ANBE Testing Administrator Solicitation Amend 1.docx

Solicitation 2031JW21R00008 Entry-level Bank Examiner Candidate Assessment Services

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued.

This procurement is being made under the procedures in FAR Subpart 13.5 and 12.6.

Solicitation number 2031JW21R00008 is hereby issued as a request for proposals for Entry-level Bank Examiner Candidate Assessment Services in support of the Office of the Comptroller of the Currency (OCC). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2021-03. The relevant NAICS code for this acquisition is 611710 and the PSC is U002; this solicitation is released for full and open competition (no set-asides). There is no singular place of performance; services shall be performed nationwide (see solicitation performance work statement for details).

Responses to this solicitation are due no later than April 26, 2021 at 17:00 EST, by e-mail to Dwight.Shockency@occ.treas.gov and Thomas.Martin@occ.treas.gov.

Questions regarding this solicitation are due no later than April 8, 2021 at 17:00 EST, by e-mail to Dwight.Shockency@occ.treas.gov and Thomas.Martin@occ.treas.gov. Please submit all questions within Attachment 3 – Q&A. If questions are submitted, they will be answered en masse by amendment to this solicitation; questions will NOT be answered on an individual basis as they come.

The government point of contact for information on this solicitation is Dwight Shockency at Dwight.Shockency@occ.treas.gov or 202-649-5626 (e-mail is preferred).

Place of Performance: Within the USA nationwide.

All clauses and provisions listed in this document are applicable to this acquisition, and any and all addenda are within or attached. Per FAR 12.603(c)(2), the clauses and provisions at FAR 52.212-1, 52.212-2, 52.212-3, 52.212-4, and 52.212-5 are applicable and all addenda are within or attached to this solicitation.

Office of the Comptroller of the Currency’s Entry-level Bank Examiner Candidate Assessment Services Pricing

1.0 LINE ITEM DESCRIPTION

The Contractor shall furnish all technical, management, supervision, labor, materials, licensing, and any other support necessary to provide the services as described in the Performance Work Statement (PWS).

2.0 PRICING

The Contractor shall provide the services at a Firm Fixed Unit Price, except for CLINs 0006, 1006, 2006, 3006, and 4006 which shall be Time and Materials. The contract will consist of a base period and four one-year option periods. The option periods will be exercised at the sole discretion of the Government consistent with FAR 52.217-9.

Base Period: June 3, 2021 – June 2, 2022 Two (2) Campaigns

Option Period 1: June 3, 2022 through June 2, 2023 Two (2) Campaigns

Option Period 2: June 3, 2023 through June 2, 2024

(Optional) Un-proctored Test Assessment Fee

(Optional) Mobile Test Center

Option Period 3: June 3, 2024 through June 2, 2025

Option Period 4: June 3, 2025 through June 2, 2026

TOTAL OF ALL CLINs: __________________

Performance Work Statement

Entry-level Bank Examiner Candidate Assessment Process

1.0 PURPOSE AND OBJECTIVE

The purpose of this effort is to provide Entry-level Bank Examiner Candidate Assessment testing services that allow the Office of the Comptroller of the Currency (OCC) to fairly select qualified candidates for its entry-level bank examiner positions.

The Contractor shall (1) provide nationwide testing facility sites for entry-level candidates to complete required electronic assessments utilizing an automated assessment scoring technology; (2) provide commercial off-the-shelf options for writing and analytical skills assessments; (3) incorporate OCC’s knowledge test into the automated testing system; (4) provide scheduling and proctoring of the required assessments; (5) calculate and record candidates’ scores and provide results to the OCC; (6) maintain the data and provide the results to the OCC; (7) recommend and implement adjustments to assessment weighting and assessment cut scores based on score distributions.

It is essential that OCC has an alternate plan for administering the Entry-level Bank Examiner assessments if in-person proctored assessments are not an option due to a manmade or natural disaster/emergency causing testing center closures and stay-at-home orders, varying by each state. As an alternate solution, and option for the OCC, the Contractor shall provide an un-proctored and a virtual proctored solution for entry-level candidates to complete required electronic assessments delivered via a secured internet-based testing platform.

2.0 BACKGROUND

The OCC was established in 1863 as a bureau of the Department of the Treasury. It is responsible for regulating and supervising the national banking system. The OCC charters, regulates, and examines approximately 1,220 national banks and 57 federal branches and agencies of foreign banks in the United States. The OCC's nationwide staff of examiners conducts on-site examinations of national banks and provides sustained supervision of bank operations. Its mission is to ensure a safe, sound, and competitive national banking system that supports the citizens, communities, and economy of the United States.

The OCC hires approximately 150 entry-level bank examiners (also known as Assistant National Bank Examiners (ANBE)) every year in two recruitment campaigns, one in the fall and one in the spring. Applications are received during set dates in the campaigns in September (fall) and February (spring). Applications are received via an online Applicant Tracking System (ATS) developed by Monster Government Solutions (MGS), hosted by the Department of Treasury’s Enterprise Business Solutions and administered by the OCC.

Applicant qualifications are auto screened via self-certification in the ATS. If the applicant self-certifies, the applicant receives an invitation to proceed to the next step in the process. As part of this next step, candidates are currently tested on a multiple-choice Knowledge Test (KT), a Written Communications Skills Test (WCST), and an Analytical Skills/Critical Thinking Skills test. Annually, the OCC tests approximately 1,200 - 2,000 candidates over the two recruitment campaigns.

Candidates who pass the three tests have their qualifications verified and are then recommended for the assessment (or testing) phase of the selection process in which each candidate will be required to pass three assessments with breaks in between. The OCC, with support from the Contractor, will annually evaluate the performance of the assessments to determine if more or fewer, or alternate assessments are needed.

3.0 SCOPE

NOTE: FAR clause 52.222-41, Service Contract Labor Standards (Aug 2018) applies to this acquisition. Wage determinations cannot be provided within the text of this contract due the scope of the requirement (throughout the entire United States). Notwithstanding the absence of a printed wage determination in this contract, the Contractor shall adhere to the wage determination appropriate to each locality appropriate for the employee(s) within said area. Wage determinations can be found at https://beta.SAM.gov.

The Contractor shall provide the full range of services necessary to successfully achieve the requirements described in this Performance Work Statement (PWS).

3.1 Testing Web-portal and Services (CLIN 0001, 1001, 2001, 3001, 4001)

The Contractor shall provide all data automation, programming, and related services necessary to electronically administer the ANBE Assessments in accordance with the requirements specified herein. The minimum key performance parameters for the online testing web portal include:

1. Test Web-Portal Requirements

a) Provide an easy-to-use interface for both OCC users and candidates.

b) Provide an administrator web portal to upload approved candidates with a unique identifier for testing, including first name, last name, email address, and zip code.

c) Use a unique identifier for each candidate that is generated by OCC’s ATS (Career Connector) to integrate the candidate test data and the ATS application data throughout the process, and allow the candidate’s test results and test session to be tied to that unique identifier.

d) Provide a scheduling web portal allowing candidates to self-register and schedule tests during set dates.

e) Provide candidates with the ability to submit reasonable accomodation requests during the test scheduling process and alert OCC by the next business day to review and approve the request via email.

f) Provide the hardware, software, internet connection, and confidential testing web portal to administer tests for physical testing sites.

g) Provide a confidential testing web portal, for a proctored and un-proctored setting, for applicants to take the assessments (e.g., Knowledge Test, Written Communication Test and Analytical Reasoning Test), including the ability to provide instructions for use.

h) Provide information to candidates in the testing environment, such as:

i. Welcome information

ii. Instructions

iii. Thank you message

iv. Pass/Fail and Next Step Notifications

i) Score and make test scores available to designated OCC POC(s) online for export to an excel spreadsheet, or another usable format, that is sortable, searchable, and with the ability to filter results.

j) Provide a web-based OCC administrator web portal to house and provide real-time records of the full assessment process, along with reporting capabilities to manage the assessment program. Examples of required reporting capabilities include data on how many applicants have scheduled, tested, not tested, passed/failed test, and the number of miles each candidate has traveled to take the assessment, etc.

k) Score and display a preliminary pass/fail grade to each test candidate after either: 1) the candidate immediately finishes and submits the test; or

2) immediately after the test is automatically terminated due to allotted test time expiring.

l) The test application must accurately time each test and terminate the test once the allotted time is up.

m) The application must provide an on-screen tutorial/instruction explaining how each of the tests works. This tutorial must be provided prior to the test beginning and during the entire test. The tutorial shall cover an explanation of the multiple-choice test format for the Knowledge Test (KT), the procedures for answering questions, reviewing, and changing answers, and submitting the completed tests. The on-screen tutorial display shall also include the time limit, time remaining, and a pass/fail notification.

n) Provide a statement that notifies candidates who do not pass that they will not be allowed to continue to the next test. The OCC will provide the contractor this language within 30 calendar days of contract award.

o) Provide a statement at the conclusion of the tests advising candidates of their next steps. The OCC will provide the contractor this language within 30 calendar days of contract award.

p) Depending on the vendors test hurdling process, pass/fail notifications will be provided to test candidates after each test assessment. And then the overall results shall be emailed to the candidate within 48 hours of completion of all three tests.

q) The Contractor shall provide protection and security of all test and test-related data, and candidate data. The Contractor shall ensure that the application, test-delivery methodology, and equipment/server are functioning properly, and must provide an immediate response and solution if errors or problems occur.

r) The Contractor shall be responsible for “end-to-end” availability of testing resources, such as servers which host the assessments and the hardware/software provided, as well as being available on both the client and server side.

s) Conduct quality control to ensure that the tests are fully operational and accessible by the test candidates and provide documentation to the COR after each real-time incident (i.e. inaccessibility issues, weather, power outages, etc.).

t) Provide a campaign debrief that covers lessons learned and recommendations for overall program improvement.

u) The Contractor shall work with assigned OCC industrial-organizational (IO) psychologists to set and validate cut scores for the validated commercial off-the-shelf tests, as well as implementing the scoring scenario for all assessments on the testing web portal.

v) Ensuring test materials are safeguarded to prevent unauthorized exam content exposure, such as ensuring test centers are locked after hours and ensuring tests can only be accessed by specific pre-determined IP addresses at the testing centers.

2. Test Assessment Services

a) Provide, validate, administer, and score a commercial off-the-shelf Written Communication Skills and Analytical Reasoning test that have been validated by an IO psychologist for use with the 0570 occupational series. Note that Written Communication and Deductive and Inductive Reasoning have been identified as critical competencies in an ANBE job analysis.) The Contractor shall provide multiple versions of the tests that can be alternated across campaigns or are computer adaptive and may be used in a proctored, virtual proctored or un-proctored setting. The following are the requirements for each commercial-off-the-shelf test:

1. The Written Communication test is a critical assessment to have in the overall process due to the need to measure written communication skills that must be brought to the job. The test shall, at a minimum, measure grammar, syntax and structure, spelling, organization of writing, vocabulary and word selection, focus, attention to subject, flow, and coherence.

2. Another critical skill of the entry-level bank examiner is the ability to analyze data, recognize and understand patterns or trends in data, and develop recommendations based on data. The Analytical Reasoning Test should measure analytical or critical thinking skills.

b) The Contractor shall provide IO psychologist support to determine the appropriate cut scores for both the Written Communication and Analytical Reasoning tests. The Contractor shall provide technical documentation of the process used to set and adjust cut scores each time cut scores are set or adjusted. This document shall satisfy the requirements of the technical and professional standards governing such work behind determining appropriate cut scores.

c) The Contractor shall also work with OCC assigned IO psychologists and the Program Manager to set up processes for evaluating, setting, and applying a weighting paradigm across the three assessments. The weighting paradigm and score combination shall be applied during the Fall 2021 campaign. At the conclusion of the campaign or year, and at the discretion of the OCC, the Contractor shall work with the OCC to examine the results of the cut scores and weighting paradigm to ensure the scores and weights are performing as predicted. The Contractor shall adjust the weighting paradigm and score combination, as necessary/requested. This will include reviewing applicant flow (and appropriate demographic data, where available) to verify cut scores are set at optimal levels; the cut score shall represent the level of competency that is required to be minimally qualified. The results shall be validated by the contractor annually to ensure the scores and weights are performing as expected for all active assessments. The Contractor shall use the weighting and score combination paradigm when administering the tests.

d) The OCC may elect to add or remove tests, including tests of different competencies from the battery at its discretion. If one or more new tests are chosen, the Contractor shall work with the OCC to examine the results of the cut scores and weighting paradigm to ensure the scores and weights are performing as expected at the conclusion of the campaign or year. If the new tests are obtained from the Contractor, the Contractor shall validate such tests for use in the ANBE battery and establish associated cut scores.

3. Data Management

a) Accurately record scores and provide data management capabilities to the OCC, such as via the use of dashboards that authorized OCC POC(s) can access to gain visibility into the testing web portal. The system shall provide reporting on individual applicant responses, as well as provide aggregate data extractions for off-line analysis as standard functionality.

b) Provide a central repository for real-time test results within the administrator web portal, enabling OCC to have accurate and timely information. OCC administrators shall be able to see if the candidate has accessed the site to schedule, see if sessions have been scheduled, check-in for a session, or has completed their scheduled appointment, as well as candidate test results.

c) The OCC shall own all test results data.

d) The Contractor shall certify that all non-public agency information is purged at the conclusion of the contract consistent with 3.9 INFORMATION SECURITY AND PRIVACY REQUIREMENTS.

3.2 In-Person Proctored Test Assessment (CLIN 0002, 1002, 2002, 3002, 4002)

1. At the request of OCC, the Contractor shall provide the use of an in-person proctored assessment process.

2. The Contractor shall provide a network of nationwide physical testing sites for candidates to travel to take the assessments. The Contractor shall have a network of at least 500 established, computer-based testing centers across the United States, with at least one in each state. As used herein “established” means facilities that are regularly used for electronic testing purposes. Historically, locations have been near accredited colleges and universities, where at least 90% of candidates have traveled within 2 hours (or 120-mile radius) to a testing center.

3. The test centers shall be compliant with Americans with Disabilities Act, 42 U.S.C. Section 12101 et seq. (ADA) and all Electronic Information Technology used for testing within the facility compliant with Rehabilitation Act of 1973, as amended, 29 U.S.C 794d (Section 508)

4. The Contractor shall provide reasonable accommodations approved by the OCC during the scheduling phase.

5. The test centers shall be open during normal business hours for candidate testing. “Normal business hours” means between the hours of 8:00 a.m. and 5:00 p.m. locally, Monday through Friday.

6. The Contractor shall provide convenient parking/access and convenient access to mass transit where available.

7. The Contractor shall send email reminders to applicants to help minimize no-shows at the testing centers for proctored testing. (See CLIN 4 for applicable No-Show Fees.)

8. The Contractor’s facilities shall allow each candidate to be tested in his/her own test carrel to provide a distraction-free, secure, temperature controlled, and well-lit environment. The Contractor’s facilities shall otherwise meet acceptable standards for a commercial marketplace computer-based testing environment.

9. The Contractor shall administer the test to the OCC candidates at the approved physical test centers via a testing web portal, in accordance with Section 3.1.

10. Candidates eligible to complete all three tests shall not exceed 4 hours of combined testing and break times. All candidates shall be given the allotted time for each test and each break.

11. The Contractor shall administer, proctor, and score a multiple-choice Knowledge Test (KT) provided by the OCC. Candidates shall be given 60 minutes for the KT. The OCC will provide the KT within 30 days of the testing period.

12. The Contractor shall provide and score the validated Written Communication Skills Test and Analytical Reasoning test. Candidates shall be given the appropriate allotted times as agreed upon during the validation process.

13. For each campaign, the Contractor’s test centers shall be ready to administer the test to any approved OCC candidate who has scheduled the test(s).

14. The Contractor shall provide trained test center personnel to serve as proctors to administer the tests taken by candidates.

15. Before allowing any candidate to take the test, the test center’s personnel shall make visual verification of the candidate’s identity. To verify their identity, candidates shall be required to produce a government-issued photo ID that also bears the candidate’s signature. The Contractor shall not allow any candidate that does not have the required identification to take the tests.

16. Once the candidate’s identity has been verified, the test center’s personnel shall provide the candidate with a brief description of the policies and procedures of the test center and shall then answer questions posed by the candidate that are of an administrative nature.

17. The test center shall provide pre-test instructions to inform the candidate of important information prior to the start of the tests, such as testing room restrictions and consequences for the breach of testing policies, such as cheating.

18. The test center’s personnel shall provide the candidate with scratch paper, a basic calculator, a pencil and/or pen. The candidate is not allowed to bring personal articles, such as coats, briefcases, purses, cell phone, paper, pen, and reference material, into the testing area. The test center shall provide lockers for candidates to lock their personal items while taking the test.

19. The test center’s personnel shall escort the candidate to his/her test carrel and shall verify that the test program is on the screen and ready for the candidate’s use.

20. The test center shall have a proctor monitor the testing session to ensure that the candidate(s) is taking the test in a fair manner and that security of the test is not breached. If problems or irregularities are noted, the Contractor shall document them in the form of an incident report in the proctor console and notify the COR within 24 hours via email of the date of the test was taken or the following Monday if the test was taken on Friday.

21. The test center’s proctor shall verify that the candidate was present through the entire time the test was in progress. Breaks are permitted, but only between each test and during the allotted time.

22. At the end of the test, the test center’s personnel shall collect all materials from the candidate and shred any paper related items.

In the event of inclement weather, manmade or natural disasters, and/or stay-at-home orders, the test center shall notify scheduled candidates via email and/or phone of test center closure and allow the candidate to reschedule an additional session at no cost to the OCC.

3.3 Virtual Proctored Test Assessment (OPTIONAL CLIN 0003, 1003, 2003, 3003, 4003)

1. At the request of OCC, the Contractor shall provide the use of a virtual proctored assessment process.

2. The Contractor shall provide a secure internet-based scheduling and testing platform for candidates to schedule and take the assessments.

3. The tests provided by the Contractor shall be available by traditional (desktop, laptop) means.

4. The Contractor shall provide a method for administering virtual proctored tests that should not require the candidate to possess anything more than an internet connection, a device, a webcam, and a microphone.

5. The Contractor shall provide a live virtual proctor to monitor candidates completing the assessments.

6. The Contractor shall provide plans/information on how test security is maintained, and what processes will be in place to prevent cheating. See Section 3.8 Deliverables.

7. The Contractor shall provide a method for verifying candidate identity.

8. The Contractor shall provide reasonable accommodation requests approved by the OCC during the scheduling and testing phase. See Section 3.8 Deliverables.

9. Candidates eligible to complete all three tests shall not exceed 4 hours of combined testing and break times. All candidates shall be given the allotted time for each test and each break.

10. The Contractor shall administer and score a multiple-choice Knowledge Test (KT) provided by the OCC. Candidates shall be given 60 minutes for the KT. The OCC will provide the KT within 30 days of testing period.

11. The Contractor shall provide and score the validated Written Communication Skills Test and Analytical Reasoning test. Candidates shall be given the appropriate allotted times as agreed upon during the validation process.

12. The Contractor’s test web portal shall be ready to administer the test to any approved OCC candidate during the approved test dates.

13. The Contractor shall provide support for candidates experiencing technical problems.

3.4 Un-proctored Test Assessment (OPTIONAL CLIN 0004, 1004, 2004, 3004, 4004)

1. At the request of OCC, the Contractor shall provide the use of an un-proctored assessment process.

2. The Contractor shall provide a secure internet-based scheduling and testing platform for candidates to schedule and take the assessments.

3. The tests provided by the Contractor shall be available by traditional (desktop, laptop) means.

4. The Contractor shall provide a method for administering un-proctored tests that should not require the candidate to possess anything more than an internet connection, a device and whatever is required to verify identity.

5. The Contractor shall provide plans/information on how test security is maintained, and what processes will be in place to prevent cheating. See Section 3.8 Deliverables.

6. The Contractor shall provide a method for verifying candidate identity.

7. The Contractor shall provide reasonable accommodation requests approved by the OCC during the scheduling and testing phase.

8. Candidates eligible to complete all three tests shall not exceed 4 hours of combined testing and break times. All candidates shall be given the allotted time for each test and each break.

9. The Contractor shall administer and score a multiple-choice Knowledge Test (KT) provided by the OCC. Candidates shall be given 60 minutes for the KT. The OCC will provide the KT within 30 days of testing period.

10. The Contractor shall provide and score the validated Written Communication Skills Test and Analytical Reasoning test. Candidates shall be given the appropriate allotted times as agreed upon during the validation process.

11. The Contractor’s test web portal shall be ready to administer the test to any approved OCC candidate during the approved the test dates.

12. The Contractor shall provide support personnel for candidates experiencing technical problems.

3.5 No Show Proctored Assessment Fee (CLIN 0005, 1005, 2005, 3005, 4005)

This CLIN is applicable to proctored exams only. The Contractor may charge a flat fee for each candidate that registered for an exam and failed to appear without giving 24-hour notice.

3.6 Mobile Test Center Requirements (OPTIONAL CLIN 0006, 1006, 2006, 3006, 4006)

1. The requirements for logistical planning and placement of Mobile Centers are based upon sites at all fifty U.S. states.

2. At the request of OCC, the Contractor shall provide a plan for mobile test center usage in locations where a physical or local testing facility is not available within a 2-hour drive from their residence or is in a remote location within one week of the request.

3. The Contractor shall allow the OCC to choose the city and date(s) to have a mobile test center.

a. The OCC shall request the location, but logistics are handled by the Contractor and final location is based on availability of space.

b. The OCC shall be given 48-hours to select a location.

4. The Contractor shall allow the candidates to register and schedule tests during the set date(s) provided by OCC via the scheduling web portal.

a. Candidates must schedule and register during the time window defined, up to the date of the mobile test center. Once the mobile test has occurred, candidates shall not be allowed to schedule at that facility.

5. The Contractor’s mobile testing facilities shall allow each candidate to be tested in his/her own test carrel to provide a distraction-free, secure, temperature controlled, and well-lit environment. The Contractor’s mobile facilities shall otherwise meet acceptable standards for a commercial marketplace computer-based testing environment.

Note: Historically, mobile test centers have been used one to two times a year with about 10-15 students/test takers per site.

3.7 Reasonable Accommodations (CLIN 0007, 1007, 2007, 3007, 4007)

The Contractor shall provide the ability to make individual testing exceptions for candidates needing reasonable accomodations (e.g., extended test time, solitary testing areas) based on OCC’s approval of requests.

3.8 DELIVERABLES

Note: These deliverables are in addition to the IT deliverables listed in section 5.0, Part L - Security and Privacy Vendor Deliverables.

3.9 PERFORMANCE REQUIREMENTS SUMMARY

The following factors are those that the government considers to be key performance factors for this requirement. The standards are set for each of the factors and the measurements will be the surveillance method that the government will use. The acceptable quality level describes the level the government will accept. If the acceptable quality levels are exceeded, met, or not met during performance evaluation, the government will make note in the Contractor Performance Assessment Reporting System (CPARS).

4.0 ICT Accessibility Requirements

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities. As such, the following requirements apply to this contract:

1. Products, platforms and services delivered as part of this performance work statement that are ICT, or contain ICT, must conform to the Revised 508 Standards, which are located at 36 C.F.R. § 1194.1 & Apps. A, C & D, and available at https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines

1. E102 / 702.10 – Web Content Accessibility Guidelines (WCAG) success criteria level A & AA are incorporated as a requirement. The referenced WCAG criteria is available at http://www.w3.org/TR/WCAG20/

1. E202 – No General Exceptions Authorized by OCC The following items are identified as containing ICT:

· ALL APPLICABLE DELIVERABLES IN SECTION 3.0

Applicable Functional Performance Criteria: All functional performance criteria apply when using an alternative design or technology that achieves substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4-6 of the Revised 508 Standards, or when Chapters 4-6 do not address one or more functions of ICT.

Applicable requirements for software and Web products:

· E207 – WCAG Level A & AA Success Criteria

· E302 – Functional Performance Criteria

· E502 – Interoperability with Assistive Technology

· E503 – Application

· E501 – Web-based applications, independent of platform services Applicable requirements for electronic documents and/or support services:

· E205 – WCAG Level A & AA Success Criteria

· E302 – Functional Performance Criteria

· E602 – Support Documentation

· E603 – Support Services

5.0 INFORMATION SECURITY AND PRIVACY REQUIREMENTS

Security Requirements (applicable to cloud (FedRAMP and non-FedRAMP) and Commercial Service offerings)

A. Compliance with Applicable Laws, Regulations, and Standards

The contractor shall support the OCC in maintaining its compliance requirements under the Privacy Act of 1974 (5 U.S.C. 552a - the Act) and the Federal Information Security Modernization Act of 2014 (Public Law 107-347) (FISMA). The contractor shall provide the OCC with information as requested to support the creation and maintenance of the System Security and Privacy Plan, Digital Identity Plan, Privacy Impact Assessment, Plans of Action and Millstones, and Risk Based Decisions.

Secure Communications Standards. All user-to-cloud service communications (e.g., via internet) must be encrypted incompliance with NIST FIPS 140-3 “Security Requirements for Cryptographic Modules.”

Protection of Controlled Unclassified Information. The contractor shall adhere to the requirements of NIST SP 800-171 Rev 1 “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations” to protect OCC Controlled Unclassified Information.

B. General Requirements

Compliance. Either a commercial service offering or a FedRAMP certification—with the intent to leveraging the cloud FedRAMP processes and deliverables—is acceptable.

Location. Information collected, used, stored, maintained, or otherwise processed by the contractor in the performance of this contract shall be accessed, transferred, stored or processed only within the United States. In addition, the maintenance and support operations of the contractor's technology and information must take place, and originate from, within the United States.

The contractor shall not host any portion of the information, information system, infrastructure, or environment in facilities outside the contiguous United States, Alaska, Hawaii, and other U.S. Territories.

Authorization to Use, Store, or Share Sensitive Information. The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all government data, equipment, etc. by treating the information as sensitive. All information gathered or created under this contract shall be considered as Controlled but Unclassified (CUI) information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets.

Confidentiality. The contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

Deliverables. The deliverables in this contract will be considered sensitive and shall not be shared with any other organization without prior approval from the OCC Contracting Officer (CO).

C. Security and Privacy Authorization

Authorization Boundary. The contractor shall provide a diagram specific for the OCC, that clearly demarcates the information system authorization boundary and depicts all of its connections and components, including the means for monitoring and controlling communications at the external boundary and at key internal boundaries within the system. The contractor shall address all components and managed interfaces of the information system authorized for operation (e.g., routers, firewalls). The diagram must include a predominant border drawn around all system components and services included in the authorization boundary.

If there are OCC-specific components (e.g., components developed or customized for the OCC, OCC-hosted components, etc.) and/or other components supporting this solution that are not in the scope of the contractor's existing security documentation, then identify those components in the diagram as well, as part of a separate OCC-specific boundary since those are unique to OCC and shall be part of the OCC-specific security authorization. The diagram must be easy to read and understand. Formal names of components as they are known at the service provider organization in functional specifications, configuration guides, other documents and live configurations shall be named on the diagram and described. The contractor shall provide a key for symbols used.

Customer Responsibilities. The contractor shall provide a detailed list of all customer responsibilities assigned to the OCC, as defined by the vendor and documented in the Customer Responsibilities Matrix (CRM).

For each customer responsibility, the contractor shall identify whether the contractor will be addressing the responsibility under the contract in order to fully meet the requirements specified in this PWS, or whether the responsibility will be assigned to the OCC. The contractor shall provide the CRM as directed in the "Security and Privacy Vendor Deliverables" section.

External Service Provider Compliance & Monitoring. NIST Special Publication 800-37, as amended, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy.

FISMA and OMB policies require that federal agencies using external service providers to process, store, or transmit federal information or operate information systems on behalf of the federal government, assure that such use meets the same security requirements that federal agencies are required to meet. Security requirements for external service providers including the security controls for external information systems are expressed in contracts or other formal agreements. External Service Provider Compliance and Monitoring.

Organizations are responsible and accountable for the information security risk incurred by the use of information system services provided by external providers. Such risk is addressed by incorporating the Risk Management Framework (RMF) as part of the terms and conditions of the contracts with external providers.

Organizations can also require external providers to provide appropriate evidence to demonstrate that they have complied with the RMF in protecting federal information. Prior to the implementation of the contractor's system or services, the OCC will provide an Authorization to Operate (ATO) or Authorization to Use (ATU), based on the findings of the OCC's analysis of the system or services IT security and privacy controls.

If the contractor provides a commercial service, the following requirement applies:

Non-Federal External Service Provider Security Documentation. Non-federal organizations with primarily non-federal customers have limitations with respect to complying with all federal requirements. As a result, the OCC obtains assurance through other industry standard security reviews, including Statement on Standards for Attestation Engagements (SSAE) No. 18.

a. Statement on Standards for Attestation Engagements (SSAE) No. 18 Requirements. The contractor shall provide the OCC with an SSAE 18 System and Organization Controls (SOC) 2 Type 2 Report on an annual basis for services provided.

b. The preferred coverage period for the report is July 1 through June 30 with a bridge letter covering the three months to September 30.

c. For any gaps in the fiscal year coverage period (October 1 - September 30), the OCC will work with the contractor to complete the internal controls assessment by relying on the work performed by the contractor's competent and objective internal audit function per Statement on Auditing Standards No. 128, Using the Work of Internal Auditors.

d. The submission of the results of the SSAE 18 SOC 2 Type 2 Report shall be as instructed per the "Security and Privacy Vendor Deliverables" section.

e. If SOC 2 Type 2 reports are not available within the last three years, the contractor shall inform the OCC to determine if there is a suitable alternative with similar level of information and detail.

f. If any portion of standard security objectives (e.g., contingency planning controls, etc.) were not in the scope of the independent auditors testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2 report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

OCC Security Authorization to Use. The determination of whether to issue an OCC security authorization will be made by the OCC based on the identified risks to the OCC's data and operations. These risks include: (1) deficiencies noted in the contractor's most recent SOC 2 Type 2 Report, (2) the gaps identified in the IT security and privacy control assessments performed specific to OCC customer responsibility implementations as designated in the CRM.

FIPS 199 System Security Category. It is anticipated that the Federal Information Processing Standard (FIPS) 199 system security categorizations for the ANBE Testing Administrator will be FIPS 199: Low. If the contractor provides a public cloud Federal Risk and Authorization Management Program (FedRAMP) FIPS 199: Low control baseline, which is based on the Federal Information Security Modernization Act of 2014 (FISMA) security and privacy requirements for a FIPS 199: Low impact system, applies to the contractor and the contractor systems supporting these public cloud services.

D. Configuration Management

Security Configuration Settings. The contractor shall establish and enforce security configuration settings for information technology products employed in the ANBE Testing Administrator.

Security Updates and Patches. The contractor shall ensure that the ANBE Testing Administrator is properly maintained and monitored, to include immediate response to critical security patches, routine maintenance windows to allow for system updates, and compliance with the defined configuration management and change control processes. All patches and system updates shall be properly tested in a development environment before being implemented in the production environment.

Least Functionality. The contractor shall restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services for information technology products employed in the ANBE Testing Administrator.

E. Continuous Monitoring

Compliance Reviews and Audits. The contractor shall permit and support compliance reviews and audits under applicable laws to allow the OCC to meet legal and compliance obligations and shall implement processes that allow visibility into the privacy and security controls employed and their effectiveness. The contractor shall provide the OCC or authorized designated officials with information requested by auditors in a timely manner, consistent with the respective auditor's deadline, in support of security compliance reviews and various annual audits, e.g., FISMA, Financial Statement Audit, A-123, etc.

In addition, the contractor shall provide the OCC or authorized designated officials logical and physical access.

to the contractor's facilities, installations, technical capabilities, operations, records, and databases pertinent to this contract within seven (7) calendar days upon request for these purposes.

Continuous Monitoring Reports. The contractor shall submit monthly continuous monitoring reports to the OCC as directed in the "Security and Privacy Vendor Deliverables" section. At a minimum, the continuous monitoring reports shall detail vulnerabilities identified, secure configuration compliance findings and status, open POA&Ms; accepted risks status and rationale, and independent assessments planned/completed.

If the contractor is not providing a FedRAMP authorized cloud solution, the following requirement applies:

Annual SOC 2 Type 2 Reviews. As mentioned in Section C. "Security and Privacy Authorization," under SSAE 18 requirements, the contractor shall provide the annual SSAE 18 SOC 2 Type 2 report to the OCC for review in support of continuous monitoring activities. If any portion of standard security objectives (e.g., contingency planning controls, etc.) were not in the scope of the independent auditor's testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2 report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

If the contractor is providing a providing a FedRAMP authorized cloud solution, the following requirements apply:

Annual 3PAO Security Assessment Report and Package Review. As mentioned in Section C.