Revised_DRAFT_Strategic Communication Support Services PWS.pdf

STRATEGIC COMMUNICATIONS SUPPORT SERVICES

PERFORMANCE WORK STATEMENT

DRAFT

1.0 Background

2.0 Objective

3.0 Scope

4.0 Task Areas

4.1 TA 1 – Communication Strategy and Plan Implementation

4.2 TA2 – Product and Service Delivery Communications Support

4.3 TA3 – Campaign and Branding Support

4.4 TA4 – Executive and Senior Leadership Support

5.0 Cybersecurity Requirements

6.0 Deliverables

7.0 Information and Communications Technology (ICT) Accessibility Requirements

8.0 Paperwork Reduction Ac (PRA)

9.0 Organizational Conflict of interest

10.0 Quality Assurance Surveillance Plan

11.0 Place of Performance

12.0 Period of performance

1.0 BACKGROUND

The Office of the Comptroller of the Currency (OCC) is an independent bureau of the U.S.

Department of the Treasury that charters, regulates, and supervises all national banks, federal savings associations, and federal branches and agencies of foreign banks.

The Office of Information Technology Services (ITS), within the Office of Management (OM), delivers a wide range of information technology (IT) services and support to the agency in areas of network and infrastructure, end user support, a help desk that operates 24 x 7 x 365 days a year, modernization of legacy applications and service delivery, IT portfolio management, data governance, customer experience, relationship management, and cybersecurity. As a trusted partner delivering solutions and services to the OCC, ITS must have a robust communications program.

2.0 OBJECTIVE

The objective of this is Blanket Purchase Agreement (BPA) is to provide Strategic Communication Support Services through a comprehensive communications program for ITS.

As a modern IT organization, communications are a core component to building trust in IT services and partnerships throughout the agency. ITS seeks to increase the reliability, timeliness, and effectiveness of information sharing at the OCC as well as improve employee engagement and advancement of the ITS strategic priorities. Furthermore, ITS seeks communications services in support of a wide variety of IT initiatives, activities, and priority projects that require marketing, branding, and content management consistent with strategic goals and objectives.

To accomplish the goals and priorities of ITS, the organization requires communication expertise familiar with complex IT system development programs, modernization, and service delivery as well as knowledge of creating processes to implement the wide-ranging communication support and services to the organization with a customer service mindset to inform, engage, and drive effective communications.

3.0 SCOPE

The Contractor shall provide all the necessary labor and materials to perform Strategic

Communication activities and services required in each functional area listed below. The

Contractor will ensure that all communications, materials, and related activities meet the standards outlined in the General Services Administration’s (GSA) Digital.gov Guides and

Resources.1

1 Digital.gov is made up of a cross-functional team of writers, editors, strategists, technologists, and designers who all work at the Technology Transformation Services (TTS) at the General Services Administration (GSA) https://digital.gov/

Individual Call Orders shall be issued as required for organizational requirements and/or project specific strategic communications. The scope of this BPA includes the following Task Areas (TA):

• TA1 – Communications Strategy and Plan Implementation

• TA2 – Product and Service Delivery Communications Support

• TA3 – Campaign and Branding Support

• TA4 – Executive and Senior Leadership Support

4.0 TASK AREAS

4.1 TA 1 – Communication Strategy and Plan Implementation

The Contractor shall create and execute a full-scale communications strategy and implementation roadmap inclusive of a broad range of innovative and creative activities related to information sharing, employee engagement, and governance. As a modern IT organization, ITS requires these services, specifically:

• Creation of effective messaging to the agency and ITS employees to increase understanding and awareness of ITS activities, success stories, overall goals, and strategic priorities.

• Creation and implementation of a governance model and standardization process of ITS communications along with appropriate artifacts (e.g. templates) for numerous use cases to ensure consistency of messaging to the various, intended audiences.

• Creation and delivery of communications that drive engagement and awareness of activities, priorities, and accomplishments in support of ITS Leadership.

• Creation of communication work products (ex. print, digital or video) that demonstrate current and evolving industry and federal government information sharing trends and practices, including established delivery methods that suit the circumstances for communication.

• Ability to ideate and to inspire the ITS team members to think differently about how we solve customer problems by drawing on experience, best practices, and appropriate external sources.

• Provide strategic and tactical support fand creation of content for the ITS web presence and web materials created and used by the agency, such as Knowledge Based Articles

(KBAs), corrective action plans, releases, upgrades, and other IT related materials.

• Provide superior support and flexible management of all aspects of the strategic communications plan, strategy, content creation, and dissemination.

• Creation and facilitation of a monthly lunch and learn series for the ITS workforce to share new and innovative IT technologies, communicate ITS project successes, adopt new methodologies in the IT sector, and engage with outside speakers.

• Provide research and communication of ITS workforce training opportunities to develop the skills and knowledge necessary to continuously develop the organization.

• Creation and dissemination of engaging and informative content that supports the communication objectives of the priorities, programs, and leadership initiatives (e.g.

annual reports, newsletters, and focus stories of interest.)

4.2 TA2 – Product and Service Delivery Communications Support

The Contractor shall develop and implement a comprehensive engagement strategy to facilitate the understanding and adoption of new IT solutions and services. Activities and services may include:

• Creation of materials (print or digital) for job aids, trainings materials, and other educational materials to empower end-users to effectively leverage new and enhanced

IT solutions and services.

• Support to the logistics, coordination, and execution of ITS trainings and user outreach activities as required through various phases of ITS projects and service delivery.

• Creation and management of feedback mechanisms and channels for end-users to provide input for an environment of continuous improvement, (e.g. surveys/polls, focus groups, and feedback sessions.)

• Identification of trends and opportunities from data analysis to develop informed strategic decisions and present reports on findings to the COR.

• Ability to translate concepts and visions into plain language communications and materials.

• Creation and dissemination of project launch materials, including internal announcements, draft release notes, and user guides in plain language.

• Collaboration effectively with designers, development teams, product managers, and other team members to build communications artifacts to achieve the desired business results.

4.3 TA3 – Campaign and Branding Support

The Contractor shall develop and execute targeted internal customer awareness campaigns to inform and educate internal stakeholders about new solutions, projects, priorities, and services.

Activities and services shall include:

• Creation of compelling messages and materials to highlight the value and benefit of identified IT solutions.

• Organization of events, webinars, and workshops to engage with internal customers.

• Ability to monitor campaign effectiveness through data analytics and metrics, such as engagement rates and feedback with the purpose to enhance the user experience.

• Creation of a branding strategy and identity for ITS projects in alignment with the organization's overall mission, goals, priorities, and strategic plan with the incorporation of logos, color schemes, templates, and other visual assets.

• Creation of key messages that communicate the project's goals and alignment with the organization's mission, goals, and objectives.

• Development and implementation of campaigns, stakeholder communications, outreach materials and related content, as well as agency-wide messaging and press-releases.

4.4 TA4 – Executive and Senior Leadership Support

As part of the overall Strategic Communications support, the Contractor shall provide support to ITS executives and senior leadership for consistent messaging aligned with organization’s strategic priorities. These activities include the creation of a wide variety of executive communications and engagement support to senior leadership and key stakeholders.

The Contractor shall ensure the ITS executives and senior leadership have the appropriate messaging prepared, materials, and artifacts for all high-level meetings, live events, and other opportunities for presentations. This may include the creation of presentations and talking points for IT Executives.

The Contractor will be a trusted partner to the ITS senior leadership team to create content for numerous engagements and communications on behalf of ITS executives and senior leadership.

The Contractor will support the ITS senior leadership team at the direction of the COR for high-level meetings and town halls to include meeting logistics, invites, development of meeting presentations, planning, and strategizing, documentation during and post meeting, and other support activities.

5.0 CYBERSECURITY REQUIREMENTS

The following cybersecurity requirements are applicable to all BPA orders. If additional cyber requirements are required at the Order level; those requirements will be included in the BPA Order RFQ.

A. Compliance with Applicable Laws, Regulations, and Standards

Federal Laws. The Contractor and all its respective subcontractors shall always follow and remain compliant with the Federal Acquisition Regulation (FAR), Privacy Act of 1974 (5 U.S.C.

552a - the Act), Federal Information Security Modernization Act of 2014 (Public Law 107-347)

(FISMA).

FIPS. The Contractor and all its respective subcontractors shall follow Federal Information Processing Standards (FIPS), National Institute of Standards and Technology (NIST) standards and guidelines, and other laws, mandates, or executive orders pertaining to the protection of sensitive information and information systems.

OCC Policies and Procedures. The OCC understands that there are limitations in applying agency-specific policies to systems and environments shared with other organizations or customers. The requirements in this OCC Policies and Procedures subsection applies to all activities specifically performed for the OCC by the Contractor (e.g., professional services to develop or customize a component for the OCC). The intent of this section is to require Contractor compliance with OCC policies and procedures for those activities, tasks, and deliverables specifically and uniquely performed and/or completed for the OCC by the Contractor that is not a typical service or component of the existing Contractor system/solution. This section also applies to Contractors with access and use of OCC information resources (i.e., OCC network, systems, laptops, other IT equipment, and/or OCC information). The Contractor and all its respective subcontractors shall comply with all Office of the Comptroller of the Currency (OCC) security and privacy policies and standards in effect at the time of the award of the contract, as well as those requirements that may be added during the contract. The Contractor/service provider shall conform to OCC administrative regulations, policies, and procedures, as listed in section [cite corresponding location in contracting document], in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. The Contractor shall work with OCC internal organizations, as needed, to ensure that policies, procedures, configuration control, and product life-cycle requirements are fulfilled to the satisfaction of OCC ITS.

B. General Requirements:

Location. Information collected, used, stored, maintained, or otherwise processed by the Contractor in the performance of this contract shall be accessed, transferred, stored, or processed only within the United States. In addition, the maintenance and support operations of the Contractor's technology and information must take place, and originate from, within the United States.

Authorization to Use, Store, or Share Sensitive Information. The Contractor shall be responsible for properly protecting all information used, gathered, or developed because of work under this contract. The Contractor shall also protect all government data, equipment, etc. by treating the information as sensitive. All information gathered or created under this contract shall be considered as Controlled but Unclassified (CUI) information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If Contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets.

Confidentiality. The Contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

Deliverables. Deliverables produced under this BPA will be considered sensitive and shall not be shared with any other organization without prior approval from the OCC CO. The specific contents and template for each deliverable will be agreed upon with the COR of each BPA Call

Order. Orders placed under the BPA may require the Contractor to collect and/or analyze data.

All data/information collected, interviews conducted, and any other types of information and initial findings, drafts, working, and final papers are the exclusive property of the OCC. No Contractor markings or branding will be placed or permitted on the products prepared for the

OCC.

Non-Disclosure Agreement. Individuals with access to sensitive OCC data and/or the OCC network, systems, applications, laptops, or other OCC information resources that may process, store, or transmit sensitive OCC data under this contract shall execute a Non-Disclosure Agreement before being allowed such access.

D. Data Protection

Data Encryption. Where encryption is required, as specified by the OCC, the Contractor shall ensure that encryption is established and maintained for data at rest and in transit for the duration of the contract. The encryption employed shall be equivalent to those approved in Federal Information Processing Standards (FIPS) Publication 140.

Need to Know. Sensitive information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The Contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected.

General Use of Personally Identifiable Information (PII). The Contractor shall not use any PII, including low-sensitivity PII (e.g., E-mail Groups and Lists), for any purpose other than those activities necessary to the performance of this contract.

Use of Contractor Equipment. Use of Contractor-owned laptops or other equipment (e.g., media storage devices, servers, etc.) to process, transmit, or store OCC information or to access the OCC network or other OCC information resources without OCC's formal authorization is prohibited. This does not include the use of non-OCC laptops or PCs to use OCC-approved virtual desktop infrastructure to remotely access the OCC network.

E. Incident Response

Notification. The Contractor must report all information security incidents that potentially or cause the compromise of OCC information, even if the Contractor believes the security incident may be limited, small, or insignificant with respect to OCC data or systems. The OCC will determine when the Contractor's reported security incident requires additional focus and attention. Within one hour from the time the Contractor validates that an information security incident has occurred, the Contractor must report the security incident information to the OCC Cyber Defense Center (CDC): Computer.Security@occ.treas.gov, (202) 649-7930, regardless of day or time.

mailto:Computer.Security@occ.treas.gov

The Contractor must provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC with the following text in the subject line of the email: “Supplementary Information/Report related to previously reported incident # [insert number].” Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

When notifying the OCC CDC, copy the Contracting Officer if possible or, if reporting by phone or Contracting Officer's email is not immediately available, contact the Contracting Officer immediately after reporting the incident to the OCC CDC.

Information, System and Tool Availability. The Contractor shall make available any information, systems, and tools necessary for the OCC to respond to incidents in a manner consistent with NIST SP 800-61, as amended. In the case of a reported security incident, the Contractor shall provide the OCC with access to the Contractor's system and/or facilities within 72 hours of the OCC's request.

F. Information Ownership

Government Access. The government will retain unrestricted rights to government data. The OCC retains ownership of any user created/loaded data and deliverables (e.g., documents, applications, custom code, diagrams, workflows, data sets, etc.) hosted on Contractor's equipment, systems, infrastructure, etc., as well as maintains the right to request full copies of these at any time.

Removal of OCC Data. The Contractor acknowledges the OCC's exclusive right of ownership of the information and is required to transfer, return, and/or delete all agency data collected, processed, stored or maintained by the Contractor on behalf of OCC upon termination of services, and shall provide written certification and supporting documentation attesting to the transfer, return and/or deletion of agency information or data generated, collected, processed, maintained, or stored by the Contractor and any subcontractors, per instructions the "Security and Privacy Vendor Deliverables" section.

Documents and Deliverables. The preliminary and final OCC-specific deliverables and all associated working papers and other material deemed relevant by the agency that have been generated in the performance of this contract, are the property of the U.S. Government. The Contractor shall not release any information without the written consent of the Contracting Officer. All work papers, preliminary and final deliverables must be submitted to the COR at the conclusion of the contract in an acceptable and usable format, which may include the original format.

eDiscovery. The Contractor must ensure data preservation requirements (i.e., halt destruction and maintain data the Contractor may not otherwise have to maintain) related to litigation holds are met. The Contractor shall also ensure that metadata associated with litigation holds are preserved. Metadata is electronically stored information that describes the history, tracking, or management of an electronic document. It is created automatically when a user creates, modifies, accesses, or takes other actions with respect to an electronic document.

The Contractor shall provide immediate access to all government data and government-related data impacting government data for review or scan, or conduct of a forensic evaluation, and physical access to any Contractor facility with government data.

G. System Access

Government Right to Terminate Access. The OCC, at its discretion, may suspend or terminate the access to any systems and/or facilities when an information security incident or other electronic access violation, use, or misuse issue gives cause for such action. The suspension or termination may last until such time as OCC determines that the situation has been corrected or no longer exists.

H. Training Requirements

Security Awareness Training. All Contractor personnel with access to OCC data and systems must complete OCC-provided mandatory security and privacy training prior to gaining such access. Noncompliance may result in revocation of system access.

Role-Based Training. The Contractor shall ensure that IT personnel supporting this contract complete eight (8) hours of role-based specialized IT security training on an annual basis. The Contractor must identify the IT personnel and their respective IT role1 that they serve in support of this contract. The Contractor shall provide the list of List of IT Personnel on this Contract and Respective Role and the Completion Report for Role-Based IT Security Training per directions in the "Security and Privacy Vendor Deliverables" section. IT Personnel include systems engineers; software developers; systems security engineers; privacy engineers; system, network, and database administrators; personnel conducting configuration management activities; personnel performing verification and validation activities; personnel with access to system-level software; personnel with contingency planning and incident response duties; personnel with privacy management responsibilities; personnel with access to personally identifiable information; and system security officers.

6.0 DELIVERABLES

Section Deliverable Frequency Due Date

B. General Requirements Non-Disclosure Agreement

Non-Disclosure Agreements for each Contractor personnel working in support of this contract

Once Prior to accessing OCC information resources

F. Information Ownership, Removal of OCC Data, Data Protection from Contractor Equipment

Certification of OCC Data Removal from Contractor’s (including any subcontractors), Possession, Equipment, and/or Environment.

Data removal instructions include transfer of information to another party per specific instructions from the CO; return of information, deliverables, etc., to the CO; and deletion of OCC data from Contractor equipment (e.g., laptops and other Contractor owned equipment previously approved by the OCC

Once NLT 15 days after termination/expiration of each BPA Call Order

H. Training Requirements, Role-Based Training

Completion Report for Role-Based IT Security Training

Annually Annually NLT June 5th

7.0 INFORMATION AND COMMUNICATIONS TECHNOLOGY (ICT) ACCESSIBILITY

REQUIREMENTS

The following ICT accessibility requirements apply to all BPA Calls. If additional requirements are applicable to the BPA Call, those requirements will be included in the BPA Call RFQ.

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities. As such, the following requirements apply to this solicitation:

1) Products, platforms and services delivered as part of this work statement that are ICT, or contain ICT, must conform to the Revised 508 Standards, which are located at 36

C.F.R. §1194.1 & Apps. A, C & D, and available at https://www.access-board.gov/guidelines-andstandards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-andguidelines.

DRAFT

https://www.access-board.gov/guidelines-andstandards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-andguidelines https://www.access-board.gov/guidelines-andstandards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-andguidelines https://www.access-board.gov/guidelines-andstandards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-andguidelines

2) E102 / 702.10 – Web Content Accessibility Guidelines (WCAG) success criteria level A &

AA are incorporated as a requirement. The referenced WCAG criteria is available at http://www.w3.org/TR/WCAG20/.

3) A completed Accessibility Conformance Report (ACR) found at https://www.itic.org/policy/accessibility/vpat, using Voluntary Product Accessibility

Template (VPAT) Revised Section 508 Edition, Version 2.4, is required to assist the

Government in determining that the ICT products or services support Section 508 accessibility standards.

4) E202 – No General Exceptions Authorized by OCC.

The following items are identified as containing ICT: Specific deliverables identified as containing ICT will be listed in each BPA Call. Examples of items typically identified as containing ICT include reports and documents (documents delivered in Word or PDF must be formatted in an accessible manner), web portals (including commercial websites and access portals), web-based platforms, and software (including software underpinning web based or cloud-based platforms).

Applicable Functional Performance Criteria: All functional performance criteria apply when using an alternative design or technology that achieves substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4-6 of the Revised 508 Standards, or when Chapters 4-6 do not address one or more functions of ICT.

Applicable requirements for software and Web products:

• E207 – WCAG Level A & AA Success Criteria

• E302 – Functional Performance Criteria

• E502 – Interoperability with Assistive Technology

• E503 – Application Applicable requirements for electronic documents and/or support services:

• E205 – WCAG Level A & AA Success Criteria

• E302 – Functional Performance Criteria

• E602 – Support Documentation

• 603 – Support Services

Documents and Deliverables: The preliminary and final OCC-specific deliverables and all associated working papers are the property of the U.S. Government. The Contractor shall not release any information without the written consent of the Contracting Officer. All work papers, preliminary and final deliverables must be submitted to the COR at the conclusion of the contract in an acceptable and usable format, which may include the original format.

8.0 PAPERWORK REDUCTION ACT (PRA)

http://www.w3.org/TR/WCAG20/ https://www.itic.org/policy/accessibility/vpat

The PRA is a law governing how federal agencies collect information from the public. Task Areas of the SOW that include external interviews may require PRA approval prior to conducting the interviews. Orders placed against this BPA that trigger the PRA will include tasks, roles, and responsibilities of the Contractor and OCC in obtaining the required approval in advance of interviews or research being conducted.

9.0 ORGANIZATIONAL CONFLICT OF INTEREST

The Organizational Conflict of Interest OCC clause will be included in future BPA Orders to which it is believed an OCI may exist. Access to any proprietary, business confidential, or financial data of other companies shall be protected by the Contractor from unauthorized use and disclosure as long as these data remain proprietary or confidential. The Contractor agrees not to use the information learned through this BPA to compete with those other companies.

Any potential or known organizational or personal conflicts of interest during the period of performance of this BPA must be brought to the attention of the Contracting Officer immediately. If the Contractor believes the potential or actual conflict of interest can neutralized or mitigated, the Contractor shall submit a mitigation plan to the Contracting Officer for review. The Contracting Officer may require additional information and may use all relevant information known to the OCC in making a conflict-of-interest determination.

10.0 QUALITY ASSURANCE SURVEILLANCE PLAN

The Contractor shall develop a Quality Assurance Surveillance Plan (QASP) that includes each of the deliverables under the BPA and Call Order awards. The QASP shall specify in detail the quality standards to be followed for each deliverable and for each task performed for Strategic Communication Support Services. The terms of the QASP will be reviewed by the OCC ITS through the COR and agreed upon prior to any work being performed.

11.0 PLACE OF PERFORMANCE

The place of performance shall be the Contractor’s location, however there is a need for some meetings to be conducted at the OCC Headquarters facility located at 400 7th Street, S.W., Washington, D.C. 20219. Onsite project meetings could be up to three days a week. Work performed at the government site shall not take place on federal holidays or weekends unless directed by the Contracting Officer (CO).

If work is performed at OCC Headquarters, remote work may be permitted at the discretion of the COR. If work is performed at the Contractor’s site, remote work is permitted at the discretion of the Contractor, in accordance with the company’s human resources policies. The contractor may need to work with the COR and Contracting Officer (CO) to determine the appropriate use of shared cubicles onsite at OCC Headquarters. Local travel and parking costs are not separately reimbursable to the Contractor.

12.0 PERIOD OF PERFORMANCE

The Period of Performance (POP) of this BPA shall be Base Year 12-month period with the possibility of four (4) additional 12-month Option Year periods if exercised. In addition, this BPA includes FAR 52.217-8 Option to Extend Services which will allow extending the performance up to 6 months.