RFI Draft SOW_Actuarial Liabilities Valuation Services.pdf

DRAFT - Statement of Work (SOW) - DRAFT OCC's Actuarial Liabilities Valuation Services

1.0 GENERAL

The Office of the Comptroller of the Currency (OCC) charters, regulates, and supervises all national banks and federal savings associations as well as federal branches and agencies of foreign banks. The OCC was established in 1863 as an independent bureau of the U.S. Department of Treasury. Headquartered in Washington, DC, the OCC has four district offices of which it supervises all activities of national banks.

The Comptroller of the OCC, serves as the chief executive of the OCC. The President appoints the Comptroller for a 5-year term with the advice and consent of the Senate. The Comptroller also serves as a Director of the Federal Deposit Insurance Corporation (FDIC) and NeighborWorks America.

The OCC's nationwide staff of bank examiners conducts on-site reviews of national banks and federal savings associations and provides sustained supervision of these institutions’ operations. Examiners analyze loan and investment portfolios, funds management, capital, earnings, liquidity, sensitivity to market risk for all national banks and federal thrifts, and compliance with consumer banking laws for national banks and thrifts with less than $10 billion in assets. These Examiners also review internal controls, internal and external audit, and compliance with law. In addition, the OCC’s Examiners evaluate OCC Manager's ability to identify and control risk.

In regulating national banks and federal thrifts, the OCC has the power to:

• Examine the national banks and federal thrifts;

• Approve or deny applications for new charters, branches, capital, or other changes in corporate or banking structure;

• Take supervisory actions against national banks and federal thrifts that do not comply with laws and regulations or that otherwise engage in unsound practices. Remove officers and directors, negotiate agreements to change banking practices, and issue cease and desist orders as well as civil money penalties; and

• Issue rules and regulations, legal interpretations, and corporate decisions governing investments, lending, and other practices

2.0 BACKGROUND

The OCC is a non-appropriated federal financial regulatory agency with offices throughout the United States.

The majority of employees are located in Washington, DC. As of January 2023, the OCC had approximately 3,633 employees with the following demographics:

Gender Employee Count Average Age Average Salary Average Years of

OCC Service

Male 2039 44.6 164,405.51 11.49

Female 1594 46.5 161,716.27 12.8

In 1981, the OCC began to offer a group life insurance program in addition to Federal Employee Group Life Insurance (FEGLI). The OCC Group Life Plan allows eligible employees to elect basic coverage equal to their adjusted base salary rounded up to the nearest $1,000 and then adding $2,000. An equal amount of accidental death and dismemberment insurance is automatically included. Employees under the age of 35 also get an additional benefit where the amount of basic insurance is doubled. This additional benefit begins to reduce by 10 percent (%) per year at age 36 until it is eliminated at age 45. Executives are automatically covered for $500,000 worth of coverage at no cost to them.

In addition, employees may elect OCC supplemental coverage in three different categories as follows:

• Option 1 allows employees to elect additional coverage in increments of $25,000 up to $500,000;

• Option 2 allows employees to elect spouse/domestic partner coverage equal to either 50% or 100% of their basic insurance amount; and

• Option 3 allows employees to elect dependent coverage in increments of 1 to 5 with each increment equaling $5,000 of spouse coverage and $2,500 of coverage on each dependent child

Employees may participate in both programs, FEGLI only, OCC Group Life Plan only, or elect no coverage.

Employees receive a 70% subsidy to the OCC Group Life Plan basic coverage if they are covered under OCC Group Life Plan only and a 30% subsidy if they are also covered under FEGLI. Employees pay the entire cost of any supplemental coverage.

As of January 2023, approximately 1,108 a c t i v e employees have OCC Group Life Plan only, 1 , 3 5 1 have FEGLI and OCC Group Life Plan, 6 4 9 have FEGLI only and 327 have no coverage. For active employees the current volume is approximately $438,686,000 for OCC Basic; $451,425,000 for OCC Option 1 – employee coverage; and $151,620,500 for OCC Option 2 – spouse coverage.

As of August 1, 2012, the OCC Group Life Plan covers two retiree groups, which includes OCC regular retirees and former Office of Thrift Supervision (OTS) retirees. There are approximately 2,062 OCC regular retirees and 646 former OTS retirees, which is referred to as the frozen grandfathered retiree group. This group consists of former OTS employees who retired on or before July 28, 2012.

The current volume is $122,968,750.00 for the regular retiree group, and $67,433,500.00 for the OTS frozen grandfathered retiree (OFGR) group.

The OCC Group Life Plan is funded on a "non-participating” arrangement.

OCC Regular Retiree Group: OCC employees are allowed to carry their basic insurance amount into retirement at no cost or reduce their basic insurance amount to $50,000 in order to avoid imputed income. The election to reduce the coverage amount to $50,000 can be made at any time after retirement. The coverage amount reduces to 25% of the original face value at age 65, regardless of which option is chosen. Any supplemental coverage amounts may be converted to individual plans.

OTS Frozen Grandfathered Retiree Group: This is a closed group of retirees (previously matched FEGLI). They are former OTS retirees, and the coverage amount is based on the class of employee. They were able to elect the reduction amount at age 65 and they were able to carry spouse or domestic partner benefits with two options into retirement. The plan provision for this group is listed below.

Coverage limits (for OFGR): The coverage limits for Basic Life Insurance are as follows -

• Former OTS Executives, the basic insurance amount is an amount equal to three times the annual adjusted base salary, rounded up to the next higher thousand, to a maximum of $800,000.

• Former OTS Senior Managers, the basic insurance amount is an amount equal to three times the annual adjusted base salary, rounded up to the next higher thousand, to a maximum of $600,000.

• All Other Former OTS Retirees, the basic insurance amount is an amount equal to two times the adjusted base salary, rounded up to the next higher thousand, to a maximum of $300,000.

Age 65-Reduction Options (for OFGR non-retired): The age 65-reduction must be elected upon retirement. The reduction options are as follows -

• 75% reduction of the basic insurance amount; the OCC will pay 100% of the coverage that remains.

• 50% reduction of the basic insurance amount; the OCC will pay 50% of the coverage that remains, and the retiree will be responsible for the remainder.

• No reduction of the basic insurance amount; the OCC will pay 25% of the coverage that remains, and the retiree will be responsible for the remainder.

Spouse/Domestic Partner Life Plan Benefits (for OFGR): Coverage may be provided for the retiree’s spouse or domestic partner through the spouse (OCC employee). The spousal or domestic partner coverage must be the same level (25%, 50%, or 100% of the basic insurance amount) as that elected by the retiree. This amount will be the starting point for the 50% or 100% election amount. The coverage amount is capped at $300,000 for all retirees. The OCC retiree is responsible for the full cost, and it is based on the retiree’s age. A retiree can choose from one of the two following levels of coverage -

• 50% of Basic Insurance Amount - spouse or domestic partner can be insured for a benefit equal to 50% of the retiree’s basic life benefit not to exceed cap of $300,000.

• 100% of Basic Insurance Amount - spouse or domestic partner can be insured for a benefit equal to 100% of the retiree’s basic life benefit not to exceed cap of $300,000.

3.0 OBJECTIVE

The objective of the resulting contract will be to obtain valuation services of the OCC’s future member’s postretirement life insurance actuarial liabilities of its retiring employees’ benefits to assess and project the total spend for those benefits.

4.0 PERFORMANCE REQUIREMENTS

The Contractor shall perform a full scope actuarial valuation of the OCC’s postretirement life insurance benefits plan liability for the fiscal year beginning October 1, in accordance with generally accepted actuarial principles and practices including the applicable Actuarial Standards issued by the Actuarial Standards Board, for the OCC regular retiree group and OTS frozen grandfather retiree group.

Transition Support Services – The Contractor will be required to describe the transition, phase-in and phase-out, including extracting, data recovery, data retention, transfer within a 30 or 60-day window. Details regarding data rights, terms of use, and any other agreements should be presented with the response (excluded from page limitation; hyperlinks embedded in the response to the online agreement(s)/terms are permissible).

Valuation Assessment Services - The purpose of this valuation is to fulfill OCC's accounting requirements under FASB Accounting Standards Codification (ASC) 715-60, Compensation Retirement Benefits, to determine costs for its post retirement Life Insurance plans.

The Contractor shall determine the appropriate assumptions in accordance with the valuation of postretirement benefits under FASB ASC 715-60. These assumptions typically fall into two general categories, economic and demographic. The Contractor shall review the assumptions made in the OCC's Postretirement Life Insurance Benefits Actuarial Valuation Report for the prior Plan Year Beginning October 1, which will be provided as Government Furnished Information to the Contractor. The Contractor shall develop and recommend to the OCC the appropriate assumptions for the requirements of this work scope and provide these assumptions to the Government official who will obtain the appropriate OCC management agreement on the assumptions recommended by the Contractor. The Government official will provide written concurrence on the assumptions to the Contractor within 3 business days of receiving the recommendations. The Contractor shall return corrected submissions to the Government official within 3 business days of notification.

The Contractor shall be responsible for summarizing the valuation results and for providing the final report to the Government official. The Contractor shall provide the valuation results from model computations in a report that provides the financial information required under FASB ASC 715-60, formerly known as SFAS No.

106 disclosure. The report shall also include a summary of the benefits valued, a summary of the participation data and descriptions of the actuarial assumptions and methods applied. In addition, the contractor shall provide supporting detail separating the prior OTS Plan participants (retired as of July 2012) vs. current (the combined Plan).

The report shall provide an assessment as to the value of the benefits liability that should be carried on the financial statements of OCC as compared to those of the insurance provider.

Demographic Study Support - The Contractor shall required to provide, in option period one (OP1) of the contract, a demographic study of the postretirement life insurance benefits plan participants; required to be incorporated in the price/cost sheet as a line item in OP1 pricing (i.e., CLIN 1003). A demographic experience study completed every 3 -5 years supports the integrity of the Actuarial Valuation Report on the OCC Postretirement Life Insurance Plan. The most recent study was conducted in 2017 with updated assumptions reflected at September 30, 2017 fiscal year-end. The OCC uses information in the Actuarial Valuation Report (e.g., actuarial liabilities data, change in the discount rate, new mortality projection scale, new salary scale, impact of demographic experience) in the preparation of its financial statements and annual report. The demographic study is of particular importance now to determine whether retirement and termination patterns have changed as a result of the pandemic (post 2020).

5.0 DELIVERABLES

The Contractor shall submit the below deliverables to the POC using the method of delivery specified and by the due date established in the table.

Deliverables Description Method of Delivery Due Date

I ASC 715-60 Valuation Report

Changes in Actuarial Assumption

Changes in actuarial assumptions and methods applied

Electronic via Email No later than March 7th of the Operating Period

Mid-Year Valuation Includes: (1) summary of benefits Electronic via Email No later than

Report valued; (2) summary of participation data; (3) description of actuarial assumptions and methods applied;

and (4) supporting detail separating prior OTS Plan participants vs.

current

April 2nd of the Operating Period

Final Valuation Report (Using September 30 Discount Rate; as agreed to by the Contractor and

OCC)

Includes: (1) summary of benefits valued; (2) summary of participation data; (3) description of actuarial assumptions and methods applied;

and (4) supporting detail separating prior OTS Plan participants vs.

current

Electronic via Email No later than the third (3rd) business day of October within each Operating Period

Demographic Study Includes: (1) summary of benefits valued; (2) summary of participation data; (3) description of actuarial assumptions and methods applied;

(4) summary of pattern changes.

Electronic via Email No later than February 2026.

Within OP1 of the resulting contract award

II Presentations

Findings Presentation

Overview of valuation results to OCC Management

Virtual and MS PPT via PDF

Upon request, per instructions of authorized Government officials

6.0 KEY PERSONNEL

The key personnel identified for the resulting contract will be a dedicated Project Manager (PjM) and Project Analyst (PA), designated as essential for the duration of the contract. Key personnel shall be available to the support the requirements for the resulting contract to ensure that all work performed meets the requirements set forth herein. The PjM will serve as the single point of contact for the coordination of all contract activities.

The PA will actively support the PjM in performing valuation services, assist in research and assessment of demographics, analyze data, and perform other data review and manipulation activities to furnish the valuation reports.

7.0 GOVERNMENT FURNISHED INFORMATION

The Government will provide the following information to the Contractor no later than January of the current period of performance:

• Census Information on OCC employees with OCC Group Life Plan Insurance in electronic format

• Copy of Life Insurance Certificate and Policy with detailed description of plan benefits

• Copy of prior valuation report for fiscal years beginning October 1 through September 30 (Initial Report and Revised Schedules)

The OCC will provide the contractor access to the appropriate personnel in order to complete the requirements of this SOW. Availability of Contractor personnel shall be between the normal business hours of

8:00a.m. through 5:00p.m.

8.0 Performance Requirements Summary

The following factors are those that the Government considers to be key performance factors for this requirement. The quality standards are set for each of the factors, and the measurement is the most likely method of surveillance the government will use. The acceptable quality level describes the level the government will accept. If any of the acceptable quality levels are not met during performance evaluation, the government will determine if a disincentive is applicable and may note this in the contractor’s performance evaluation.

9.0 PERIOD OF PERFORMANCE

The Government anticipates the resulting contract to be for 5 years, including one 12-month base period and four 12-month option periods. Options shall be exercised in accordance with FAR 52.217-9.

• Base Period: February 25, 2024 – February 24, 2025

• Option Period 1: February 25, 2025 – February 24, 2026

• Option Period 2: February 25, 2026 – February 24, 2027

• Option Period 3: February 25, 2027 – February 24, 2028

• Option Period 4: February 25, 2028 – February 24, 2029

10.0 SECTION 508

The Contractor shall provide and maintain Information Communications Technology (ICT) that meets applicable standards of Section 508 of the Rehabilitation Act of 1973, as amended. This applies to all software user-interfaces, web-based user-interfaces, and documents such as reports, job aids, guides, and plans. Resource for further details on these standards can be found at:

• Section 508 – https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines

• Web Content Accessibility Guidelines (WCAG) – http://www.w3.org/TR/WCAG20/#conformance

Conformance to all 508 standards shall be met unless exception is authorized by the OCC Information Technology Accessibility Program Office.

General Exceptions authorized: None

Electronic Content delivered under this SOW shall meet the following standards:

• 602 – Support Documentation

• 603 – Support Services

• WCAG 2.0 Level A and AA success criteria – applies to all Web-based deliverables

• Exception authorized: Non-Web documents are not required to meet the following WCAG 2.0 success criteria: 2.4.1 Bypass Blocks, 2.4.5 Multiple Ways, 3.2.3 Consistent Navigation, and 3.2.4 Consistent Identification.

11.0 CYBER SECURITY REQUIREMENTS

https://www/ http://www/

Federal agencies are required to ensure that Controlled Unclassified Information (CUI) being stored, processed, or transmitted on non-Federal contractor systems is adequately protected. NIST Special Publication 800-171 provides the cyber security control framework that contractors must utilize to protect the CUI on their systems.

A. Compliance with Applicable Laws, Regulations, and Standards

Federal Laws. The contractor and all of its respective subcontractors shall follow and remain compliant at all times with the Federal Acquisition Regulation (FAR), Privacy Act of 1974 (5 U.S.C. 552a – the Act), Federal Information Security Modernization Act of 2014 (Public Law 107-347) (FISMA).

FIPS. The contractor and all of its respective subcontractors shall follow Federal Information Processing Standards (FIPS), National Institute of Standards and Technology (NIST) standards and guidelines, and other laws, mandates, or executive orders pertaining to the protection of sensitive information and information systems.

OCC Policies and Procedures. The OCC understands that there are limitations in applying agency-specific policies to systems and environments shared with other organizations or customers. The requirements in this OCC Policies and Procedures subsection applies to all activities specifically performed for the OCC by the contractor (e.g., professional services to develop or customize a component for the OCC). The intent of this section is to require contractor compliance with OCC policies and procedures for those activities, tasks, and deliverables specifically and uniquely performed and/or completed for the OCC by the contractor that is not a typical service or component of the existing contractor system/solution. This section also applies to contractors with access and use of OCC information resources (i.e., OCC network, systems, laptops, other IT equipment, and/or OCC information).

The contractor and all of its respective subcontractors shall comply with all Office of the Comptroller of the Currency (OCC) security and privacy policies and standards in effect at the time of the award of the contract, as well as those requirements that may be added during the contract.

The contractor/service provider shall conform to OCC administrative regulations, policies, and procedures, as listed in section [cite corresponding location in contracting document], in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. The contractor shall work with OCC internal organizations, as needed, to ensure that policies, procedures, configuration control, and product life-cycle requirements are fulfilled to the satisfaction of OCC ITS.

NIST SP 800-171. The contractor and its respective subcontractors shall ensure all components of contractor systems and organizations that process, store, and/or transmit OCC CUI or that provide protection for such components comply with the security requirements in NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.

B. General Requirements

Location. Information collected, used, stored, maintained, or otherwise processed by the contractor in the performance of this contract shall be accessed, transferred, stored or processed only within the United States. In addition, the maintenance and support operations of the contractor’s technology and information must take place, and originate from, within the United States.

Authorization to Use, Store, or Share Sensitive Information. The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all government data, equipment, etc. by treating the information as sensitive. All information gathered or created under this contract shall be considered as Controlled but Unclassified (CUI) information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets.

Confidentiality. The contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

Non-Disclosure Agreement. Each individual who has access to sensitive OCC data and/or the OCC network, systems, applications, laptops, or other OCC information resources that may process, store or transmit sensitive OCC data under this contract shall execute a Non-Disclosure Agreement before being allowed such access.

Deliverables. The deliverables in this contract will be considered CUI and shall not be shared with any other organization without prior written approval from the [insert specific OCC role].

C. Security and Privacy Authorization

D. Configuration Management

E. Continuous Monitoring

Compliance Reviews and Audits. The contractor shall permit and support compliance reviews and audits under applicable laws to allow the OCC to meet legal and compliance obligations and shall implement processes that allow visibility into the privacy and security controls employed and their effectiveness. The contractor shall provide the OCC or authorized designated officials with information requested by auditors in a timely manner, consistent with the respective auditor’s deadline, in support of security compliance reviews and various annual audits, e.g., FISMA, Financial Statement Audit, A-123, etc.

F. Data Protection

General Use of Controlled Unclassified Information (CUI). The contractor shall not use any CUI or CUI subcategories, including, Personally Identifiable Information (PII) or low-sensitivity PII (e.g., E-mail Groups and Lists), for any purpose other than those activities necessary to the performance of this contract.

Use of PII Specific to this Contract’s Scope of Work. The scope of work for this contract has specific business driven and functional requirements that involve PII. The contractor, contractor employees, and subcontractors must physically secure PII when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss. PII is no longer needed or required to be retained under applicable government records retention policies, it must be destroyed through means that will make the sensitive PII irretrievable. The contractor shall only use PII obtained under this contract for purposes of the contract and shall not collect or use such information for any other purpose without the prior written approval of the contracting officer. At expiration or termination of this contract, the contractor shall turn over all sensitive PII obtained under the contract that is in its possession to the government.

In accordance with OMB M-17-12 Preparing for and Responding to a Breach of Personally Identifiable Information, the contractor and subcontractor(s) shall:

1. Properly encrypt PII in accordance with OMB Circular A-130 and standards per the “Data Encryption” subsection above.

2. Complete regular training on how to identify and report a breach;

3. Maintain capabilities to determine what Federal information was or could have been accessed and by whom, construct a timeline of user activity, determine methods and techniques used to access Federal information, and identify the initial attack vector;

4. Allow for an inspection, investigation, forensic analysis, and any other action necessary to assist with responding to a breach;

5. Adhere to notification and reporting requirements specified in Section G. “Incident Response” to effectively report and manage a suspected or confirmed breach as soon as possible (within 1 hour) and without unreasonable delay, consistent with the OCC’s Incident Response Plan and US-CERT notification guidelines. Please note that a report of a breach shall not, by itself, be interpreted as evidence that the contractor or its subcontractor failed to provide adequate safeguards for PII.

Use of Contractor Equipment. Use of contractor-owned laptops or other equipment (e.g., media storage devices, servers, etc.) to process, transmit, or store OCC information or to access the OCC network or other OCC information resources without OCC’s formal approval is prohibited. This restriction does not apply to the use of non-OCC laptops or PCs to use OCC-approved virtual desktop infrastructure to remotely access the OCC network.

Contractor Equipment Approval. In order to obtain OCC’s approval to process, store, or transmit OCC CUI on contractor equipment, the contractor shall provide written assurance of compliance with NIST SP 800-171 (as amended), Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, requirements for all contractor system and organization components that will process, store or transmit OCC

CUI.

G. Incident Response

Notification. The contractor must report all information security incidents that potentially or actually cause the compromise of OCC information, even if the contractor believes the security incident may be limited, small, or insignificant with respect to OCC data or systems. The OCC will determine when the contractor’s reported security incident requires additional focus and attention.

Within one hour from the time the contractor validates that an information security incident has occurred, the contractor must report the security incident information to the OCC Cyber Defense Center (CDC):

TBD.TBD@occ.treas.gov, (202) XXX-XXXX, regardless of day or time.

The contractor must provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC with the following text in the subject line of the email: “Supplementary Information/Report related to previously reported incident # [insert number].”

Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

When notifying the OCC CDC, copy the Contracting Officer if possible or, if reporting by phone or Contracting Officer’s email is not immediately available, contact the Contracting Officer immediately after reporting the incident to the OCC CDC.

mailto:TBD.TBD@occ

Information, System and Tool Availability. The contractor shall make available any information, systems, and tools necessary for the OCC to respond to incidents in a manner consistent with NIST SP 800-61, as amended. In the case of a reported security incident, the contractor shall provide the OCC with access to the contractor’s system and/or facilities within 72 hours of the OCC’s request.

H. Information Ownership

Government Access. The government will retain unrestricted rights to government data. The OCC retains ownership of any user created/loaded data and deliverables (e.g., documents, applications, custom code, diagrams, workflows, data sets, etc.) hosted on contractor’s equipment, systems, infrastructure, etc., as well as maintains the right to request full copies of these at any time.

Removal of OCC Data. The contractor acknowledges the OCC’s exclusive right of ownership of the information and is required to transfer, return, and/or delete all agency data collected, processed, stored or maintained by the contractor on behalf of OCC upon termination of services, and shall provide written certification and supporting documentation attesting to the transfer, return and/or deletion of agency information or data generated, collected, processed, maintained, or stored by the contractor and any subcontractors, per instructions the “Security and Privacy Vendor Deliverables” section.

Documents and Deliverables. The preliminary and final OCC-specific deliverables and all associated working papers are the property of the U.S. Government. The contractor shall not release any information without the written consent of the Contracting Officer. All work papers, preliminary and final deliverables must be submitted to the COR at the conclusion of the contract in an acceptable and usable format, which may include the original format.

eDiscovery. The contractor must ensure data preservation requirements (i.e., halt destruction and maintain data the contractor may not otherwise have to maintain) related to litigation holds are met. The contractor shall also ensure that metadata associated with litigation holds are preserved. Metadata is electronically-stored information that describes the history, tracking, or management of an electronic document. It is created automatically when a user creates, modifies, accesses, or takes other actions with respect to an electronic document.

The contractor shall provide immediate access to all government data and government-related data impacting government data for review or scan, or conduct of a forensic evaluation, and physical access to any contractor facility with government data.

I. System Access

Government Right to Terminate Access. The OCC, at its discretion, may suspend or terminate the access to any systems and/or facilities when an information security incident or other electronic access violation, use or misuse issue gives cause for such action. The suspension or termination may last until such time as OCC determines that the situation has been corrected or no longer exists.

J. Training Requirements

Security Awareness Training. All contractor personnel with access to OCC data and systems must complete OCC-provided mandatory security and privacy training prior to gaining such access. Non-compliance may result in revocation of system access.

Role-Based Training. The contractor shall ensure that IT personnel supporting this contract complete eight (8) hours of role-based specialized IT security training on an annual basis. The contractor must identify the IT personnel and their respective IT role1 that they serve in support of this contract. The contractor shall provide the list of List of IT Personnel on this Contract and Respective Role and the Completion Report for Role-Based IT Security Training per directions in the "Security and Privacy Vendor Deliverables" section.

Personnel include systems engineers; software developers; systems security engineers; privacy engineers;

system, network, and database administrators; personnel conducting configuration management activities;

personnel performing verification and validation activities; personnel with access to system-level software;

personnel with contingency planning and incident response duties; personnel with privacy management responsibilities; personnel with access to personally identifiable information; and system security officers.

K. Supply Chain Risk Management

L. Security and Privacy Vendor Deliverables

Removal of Data Deliverables

Section Deliverable Frequency Due Date

IV. F. Information Ownership.

Removal of OCC Data

IV. D. Data Protection.

Contractor Equipment

Certification of OCC Data Removal from Contractor’s (including any subcontractors), Possession, Equipment, and/or Environment. Data removal instructions include transfer of information to another party per specific instructions from the CO; return of information, deliverables, etc., to the CO; and deletion of OCC data from contractor equipment (e.g., laptops and other contractor-owned equipment previously approved by the OCC for this use) using NIST SP 800-88, Guidelines for Media Sanitization, as amended.

Once

NLT 15 days after termination/ expiration of contract

Training Deliverables

Section Deliverable Frequency Due Date

IV. H. Training Requirements. Role- Based Training

List of IT Personnel on this Contract and Respective Role

Initially and as changes occur

Initial: Within 15 Days of Award

IV. H. Training Requirements. Role- Based Training

Completion Report for Role-Based IT Security Training

Annually Annual NLT June 5th

Non-Disclosure Agreement (NDA) Deliverables

IV. B. General Requirements. Non- Disclosure Agreement

Non-Disclosure Agreements for each contractor personnel working in support of this contract

Once

Prior to accessing OCC information resources

Authorization Boundary

Section Deliverable Frequency Due Date

C. Security and Privacy Authorization.

Authorization Boundary

OCC-specific Demarcated Security Authorization Boundary for the solution

Initially, and as changes occur

Initial: [Within x Days of Award]

Customer Responsibilities [OCC-Dedicated, Federal IT, & Commercial Services]

C. Security and Privacy Authorization.

Customer Responsibilities

Customer Responsibilities Matrix (CRM) - detailed list of all customer security responsibilities assigned to the OCC, as defined by the vendor. Typically OCC customer responsibilities are minimal and pertain to informing the contractor of new users approved for access, revocations, account reviews, if there are OCC admins – their responsibilities, etc.

Initial, and as changes occur

Initial: [Within x Days of Award]

Security Assessment & Authorization Package [OCC-Dedicated, Federal IT]

Section Deliverable Frequency Due Date

C. Security and Privacy Authorization.

Customer Responsibilities;

Security Assessment & Authorization (SA&A) Package, Ongoing Authorization E. Continuous Monitoring: Annual Security Assessment Report and Package Review

Security Assessment & Authorization (SA&A) Package, including:

− Current ATO memo, if authorized by another Federal Agency

− Security and Privacy Assessment Report

(SAR)

− Security and Privacy Assessment Plan

(SAP)

− Plan of Action & Milestones

− System Security Plan (SSP), including FIPS 199 Security Categorization

− Documents Supporting SSP* (listed below for clarification)

− Customer Responsibility Matrix (CRM)

Initially, Annually, and as Significant Changes Occur

Please note that the SSP Supporting Documents (annotated with *) are all initially due with the SA&A package and thus have the same Initial Due date.

However, the SSP supporting documents have varying submission frequencies post-award as specified lower in this table.

Initial:

[Within x Days of Award] Annual:

NLT May 1

Non-Federal ESP Security Documentation [Commercial ESP or Public Cloud ESP w/Nonfederal Customer Base and No FedRAMP ATO]

Non-Disclosure Agreement (NDA) Deliverables

Removal of Data Deliverables

Training Deliverables

C. Security and Privacy Authorization. SSAE 18 Requirements.

E. Continuous Monitoring. Annual SOC 2 Type 2 Reviews

Statement on Standards for Attestation Engagements (SSAE) 18 SOC Type II report. The preferred coverage period for the report is July 1 through June 30 with a bridge letter covering the three months to September 30.

Initially and annually

Within 30 Days after Award Annual: NLT May