropriate SDLC deliverables must be produced and will be subject to a quality review by the Contracting Officer’s Representative (COR) and maintained in a document repository. The following System Change Requests (SCRs) procedures shall be followed for delivery of enhancement request/fix bundles or upgrade:

• Documentation of the enhancement requirements, upgrade, patch or system issue, including preparation of the Preliminary Engineering Change Proposal (PECP).

• Seek approval by the $MART Change Control Board.

4.1.3 FM System Management Initiatives

The contractor shall support initiatives that have been approved by FM management to improve the overall maintenance of the FM systems. For each identified initiative, the contractor shall develop an advised approach and/or formal plan outlining the objectives, identify resource requirement, and develop an implementation phase. The execution of any resulting activities by the contractor to support and/or implement the initiative shall depend on COR approval, and priority as defined by OCC. These initiatives include:

• $MART Upgrade Analysis and/or Implementation: May include performing a comparison of existing requirements against available software packages on the market today; implementing the upgrade from the current Oracle PeopleSoft product.

• Configuration Management: Updating the existing $MART Configuration

Management plan to reflect the Change Control Board procedures. Support and maintenance of change management tools.

• Knowledge Transfer: Transferring knowledge to the FM Business Solutions team on user functionality, programming support, interfaces and upgrades, by maintaining a formal process guide.

• Document Library: Maintaining, updating, and improving the $MART

Document Library.

• $MART Homepage: Maintaining, supporting, and improving the $MART

Homepage.

• Upgrade Support: Ensuring current Financial Management Systems functionality is compatible with new office products or other software upgrades.

• MS SQL Server Upgrades: Assisting with managing deployment and knowledge transfer with the OCC DBAs and performing system testing prior to implementation, as well as regression and cutover testing on “go-live” weekend.

• Business Process Reengineering: Reviewing functional and system processes and flowcharts to develop more efficient, effective way to do the business.

4.1.4 FM Systems Interfaces/Interconnections

The contractor shall manage the interfaces/interconnections between FM systems and other systems. This includes:

• Maintaining and monitoring all existing interfaces.

• Establishing new interfaces per OCC requirements.

• Resolving transactional errors stemming from interface malfunctions from OCC responsibilities.

• Assisting in the establishment of formal interface agreements between system owners within and outside of FM that are responsible for the operations of integral and external systems.

• Documenting information to be exchanged over the interface and providing precise technical definitions of interface data flows and protocols.

• Forming strategies for developing, testing and deploying/redeploying interfaces, including creation of the requirements, design, and testing documentation required.

• Maintaining schedules and resources required to complete the interface management effort.

• Ensuring OCC’s Configuration, Quality, and Risk Management Procedures relevant to interface management are utilized.

4.1.5 FM Systems Business Analysis

The contractor shall provide business analysis expertise to facilitate system changes in support of business processes. This includes:

• Assisting in the development of Business Process diagrams to articulate changes to the

$MART / Oracle PeopleSoft system.

• Supporting OCC’s FM business unit and ITS personnel in the enhancement and/ or redesign of OCC business processes.

• Providing subject matter expertise in both federal accounting / financial systems applications in order to troubleshoot process and system issues and improve the system via changes, upgrades, and enhancements.

• Providing subject matter expertise in Federal Oracle PeopleSoft technical implementation in order to make system changes, upgrades, and enhancements.

• Ensuring $MART/ERO and all PeopleSoft Applications are mobile-ready in the OCC environment.

• Developing and maintaining reporting tools for financial data including nVision and

Tableau.

• Developing and maintaining changes to support automation in efficiency in OCC processes.

5.0 TRANSITION PHASE

The overarching objective of the Transition Phase is a low risk and low impact (to end users) transition as the contractor assumes responsibilities from the incumbent contractor. The services provided under this contract are vital to the OCC’s mission and must continue without interruption or degradation. The Transition is the primary body of work immediately after contract award and through the end of the transition phase.

In this phase, the initial set of SLAs and metrics will be introduced, baselined, and reported on during this time period. These items set the foundation for continuing performance assessment. It is anticipated that the contractor performs in a back-up and transitioning role for some time and then transitions to the primary role for the remaining time of the phase. It is OCC’s expectation that the contractor’s subject matter experts (SMEs) are on onsite to capture, document, and actively participate in the knowledge transfer process.

In this phase especially, the offeror is free to propose any and all support solutions and services based on industry best-practices and organizational experience to meet OCC’s requirements and ease the transition from the incumbent to the new contractor.

The transition phase shall not exceed sixty (60) calendar days. At the conclusion of the transition period, the contractor shall assume full responsibility of the services requested in this contract. The Contracting Officer (CO) and COR will determine when the Contractor has attained full operational capability.

5.1 Phase Out

The contractor shall submit a service migration plan prior to contract end. The plan shall provide the process and procedures for a 30-day migration (unless directed otherwise) of contractual responsibilities and include procedures for supporting operations and maintenance activities related to FM systems throughout the transfer of operational responsibilities from the contractor’s supervision to another contractor or the Government.

The Plan shall also include details regarding communications and coordination with the new service provider, an approach to ensure a smooth migration. The Plan shall also include provision of a complete and full inventory of SDLC artifacts to be transferred to the incoming contractor. The plan shall be submitted within 90 days prior to the end of the base year period of performance. The Transition Plan approved by the CO shall be implemented at the direction of the CO and/or Contracting Officer’s Representative (COR) prior to contract end.

6.0 DELIVERABLES

The contractor shall ensure that all deliverables, including documents, reports, charts and graphs delivered in electronic format adhere to the accessibility requirements in this SOW.

The contractor shall submit all deliverables to the COR, and Contract Administrator (CA) in electronic format in accordance with the frequencies stated below.

Section Deliverable D ue

Da te

5.0 Transition In Plan 5 days after contract award

5.1 Phase Out Plan 90 days prior to the end of

the contract

6.1.1 Applicable SDLC

Deliverables

One week after completion of task

6.1.2 Problem Reports Subject to Priority as

conveyed by COR

6.1.3 Status Reports Monthly (date to be proposed

by the vendor)

6.1.4 Knowledge Transfer Guide 60 days prior to the end

of each performance year

8.0 Evidence of OCC-mandatory

security and privacy training for each contractor staff working in support of this contract

Prior to network access, and annually

Section Deliverable D ue

Da te

10.0 Non-Disclosure Agreements for

each contractor staff working in support of this contract

Prior to network access

6.1.0 Deliverable Descriptions

6.1.1 Applicable SDLC Deliverables

The contractor shall deliver applicable SDLC artifacts in support of Tasks 5.0.

6.1.2 Problem Reports

The contractor shall notify the COR via email immediately of any problems that cause an interruption to the end user with no alternate means of completing the work. All other problems will require COR and CA notification within 1 business day of discovery.

6.1.3 Monthly Status Report

The contractor shall provide a status report with the following information on a monthly basis:

• Monthly Status Report including work performed in the current month and upcoming month, contract financial status, and risks/open issues.

• Monthly Invoice

6.1.4 Knowledge Transfer Guide

The contractor shall support the development and maintenance of documentation for FM systems. In addition, the contractor shall maintain a current guide which documents processes and procedures essential to the successful operation and maintenance of FM systems as proposed for the tasks in Section 4 of the SOW.

6.2 Format

Software applications currently used by OCC to support office operations include:

• Full Suite of Microsoft Office 2013 Automation Products (i.e., Word, Excel, Power Point, Outlook, Project, Access, and Visio)

Unless otherwise stated in writing, all documents shall be delivered in electronic format to the CA and COR. Electronic copies shall be delivered using the Microsoft

Office Products or as requested by the COR. In the event the delivery system is unavailable or not accessible due to a system malfunction, the contractor shall submit all reports in hardcopy format to be followed with an electronically transmitted copy as soon as the electronic mail system becomes available.

6.3 Government Acceptance Period

The COR will review deliverables prior to acceptance or provide the contractor with documented reasons for non-acceptance. In the event of a rejected deliverable, the contractor will be notified in writing by the COR of the specific reasons for rejection.

The contractor shall have an opportunity to correct the rejected deliverable and return it in accordance with delivery instructions.

The COR will have five (5) business days to review the deliverable and make comments.

The contractor shall have two (2) business days to make corrections and redeliver it to the COR. Should the OCC fail to complete the review within the review period, the deliverable will be considered accepted, unless a longer review period is mutually agreed upon between both parties.

The contractor shall be responsible for timely delivery to OCC personnel in the agreed upon review chain, at each stage of the review. The contractor shall work with OCC personnel reviewing the deliverables to assure that the established schedule is maintained.

The contractor shall take into account corrections in order to meet delivery requirements.

7.0 TASK MANAGEMENT

7.1 Personnel Management

7.1.1 Supervision of Employees

The contractor’s employees shall remain under the contractor’s direct supervision at all times. Although the Government will coordinate directions within the scope of the contract, detailed instruction for the contractor’s employees and supervision shall remain the responsibility of the contractor.

The contractor agrees that this is a non-personal services contract; that for all the purposes of the contract, the contractor is not, nor shall hold himself out to be an agent or partner of, or joint venture with, the Government; and that he shall neither supervise nor accept supervision from Government employees.

7.1.2 Business Hours and Coverage

The contractor shall support all tasks between the hours of 6:00AM – 5:00PM. If contractor determines there exists a need to perform work outside of these hours and/or remotely, prior approval must be sought and granted by the COR. Further, contractor may be required to provide support outside of normal business hours on an as-needed basis at the Contracting Officer’s request.

8.0 GOVERNMENT FURNISHED INFORMATION SECURITY

Contractor staff requiring access to the OCC’s network shall be issued OCC computers.

The Government will also provide access to all personnel systems, equipment and organizations deemed necessary for the performance of the duties outlined above. All development and management of security artifacts must be performed using Government

Furnished Property and Other Resources (this include OCC computers in the network, VPN access, and mobile.occ.gov).

Government furnished information may take the form of policies, standards, guidelines or technical documentation. The contractor shall protect from loss or unauthorized disclosure any materials or information made available to it during the performance of the contract. When not in use, written materials that the COR identifies as sensitive or confidential shall be secured in locked receptacles provided by the OCC. The contractor shall provide security levels and controls that are required by regulation and consistent with best government and professional practices. They shall provide a certified security environment where Government data resides is protected while at rest, in motion and in use.

All contractor personnel with access to OCC facilities and/or systems must complete

OCC-provided mandatory security and privacy training prior to gaining access to OCC information systems; and also completed again each year when OCC launches the training for all contractors and employees. Non-compliance may result in revocation of system access.

9.0 POST AWARD ORIENTATION

The OCC will have a post-award orientation within five (5) working days after contract award. The post-award orientation will be held at OCC Headquarters in Washington, DC and will serve as the kick-off meeting which will include a discussion of contract requirements, the schedule for the completion of this requirement, and any other pertinent information that the contractor will need to meet the performance requirements of this contract. The contractor’s key personnel shall attend this orientation.

10.0 NON-DISCLOSURE AGREEMENT

The contractor shall not disclose any information obtained in connection with work under this contract without OCC written authorization. Contractor personnel are prohibited from downloading OCC data, including e-mail attachments of OCC data files, to any contractor media without OCC knowledge and consent. All contractor personnel working under this contract and/or having access to privileged information shall execute the Non-Disclosure Agreement (Attachment 2) supplied by the OCC.

11.0 PLACE OF PERFORMANCE

Work on this task shall be performed on-site at the OCC offices at Constitution Center, 400 7th Street SW, Washington DC, 20219. The Government will furnish working space, required equipment, and access to the current desktop environment, inclusive of

Microsoft Office. Work on this task may also be performed off-site at a remote location, with prior approval by the COR.

12.0 PERSONNEL

Certain skilled and experienced professional and technical personnel are essential for successful accomplishment of the work included in this SOW. The OCC requires the

Lead/Manager and any other proposed staff be designated as Key Personnel.

12.1 Minimum Qualifications

The minimum qualifications for Key Personnel assigned to this requirement are as follows:

1. The Lead/Manager - shall have at least 10 years of current and consecutive experience with Federal accounting concepts and processes and reporting requirements, and technical proficiency in PeopleSoft Federal Financials environment. Current Certified Public Accountant (CPA) certificate is preferred.

2. Other Proposed Position(s) (To be identified by contractor) - require staff to have at least five years of PeopleSoft technical experience and/or five years of

PeopleSoft Federal accounting concepts and processes and reporting requirements.

13.0 Guidance and Related Systems

Guidance:

• Office of Management and Budget (OMB) Circular A-123, “Management’s Responsibility for

Enterprise Risk Management and Internal Control,” and related appendices

• OMB Circular A-136, “Financial Reporting Requirements”

• Digital Accountability and Transparency Act of 2014 (DATA Act) and related OMB and

Treasury guidance

• Treasury Financial Manual (TFM)

• U.S. Standard General Ledger (USSGL)

• Federal Financial Management Improvement Act (FFMIA)

Related systems:

• Government Wide Treasury Account Symbol (GTAS) Adjusted Trial Balance System

• Central Account Reporting System (CARS)

• Collections Information Repository (CIR)

• Federal Procurement Data System (FPDS)

• Intra-Government Payment and Collection (IPAC)

• Invoice Processing Platform (IPP)

• Pay.gov

• System for Award Management (SAM)

• Treasury Information Executive Repository (TIER)

14 ACCESSIBILITY REQUIREMENTS

The Contractor shall provide and maintain Information Communications Technology

(ICT) that meets applicable standards of Section 508 of the Rehabilitation Act of 1973, as amended. This applies to all software user-interfaces, web-based user-interfaces, and documents such as reports, job aids, guides, and plans. Resource for further details on these standards can be found at:

• Section 508 - https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines

• Web Content Accessibility Guidelines (WCAG) -http://www.w3.org/TR/WCAG20/#conformace

Electronic Content, which includes all electronic documents delivered under this work statement shall meet the following standards:

• 302 – Functional Performance Criteria

• 602 – Support Documentation

• 603 – Support Services

• WCAG 2.0 level A and AA success criteria – applies to all Web-based deliverables

• Exception authorized: Non-Web documents are not required to meet the following WCAG 2.0 criteria: 2.4.1 Bypass Blocks, 2.4.5 Multi-ways, 3.2.3 Consistent Navigation, and 3.2.4 Consistent ID

Software and Web-based interfaces, developed, acquired, upgraded, modified, or maintained under this work statement shall meet the following standards:

• 302 – Functional Performance Criteria

• 502 – Interoperable with Assistive Technology

• 503 – Application

• 602 – Support Documentation

• 603 – Support Service

• WCAG 2.0 level A and AA success criteria – applies to all Web-based interfaces and all Software interfaces, or hybrids of the two

• Exception authorized: Non-Web software that resides on a PC or Server are not required to meet the following WCAG 2.0 criteria: 2.4.1 Bypass Blocks, 2.4.5

Multi-ways, 3.2.3 Consistent Navigation, and 3.2.4 Consistent ID

Conformance to all 508 standards shall be met unless exception is authorized by the

OCC IT Accessibility Program Office.

15.0 SECURITY AND PRIVACY REQUIREMENTS

All Contractor personnel are required to have a Public Trust security clearance.

The COR and the Office of Security have the right to inspect the procedures, methods, and facilities utilized by the Contractor in complying with the security requirements under this contract. Shall the COR determine that the Contractor is not complying with the security requirements of this purchase order, the Contractor shall be informed by the CO of the proper action to be taken in order to effect compliance with such requirements.

Departing Contractor personnel shall complete the list of off-boarding activities as identified in the Contractor’s Off-Boarding Tasks, Attachment 3 of the contract. The

COR shall receive the completed list of off-boarding activities and the completed TD F

80-05.5 Documentary Materials Removal/Non-removal Certification for each Contractor personnel.

https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines

15.1 Compliance with Applicable Laws, Regulations, and Standards

• Federal Laws. The Offeror and all of its respective subcontractors shall follow and remain compliant at all times with the Federal Acquisition

Regulation (FAR) and Privacy Act of 1974 (5 U.S.C. 552a - the Act).

• FIPS. The Offeror and all its respective subcontractors shall follow Federal

Information Processing Standards (FIPS), National Institute of Standards and

Technology (NIST) standards and guidelines, and other laws, mandates, or executive orders pertaining to the development, operations, and protection of information systems and sensitive information and data.

• Office of the Comptroller of the Currency (OCC) Policies and

Procedures. The Offeror and all of its respective subcontractors shall comply with all Office of the Comptroller of the Currency (OCC) security and privacy policies and standards in effect at the time of the award of the contract, as well as those requirements that may be added during the contract.

The Offeror/Service Provider shall conform to OCC administrative regulations, policies, and procedures, in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. The Offeror shall work with OCC internal organizations as needed to ensure that policies, procedures, configuration control, and product life-cycle requirements are fulfilled to the satisfaction of OCC ITS.

The Offeror shall support agency’s operational models and specific security rules throughout the duration of the contract. The Offeror shall support adjustments based on threats identified by the TIC Portal SOC. For example, adjustments to the security policy could be made by the OCC's authorities after the SOC identifies changing trends in intrusion behavior.

15.2 General Requirements

• Authorization to Use, Store, or Share Sensitive Information. The Offeror shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The Offeror shall also protect all government data, equipment, etc. by treating the information as sensitive. All information about the systems, gathered or created under this contract shall be considered as Controlled but Unclassified (CUI) information.

It is anticipated that this information will be gathered, created, and stored within the primary work location. If Offeror personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets. The use of any information that is subject to the Privacy Act will be utilized in full accordance with all rules of conduct as applicable to Privacy Act Information.

• Deliverables. The deliverables in this contract will be considered sensitive and shall not be shared with any other organization without prior approval from the OCC CO.

• Confidentiality. The Offeror agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information. Each Offeror or employee of the

Offeror to whom information may be made available or disclosed shall be notified in writing by the Offeror that such information may be disclosed only for a purpose and to the extent authorized herein.

15.3 Data Protection

• Need to Know. Sensitive information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The Offeror shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected.

• Use of PII. The Offeror shall not use any Personally Identifiable Information

(PII), E-mail Groups, Lists, or contract information for any purpose other than those activities necessary to the performance of this contract.

15.4 Incident Notification

All Information Security Incidents, including those that potentially or actually cause the compromise of OCC information, must be reported in accordance with the requirements below, even if it is believed the incident may be limited, small, or insignificant. OCC will determine when an incident requires additional focus and attention.

Offeror employees must report all information security incidents to the OCC Cyber

Defense Center (CDC) immediately (within 1 hour) after becoming aware of the incident, at: Computer.Security@occ.treas.gov, (202) 649-7930, regardless of day or time.

Offeror employees must provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC; with the following text in the subject line of the email: “Supplementary Information/Report related to previously reported incident ## [insert number].”

Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

When notifying the OCC CDC, copy the Contracting Officer if possible or, if reporting by phone or Contracting Officer’s email is not immediately available, contact the Contracting Officer immediately after reporting the incident to the OCC

CDC.

FAR 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this address: http://www.acquisition.gov/far/.

(End of Clause)

FAR Clause Title Date

52.203-3 Gratuities Apr 1984

52.203-12 Limitation on Payments to Influence Certain Federal Transactions

Oct 2010

52.203-17 Contractor Employee Whistleblower Rights and Requirements to Inform Employees of Whistleblower Rights

Apr 2014

52.204-4 Printed or Copied Double-Sided on Postconsumer Fiber Content Paper

May 2011

52.212-4 Contract Terms and Conditions – Commercial Items OCT 2018

52.227-1 Authorization and Consent Dec 2007

52.232-39 Unenforceability of Unauthorized Obligations Jun 2013

52.232-40 Providing Accelerated Payments to Small Business Subcontractors

Dec 2013

52.233-3 Protest After Award Aug 1996

52.233-4 Applicable Law for Breach of Contract Claim Oct 2004

52.242-13 Bankruptcy Jul 1995

52.242-15 Stop-Work Order Aug 1989

52.243-1 Changes – Fixed Price Aug 1987

I.2 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR EXECUTIVE ORDERS—

COMMERCIAL ITEMS (MAY 2019)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan

2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations

Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Jul 2018) (Section 1634 of Pub. L. 115-91).

(3) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(4) 52.233-3, Protest After Award (Aug 1996) (31 U.S.C. 3553).

(5) 52.233-4, Applicable Law for Breach of Contract Claim (Oct 2004) (Public Laws 108-77 and 108-78

(19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

[Contracting Officer check as appropriate.]

_X__(1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Sept 2006), with Alternate I (Oct

SECTION III – OTHER CONTRACTUAL TERMS AND CONDITIONS

http://www.acquisition.gov/far/ https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i52_203-19 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#id189A70O0P1N https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1062680 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1048661 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1048698 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1063319

1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

___(2) 52.203-13, Contractor Code of Business Ethics and Conduct (Oct 2015) (41 U.S.C. 3509)).

____(3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009

(June 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and

Reinvestment Act of 2009.)

__X_(4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (Oct 2018) (Pub.

L. 109-282) (31 U.S.C. 6101 note).

____(5) [Reserved].

____(6) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-117, section 743 of

Div. C).

____(7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Oct 2016)

(Pub. L. 111-117, section 743 of Div. C).

_X__(8) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment. (Oct 2015) (31 U.S.C. 6101 note).

__X__(9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Oct 2018)

(41 U.S.C. 2313).

____(10) [Reserved].

____(11) (i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Nov 2011) (15 U.S.C.657a).

____(ii) Alternate I (Nov 2011) of 52.219-3.

____(12) (i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (Oct

2014) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).

____(ii) Alternate I (Jan 2011) of 52.219-4.

____(13) [Reserved]

____(14) (i) 52.219-6, Notice of Total Small Business Set-Aside (Nov 2011) (15 U.S.C.644).

____(ii) Alternate I (Nov 2011).

____(iii) Alternate II (Nov 2011).

____(15) (i) 52.219-7, Notice of Partial Small Business Set-Aside (June 2003) (15 U.S.C. 644).

____(ii) Alternate I (Oct 1995) of 52.219-7.

____(iii) Alternate II (Mar 2004) of 52.219-7.

_X___(16) 52.219-8, Utilization of Small Business Concerns (Oct 2018) (15 U.S.C. 637(d)(2) and (3)).

_X___(17) (i) 52.219-9, Small Business Subcontracting Plan (Aug 2018) (15 U.S.C. 637(d)(4))

_____(ii) Alternate I (Jan 2017) of 52.219-9.

_____(iii) Alternate II (Nov 2016) of 52.219-9.

____(iv) Alternate III (Nov 2016) of 52.219-9.

_____(v) Alternate IV (Aug 2018) of 52.219-9

_____(18) 52.219-13, Notice of Set-Aside of Orders (Nov 2011) (15 U.S.C. 644(r)).

_____(19) 52.219-14, Limitations on Subcontracting (Jan 2017) (15 U.S.C.637(a)(14)).

__X___(20) 52.219-16, Liquidated Damages-Subcontracting Plan (Jan 1999) (15 U.S.C. 637(d)(4)(F)(i)).

_____(21) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside (Nov 2011)

(15 U.S.C. 657f).

__X___(22) 52.219-28, Post Award Small Business Program Rerepresentation (Jul 2013)

(15 U.S.C. 632(a)(2)).

_____(23) 52.219-29, Notice of Set-Aside for, or Sole Source Award to, Economically Disadvantaged

Women-Owned Small Business Concerns (Dec 2015) (15 U.S.C. 637(m)).

_____(24) 52.219-30, Notice of Set-Aside for, or Sole Source Award to, Women-Owned Small Business

Concerns Eligible Under the Women-Owned Small Business Program (Dec 2015) (15 U.S.C. 637(m)).

__X___(25) 52.222-3, Convict Labor (June 2003) (E.O.11755).

__X_(26) 52.222-19, Child Labor-Cooperation with Authorities and Remedies (Jan 2018) (E.O.13126).

_X__(27) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

_X__(28) (i) 52.222-26, Equal Opportunity (Sept 2016) (E.O.11246).

____(ii) Alternate I (Feb 1999) of 52.222-26.

__X__(29) (i) 52.222-35, Equal Opportunity for Veterans (Oct 2015) (38 U.S.C. 4212).

__X__(ii) Alternate I (July 2014) of 52.222-35.

__X__(30) (i) 52.222-36, Equal Opportunity for Workers with Disabilities (Jul 2014) ____(29 U.S.C.793).

____(ii) Alternate I (July 2014) of 52.222-36.

http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1063504 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1063607 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1064087 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section6101&num=0&edition=prelim https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1064214 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1064243 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1062590 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section6101&num=0&edition=prelim https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1062651 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title41-section2313&num=0&edition=prelim https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057314 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section637a&num=0&edition=prelim https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057314 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057352 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057352 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057393 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057419 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057419 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057419 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i52_219-8 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i52_219-9 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i52_219-9 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i52_219-9 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i52_219-9 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i52_219-9 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057715 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057730 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057758 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057823 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057874 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057902 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057947 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1055332 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1055664 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1055713 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1055793 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1055793 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1056230 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title38-section4212&num=0&edition=prelim https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1056230 https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1056250 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title29-section793&num=0&edition=prelim https://acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1056250

__X__(31) 52.222-37, Employment Reports on Veterans (Feb 2016) (38 U.S.C. 4212).

__X__(32) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010)

(E.O. 13496).

_X___(33) (i) 52.222-50, Combating Trafficking in Persons (Jan 2019) (22 U.S.C. chapter 78 and E.O.

13627).

____(ii) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).

____(34) 52.222-54, Employment Eligibility Verification (Oct 2015). (Executive Order 12989). (Not applicable to the acquisition of

____(34) 52.222-54, Employment Eligibility Verification (Oct 2015). (Executive Order 12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial items as prescribed in 22.1803.)

____(35) (i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA–Designated Items

(May 2008) (42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

____(ii) Alternate I (May 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)©). (Not applicable to the acquisition of commercially available off-the-shelf items.)

____(36) 52.223-11,…