0004_Dental_Solicitation Amendment Cont Pages (TCs)_20241011.docx

Dental Insurance Solicitation

2031JW24R00002

PART I – THE SCHEDULE

SECTION B – SUPPLIES OR SERVICES AND PRICES / COSTS

B.1 See Attachment (1) Price Proposal Spreadsheet for the Contract Line-Item Number (CLIN) structure.

SECTION C – DESCRIPTIONS / SPECIFICATIONS / STATEMENT OF WORK

1.0 GENERAL

The Contractor shall provide the services specified herein for a 12-month base period and nine one-year option periods (if exercised) at the rates specified in each CLIN.

The Contractor shall underwrite and administer the Office of the Comptroller of the Currency’s (OCC) Dental Insurance Program for OCC employees, retirees, and their eligible family members as well as employees of the Office of Financial Research (OFR) and their dependents.

1.1 PRICING SCHEDULE FOR DENTAL INSURANCE PROGRAM

The Contractor shall underwrite and administer insurance for two different dental plans, Preferred Provider Organization (PPO) and Dental Health Maintenance Organization (DHMO).

The OCC pays 100 percent of the premium for its active employees (OCC and OFR), disabled retirees (OCC only), and buyouts/survivors (OCC only). Retirees pay 100% of the premium based on the coverage tier they elect, which can be retiree only, retiree plus one, or retiree and their eligible family members.

The number of eligible employees enrolled in the DHMO and PPO plans is estimated and used for the purpose of establishing a funding amount for each performance period. The OCC employee population may fluctuate within each performance period resulting in an increase or decrease throughout the year (i.e., there may be a variation in quantity). The number of eligible employees enrolled in the DHMO and PPO plans is also subject to change. The OCC will remit premium payment based on actual enrollment for that month at the performance period’s fixed unit rate. Retirees will be invoiced monthly directly by the contractor.

As noted in the SOW section to follow, the OCC is considering two plan designs, Attachment (2) is the Current Plan Design and Attachment (3) is the Enhanced Plan Design, which consists of the current plan design with two changes – increases in the calendar year maximum and orthodontic lifetime maximum. The Government will identify the chosen plan design at the time the contract is awarded.

1.2 CLIN DESCRIPTION AND ARRANGEMENT

The contract type will be Fixed-Price with prospective price redetermination. The base and option year 1 CLIN rates are fixed; however, the total price for each CLIN could increase or decrease depending on changes in the number of eligible OCC and OFR employees, and OCC retirees. Insurance rates for option CLINs 2001 through 9001 will be negotiated prior to exercise but may not exceed the capped amount to be established. Additionally, there will be a transition period (date of award through June 30, 2025) to enroll employees into the dental plan, which will not be separately priced (i.e., at no additional cost to the Government) and will be included in the base year. See Attachment (1), Price Proposal Spreadsheet, for the CLIN structure.

At any time during the contract’s period of performance, the OCC may negotiate with the Contractor for changes to the insurance plans that would provide more benefits to beneficiaries of the plans (lower co-pays, more services covered, lower deductibles, etc.), provided the cost to the OCC for such increases in benefits do not exceed 20% of the fixed and/or capped price rates for the associated year(s) of coverage.

1.3 INTRODUCTION

The OCC is a non-appropriated federal financial regulatory agency of the Department of the Treasury. The OCC supervises national banks, federal savings associations, and federal branches and agencies of foreign banks that serve consumers, businesses, and communities across the United States and conducts approximately 70% of banking activity in the country. These banks range from community banks serving local neighborhood needs to the nation’s largest most internationally active banks.

The OCC Headquarters is in Washington D.C., with four district offices in New York, Chicago, Dallas, and Denver. The OCC employs about 3,600 employees nationwide in offices throughout the contiguous United States with most employees located in Washington, D.C. This population count changes throughout the year. The OCC is unique from most other federal government agencies because it has independent authority to offer its employees compensation and benefit programs that are not offered by other agencies. The OCC-sponsored benefit programs include, but are not limited to, dental insurance, AD&D, flexible spending accounts, short and long-term disability and 401(k) programs.

The OCC, for purposes of its governmental plans, is specifically exempted from Title I of the Employee Retirement Income Security Act.

1.4 SCOPE OF WORK

1.4.1 BACKGROUND

The OCC needs a contractor (i.e., a qualified insurance company – not insurance brokers/agencies) to provide for underwriting and administration of these benefits.

The Contractor shall provide a dental insurance program for the agency’s employees, retirees, and their eligible family members, as well as employees of the OFR and their dependents. OFR was established because of the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank”), as a small office (maximum headcount of 250 employees) within the Department of the Treasury, but was given the same independent authority as the OCC. Since the OFR determined that they would not be able to obtain reasonable dental rates due to their small size, they determined that they would be best served if they joined with another governmental agency and became a part of their existing contract. In 2011 (when they were established) they chose to be a participant on the OCC’s dental insurance contract.

1.4.2 GENERAL

It is the intent of the OCC to provide a dental benefits program that will help to promote and maintain healthy living for its program participants. In support of the OCC’s efforts to educate employees on healthy living and their benefit options, the successful Contractor shall perform the following:

· Attend an onsite or virtual health benefits fair that is generally held on multiple days from November through December of every year. When providing on-site fairs, the Contractor must supply handouts and giveaways (ancillary dental items such as toothbrushes, floss, etc.) and be prepared to answer employee questions concerning the OCC Dental Insurance program. Travel reimbursement is not authorized and will not be paid by the Government.

· Support an OCC wellness fair at OCC’s headquarters location (Washington, DC) by arranging for the attendance of a professional in the health field (at no additional cost to the OCC) who must provide free demonstrations of their services or products. In the year that the OCC hosts a wellness fair, the OCC will notify the Contractor within 90 days of the event date. Travel reimbursement is not authorized and will not be paid by the Government.

· Host a bi-annual online seminar to educate employees on the dental benefits and claims process.

Dental Insurance Plan Options. Employees are offered a choice between a dental Nationwide PPO option or a DHMO option. Regardless of the option selected or the number of persons covered, the OCC pays 100% of the premium. However, retirees pay 100% of the premium based on the coverage tier they elect, which can be retiree only, retiree plus one, or retiree and their eligible family members.

Dental Insurance Program Guide. The Contractor shall provide a detailed dental insurance program guide that outlines all program benefits to include, but is not limited to, plan design, program requirements, limitations, and exclusions. The program guide will be identified as the official statement of benefits.

The Contractor shall provide services in accordance with this SOW regardless of the actual number of services or fluctuation in services. Any information in this SOW regarding estimated or historical services is intended to aid the Contractor in understanding the requirements associated with the services.

1.4.3 ELIGIBILITY

All full-time and part-time employees who are hired on an appointment that is expected to last more than one year are offered the opportunity to enroll in the program. OCC and OFR employees can elect coverage for their eligible dependents as follows:

· A lawful spouse or domestic partner (same or opposite sex);

· Children (defined as a natural, step, foster, legally adopted, or child of the domestic partner) up to age 26, no requirements to be a full or part-time student; and

· A child that has been deemed “disabled” under the certification guidelines of the Federal Employees Health Benefits program. Eligibility must be established before the child obtains age 26, and the disability must be certified by a physician that a child is permanently and totally disabled and incapable of self-support.

1.4.4 ENROLLMENTS AND EFFECTIVE DATES

Below is a chart that identifies all the enrollment opportunities.

verify the event

change options

Moving at least 30 miles outside of the DHMO servicing area

address First of the month following receipt of enrollment form

Additionally, there are a few other events that may occur which will allow an employee to change their enrollment in the program. They are as follows:

six months

1.4.5 TERMINATION OF ENROLLMENT

When an employee’s employment ends, their coverage terminates on the date of their separation. A separated employee is not extended the option to continue coverage beyond their date of separation unless one of the following occurs:

1. Employee retires from the OCC on an immediate annuity;

2. Employee is approved for disability retirement by OPM;

3. Employee is offered a “buyout” by the OCC; or

4. Employee dies and any dependents enrolled on their plan will be extended 24 months of coverage, at which time the policy will terminate.

Coverage for a dependent will terminate when:

1. The employee’s coverage is terminated;

2. The dependent child attains age 26 ;

3. A dependent child under age 26 gets married;

4. The dependent dies;

5. The employee divorces their spouse or terminates their relationship with their domestic partner;

6. A stepchild or a child of the domestic partner is no longer in a “parent-child relationship” with the employee; or

7. The employee chooses to drop the dependent from coverage during open season or outside of open season. In this scenario, the employee can re-enroll the dependent during any open season only.

1.4.6 SURVIVOR BENEFITS

Upon the death of an employee or disabled retiree, the surviving dependents that are enrolled on the employee’s plan will be extended 24-months of coverage, at which time the policy will terminate.

1.4.7 FUNDING AND PAYMENT SCHEDULE

The program is fully insured, and the OCC pays 100% of the premium for both the PPO and DHMO options for active employees, disabled retirees, survivors, buyout employees and OFR active employees (this also includes employee who are in a leave without pay status or on military leave) and dependents. The monthly premium is “composite rated.” However, the OCC does not share in the cost of the premium for the non-disabled retirees and their premium rate consist of a 3-tier rate (Single, 2-Person, and Family) for which participants pay 100% of the premium. Attachment (4) includes further details on premium rate history.

The Contractor shall invoice the OCC monthly for payment for services for OCC and OFR active employees, OCC disabled retirees, survivors, and buyout employees. Non-disabled retirees shall be directly billed by the Contractor and the Contractor shall give them flexible payment options.

The OCC has a unique funding arrangement for its dental program which is a fully insured participating arrangement with a Premium Stabilization Reserve (PSR) account that is held by the Contractor. If claim costs are less than the premium paid for the year, then the extra money (after administrative expenses and profit are deducted) is held in the PSR and used for future rate reductions or a premium holiday. The contractor shall comply with this funding arrangement. Attachment (5), PSR Funding Agreement, provides further details regarding the specifics of the agreement.

Funds will be obligated at time of award for the base period (or at the time each option period is exercised if the Government chooses to exercise an option). Funds will be added to the contract by modification for eligible employees who are hired after July 1 of that period of performance, if needed. The Contractor agrees this incremental funding may be added by OCC via unilateral modification. The Contractor shall notify the Contracting Officer (CO) when 75% of the funds on any CLIN have been invoiced to the OCC. The Contractor shall provide an estimate of additional funds required for the remainder of the period of performance. The Contractor shall invoice the OCC monthly for payment for services for OCC and OFR active employees, OCC disabled retirees, survivors, and buyout employees in accordance with the PPO and DHMO plans outlined in Attachments (2) and (3). Non-disabled retirees shall be directly billed by the Contractor, and the Contractor shall give them flexible payment options.

1.4.8 PLAN DESIGN

The Contractor must provide dental insurance benefits with a plan design that covers a Preferred Provider Organization (PPO) plan option and a Dental Health Maintenance Organization (DHMO) plan option.

1.4.9 WEBSITE AND ENROLLMENT ADMINISTRATION TOOLS

Benefits Administration Tool. At a minimum, the Contractor shall provide a safe and secure electronic system to maintain enrollment data. The Contractor shall provide the OCC’s Human Capital (HC) staff access to the system for the purpose of processing new hire enrollments, qualifying life events, and open season changes. The Contractor shall provide training (and training materials) to the OCC’s HC staff on the use of their system. The Contractor shall troubleshoot any issues with processing enrollments.

The Contractor shall provide information about their capability to provide a self-service electronic enrollment tool to facilitate new hire elections, qualifying life events, and open season changes.

The Contractor shall provide an electronic method for non-disabled retirees to elect the dental PPO option, and provide payment options for the non-disabled retirees to pay directly to the Contractor.

Website. The Contractor shall provide a customized and accessible website for the OCC dental insurance program. At a minimum, this website shall have the capability for enrollees to search for PPO in-network and out-of-network dentists, DHMO dentists, options to print ID cards, plan information, Frequently Asked Questions, program guide, and voluntary retiree information.

Member Portal. The Contractor shall provide the capability for employees to register and access their member record. At a minimum, the portal shall include demographic information, options to view/print explanation of benefits (EOB), view/print ID cards, list dependents, and show a summary of dental plan option benefits. See section 1.11 below for specific security requirements.

Data File Exchanges. The Contractor shall have the capability to exchange data files with the OCC via a Secure File Transfer Protocol site established by the Contractor. The Contractor shall have the capability to generate an alternate ID number to use in lieu of employees’ Social Security Number (SSN). The Contractor shall not use full or partial SSNs as the employees’ alternate ID. The Contractor shall collaborate with the OCC IT Data Warehouse to establish data files necessary to administer the program. The Contracting Officer’s Representative (COR) will provide contract information for the Data Warehouse points of contact to the Contractor.

Future OCC Benefits Enrollment Platform. At any point during the period of performance, the OCC reserves the right to implement its own benefits enrollment platform to manage dental enrollment data for its dental insurance program. If the OCC implements its own benefits enrollment platform at any future date, the Contractor shall collaborate with the OCC to transition enrollment data and participate on the project team to ensure there is a smooth transition.

1.5 KEY PERSONNEL REQUIREMENTS

The Contractor shall provide a single point of contact that will serve as a liaison to the OCC to address day-to-day matters, per 1052.215-8003 Key Personnel, referred to as the “account manager”. This person must ensure that all issues are addressed and responded to in a timely manner, including tracking issues electronically (i.e., incident log), until the issues are resolved. If an issue cannot be resolved by the next business day, then the person must provide the OCC with a reasonable date that the issue will be resolved. This individual shall have a minimum of three years of account management experience in the insurance industry.

Respond to any issues brought to their attention by the next business day (if not with a resolution, should at least provide an acknowledgement of the issue and next steps);

· Ensure that eligibility and retiree billing issues are resolved in a satisfactory manner; and

· Ensure that the OCC is notified of any system outages at the earliest possible time but no later than on the day that the outage occurs.

1.6 CLAIMS EXPERIENCE

The Contractor shall process all claims accurately and in accordance with the time limit listed below. The Contractor shall provide OCC employees with written notification of its claims appeal process. The Contractor shall also ensure that employees have access to a safe and secure online system where they can view the status of a claim and print copies of the EOB statements for previously filed and adjudicated claims. The Contractor must have an option to opt out of paper mailings for claims and EOBs. The Contractor shall provide a method for the employee to obtain a pre-treatment estimate.

Contractor is to adjudicate claims timely and accurately with no more than a 1% error rate:

· Ensure that claim determinations are made within 14 calendar days of receipt, but no more than 30 calendar days; and

· EOB statements are mailed to the claimant's address on file within 5 business days of claims adjudication.

Offeror’s Claims Turnaround Report (CTR) that identifies the following:

· Date of receipt of claim,

· Date the claim was adjudicated, and

· Date the EOB was mailed.

The CTR is to be sent to the OCC monthly.

1.7 PERIOD OF PERFORMANCE

The OCC is awarding a contract with a 12-month base period and nine one-year options. There shall be a three-month transition period (date of award April 1, 2025, through June 30, 2025) included in the base period. There will be a line-item, that is not separately priced, for the transition period from the date of award to June 30, 2025, to facilitate the enrollment of OCC and OFR employees. Insurance coverage services shall commence on July 1, 2025. See clause OCC 1052.242-8002 for period of performance dates and details.

1.8 PLACE OF PERFORMANCE

The Contractor shall perform all its duties relating to this contract at the Offeror’s work location.

1.9 DELIVERABLES

The Contractor shall produce the following items:

1.9.1 ACCEPTANCE/REJECTION PROCEDURES

The COR will review all deliverables to ensure accuracy, functionality, completeness, professional quality, and overall compliance with the guidelines/requirements. The Contractor shall ensure the accuracy and completeness of all deliverables. Unless otherwise indicated, the Government will require ten (10) business days to review and/or comment on or accept deliverables. Errors, misleading or unclear statements, incomplete or irrelevant information, and/or excessive rhetoric, repetition, and/or "padding", shall be considered deficiencies and shall be subject to correction by the Contractor, at no additional cost to the Government. If the deliverable does not meet the noted criteria, the Government will return it for correction at no cost to the OCC.

If the COR rejects any deliverable, that rejected document will be handled in the following manner:

1.9.1.1 After notification that the deliverable did not meet the acceptance criteria, the Contractor shall re-submit an updated/corrected version within five 5 business days after receipt of Government comments. The Government will provide specific details as to why the deliverable is not acceptable.

1.9.1.2 Upon re-submission by the Contractor, the Government will reapply the same acceptance criteria. If the deliverable does not meet the acceptance criteria a second time, in addition to the Contractor being required to again fix the deficiencies, the incident may adversely impact the Contractor’s Contractor Performance Assessment Reporting System (CPARS) rating.

1.10 SECTION 508

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities. As such, the following requirements apply to this solicitation:

1. Products, platforms, and services delivered as part of this work statement that are ICT, or contain ICT, must conform to the Revised 508 Standards, which are located at 36 C.F.R. § 1194.1 & Apps. A, C & D, and available at https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines.

2. E102 / 702.10 – Web Content Accessibility Guidelines (WCAG) 2.0 guidelines success criteria level A & AA are incorporated as a requirement. The referenced WCAG criteria is available at http://www.w3.org/TR/WCAG20/.

3. A completed Accessibility Conformance Report (ACR) found at https://www.itic.org/policy/accessibility/vpat, using Voluntary Product Accessibility Template (VPAT) Revised Section 508 Edition, Version 2.5, is required to assist the Government in determining that the ICT products or services support Section 508 accessibility standards.

4. E202 – General Exceptions Authorized by OCC as applicable.

The following items are identified as containing ICT:

· Software Applications & Operating Systems

· Web-based Intranet and Internet Information and Applications

· Information, Documentation, and Support

Applicable Functional Performance Criteria: All functional performance criteria apply when using an alternative design or technology that achieves substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4-6 of the Revised 508 Standards, or when Chapters 4-6 do not address one or more functions of ICT.

Applicable requirements for software and Web products:

· E207 – WCAG Level A & AA Success Criteria

· E302 – Functional Performance Criteria

· E502 – Interoperability with Assistive Technology

· E503 – Application

Applicable requirements for electronic documents and/or support services:

· E205 – WCAG Level A & AA Success Criteria

· E302 – Functional Performance Criteria

· E602 – Support Documentation

· E603 – Support Services

1.11 SECURITY AND PRIVACY REQUIREMENTS

A. Compliance with Applicable Laws, Regulations, and Standards

Secure User-to-Cloud Communications Standards. All user-to-cloud service communications (e.g., via internet) must be encrypted with the latest industry standard browser protocol.

B. General Requirements

Location. Information collected, viewed, used, stored, maintained, or otherwise processed by the contractor in the performance of this contract shall be accessed, transferred, stored or processed only within the United States. In addition, the maintenance and support operations of the Offeror’s technology and information must take place, and originate from, within the United States.

US Persons: Federal employees, contractors, subcontractors, experts, consultants, and paid/unpaid interns hired for work within the United States or its territories and possessions and who require access to sensitive Controlled but Unclassified Information (CUI), like Personal Identifiable Information (PII), IT systems or security items or products, shall either be U.S. citizens or have lawful permanent resident alien status (green card holders).

The contractor shall not host any portion of the information, information system, infrastructure, or environment in facilities outside the contiguous United States, Alaska, Hawaii, and other U.S. Territories.

Authorization to Use, Store, or Share Sensitive Information. The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all government data, equipment, etc. by treating the information as Controlled but Unclassified (CUI) information. All information gathered or created under this contract shall be considered as (CUI). It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets.

Confidentiality. The contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

Deliverables. The deliverables in this contract will be considered CUI and shall not be shared with any other organization without prior written approval from the Information System Security Officer (ISSO).

C. Security and Privacy Authorization

Authorization Boundary. The contractor shall provide a security architecture diagram(s) specific for the OCC, that clearly demarcates the information system authorization boundary and depicts all of its connections, ports, protocols, functions, services, and components, including the means for monitoring and controlling communications at the external boundary and at key internal boundaries within the system. The contractor shall address all components, connections, ports, protocols, security controls, and managed interfaces of the information system authorized for operation (e.g., routers, firewalls). The diagram must include a predominant border drawn around all system components and services included in the authorization boundary. If there are OCC-specific components (e.g., components developed or customized for the OCC, OCC-hosted components, etc.) and/or other components supporting this solution that are not in the scope of the Offeror’s existing security documentation, then identify those components in the diagram as well, as part of a separate OCC-specific boundary since those are unique to OCC and shall be part of the OCC-specific security authorization. The diagram must be easy to read and understand. Formal names of components as they are known at the service provider organization in functional specifications, configuration guides, other documents and live configurations shall be named on the diagram and described. The contractor shall provide a key for symbols used. This diagram shall be delivered to the Everbridge COR, Enterprise Architect, and Information System Security Officer.

External Service Provider Compliance & Monitoring Background. The FISMA and OMB policies require that federal agencies using external service providers to process, store, or transmit federal information or operate information systems on behalf of the federal government, assure that such systems meet the information security protections commensurate with the information and system sensitivity. Federal agencies are responsible and accountable for the information security risk incurred by the use of information system services provided by external providers.

Such risk is addressed by incorporating the Risk Management Framework (RMF)1 and security requirements for external information systems and services as part of the terms and conditions of the contracts with external providers. Federal agencies can also require external providers to provide appropriate evidence to demonstrate that they have complied with protecting federal information. Prior to the implementation of the Offeror’s system or services, the OCC ensures compliance with the RMF by issuing an Authorization to Operate (ATO) or Authorization to Use (ATU), based on its review and analysis of the external provider's security documentation (described in detail in the next section) and assessment of customer (OCC's) security responsibilities.

1. NIST Special Publication 800-37, as amended, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy.

Non-Federal External Service Provider Security Documentation. Non-federal organizations with primarily non-federal customers have limitations with respect to complying with all federal requirements. As a result, the OCC obtains assurance through other industry standard security reviews, including Statement on Standards for Attestation Engagements (SSAE) No. 19.

a. Statement on Standards for Attestation Engagements (SSAE) No. 19 Requirements. The contractor shall provide the OCC with an SSAE No. 19 System and Organization Controls (SOC) 2 Type 2 Report on an annual basis for services provided.

b. The preferred coverage period for the report is July 1 through June 30 with a bridge letter covering the three months to September 30.

c. For any gaps in the fiscal year coverage period (October 1 - September 30), the OCC will work with the contractor to complete the internal controls assessment by relying on the work performed by the Offeror’s competent and objective internal audit function per Statement on Auditing Standards No. 128, Using the Work of Internal Auditors.

d. The submission of the results of the SSAE No. 19 SOC 2 Type 2 Report shall be as instructed per the "Security and Privacy Vendor Deliverables" section.

e. If SOC 2 Type 2 reports are not available within the last three years, the contractor shall inform the OCC to determine if there is a suitable alternative with similar level of information and detail.

f. If any portion of standard security objectives (e.g., contingency planning controls, etc.) were not in the scope of the independent auditors testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2 report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

2. OCC Security Authorization to Use. The determination of whether to issue an OCC security authorization will be made by the OCC based on the identified risks to the OCC's data and operations. These risks include: (1) deficiencies noted in the Offeror’s most recent SOC 2 Type 2 Report, (2) the gaps identified in the IT security and privacy control assessments performed specific to OCC customer responsibility implementations as designated in the CRM.

D. Configuration Management

Security Configuration Settings. The contractor shall establish and enforce security configuration settings for information technology products employed in the identified ITS secure configuration baseline. See Attachment 9 for further information.

Security Updates and Patches. The contractor shall ensure that the Dental IT system is properly maintained and monitored, to include immediate response to critical security patches, routine maintenance windows to allow for system updates, and compliance with the defined configuration management and change control processes. All patches and system updates shall be properly tested in a development environment before being implemented in the production environment.

Least Functionality. The contractor shall restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services for information technology products employed in the Dental IT system.

E. Continuous Monitoring

Compliance Reviews and Audits. The contractor shall permit and support compliance reviews and audits under applicable laws to allow the OCC to meet legal and compliance obligations and shall implement processes that allow visibility into the privacy and security controls employed and their effectiveness. The contractor shall provide the OCC or authorized designated officials with information requested by auditors in a timely manner, consistent with the respective auditor's deadline, in support of security compliance reviews and various annual audits, e.g., FISMA, Financial Statement Audit, A-123, etc.

In addition, the contractor shall provide the OCC or authorized designated officials logical and physical access to the Offeror’s facilities, installations, technical capabilities, operations, records, and databases pertinent to this contract within seven (7) calendar days upon request for these purposes.

Annual SOC 2 Type 2 Reviews. As mentioned in this SOW. "Security and Privacy Authorization," under SSAE No. 19 requirements, the contractor shall provide the annual SSAE No. 19 SOC 2 Type 2 report to the OCC for review in support of continuous monitoring activities. If any portion of standard security objectives (e.g., contingency planning controls, etc.) were not in the scope of the independent auditor's testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2 report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

Logging. The service provider must provide OCC audit access to any FIPS 199 Moderate, or higher data encrypted at rest and in motion in the commercial cloud at an Event Logging (EL) maturity level of EL3. An example of EL2 requirements, which is required to be satisfied for EL3, can be found in the Copy of CISA Enterprise Logging Data Convention Link. Detailed EL3 requirements are listed in OMB Memorandum M21-31.

The service provider shall forward all required logging data, in near real-time and on an automated basis, to centralized systems responsible for security, information, and event monitoring Security Event and Incident Management (SEIM) e.g., SPLUNK; bulk storage; and other analytical workflows or services. Data must be encrypted in transit between its source and destination.

F. Data Protection

Data Encryption. Where encryption is required, as specified by the OCC, the contractor shall ensure that encryption is established and maintained for data at rest and in transit for the duration of the contract. The encryption employed shall be equivalent to those approved in Federal Information Processing Standards (FIPS) Publication 140-2 or 140-3.

Need to Know. CUI/Sensitive information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The contractor shall ensure that appropriate administrative, technical, electronic, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected.

Such measures include controls listed in NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, as amended, in the following areas: Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity.

Data Separation. Unless otherwise directed by the OCC and/or controls are implemented to ensure adequate separation, any storage of data shall be contained within the resources allocated by the contractor to support the OCC and may not be on systems that are shared with other commercial or government clients.

General Use of Controlled Unclassified Information (CUI). The contractor shall not use any CUI or CUI subcategories, including, Personally Identifiable Information (PII) or low-sensitivity PII (e.g., E-mail Groups and Lists), for any purpose other than those activities necessary to the performance of this contract.

Use of Contractor Equipment. Use of contractor-owned laptops or other equipment (e.g., media storage devices, servers, etc.) to process, transmit, or store OCC information or to access the OCC network or other OCC information resources without OCC's formal approval is prohibited. This restriction does not apply to the use of non-OCC laptops or PCs to use OCC-approved virtual desktop infrastructure to remotely access the OCC network.

G. Incident Response

Notification. The contractor must report all information security incidents that potentially or actually cause the compromise of OCC information, even if the contractor believes the security incident may be limited, small, or insignificant with respect to OCC data or systems. The OCC will determine when the Offeror’s reported security incident requires additional focus and attention.

Within one hour from the time the contractor validates that an information security incident has occurred, the contractor must report the security incident information to the OCC Cyber Defense Center (CDC): Computer.Security@occ.treas.gov, (202) 649-7930, regardless of day or time.

The contractor must provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC with the following text in the subject line of the email: “Supplementary Information/Report related to previously reported incident # [insert number].”

Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

When notifying the OCC CDC, copy the Contracting Officer if possible or, if reporting by phone or Contracting Officer's email is not immediately available, contact the Contracting Officer immediately after reporting the incident to the OCC CDC.

Information, System and Tool Availability. The contractor shall make available any information, systems, and tools necessary for the OCC to respond to incidents in a manner consistent with NIST SP 800-61, as amended. In the case of a reported security incident, the contractor shall provide the OCC with access to the Offeror’s system and/or facilities within 72 hours of the OCC's request.

H. Information Ownership

Government Access. The government will retain unrestricted rights to government data. The OCC retains ownership of any user created/loaded data and deliverables (e.g., documents, applications, custom code, diagrams, workflows, data sets, etc.) hosted on Offeror’s equipment, systems, infrastructure, etc., as well as maintains the right to request full copies of these at any time.

Removal of OCC Data. The contractor acknowledges the OCC's exclusive right of ownership of the information and is required to transfer, return, and/or delete all agency data collected, processed, stored or maintained by the contractor on behalf of OCC upon termination of services, and shall provide written certification and supporting documentation attesting to the transfer, return and/or deletion of agency information or data generated, collected, processed, maintained, or stored by the contractor and any subcontractors, per instructions the "Security and Privacy Vendor Deliverables" section.

Documents and Deliverables. The preliminary and final OCC-specific deliverables and all associated working papers are the property of the U.S. Government. The contractor shall not release any information without the written consent of the Contracting Officer. All work papers, preliminary and final deliverables must be submitted to the COR at the conclusion of the contract in an acceptable and usable format, which may include the original format.

eDiscovery. The contractor must ensure data preservation requirements (i.e., halt destruction and maintain data the contractor may not otherwise have to maintain) related to litigation holds are met. The contractor shall also ensure that metadata associated with litigation holds are preserved. Metadata is electronically stored information that describes the history, tracking, or management of an electronic document. It is created automatically when a user creates, modifies, accesses, or takes other actions with respect to an electronic document.

The contractor shall provide immediate access to all government data and government-related data impacting government data for review or scan, or conduct of a forensic evaluation, and physical access to any contractor facility with government data.

I. System Access

Government Right to Terminate Access. The OCC, at its discretion, may suspend or terminate the access to any systems and/or facilities when an information security incident or other electronic access violation, use or misuse issue gives cause for such action. The suspension or termination may last until such time as OCC determines that the situation has been corrected or no longer exists.

The system shall implement multi-factor authentication for remote users.

J. Training Requirements

K. Supply Chain Risk Management

Background. In accordance with Federal requirements, the OCC requires supply chain entities to implement necessary security safeguards to: (i) reduce the likelihood of unauthorized modifications at each stage in the supply chain; and (ii) protect information systems and information system components, prior to taking delivery of such systems/components. This control also applies to information system services.

Supply Chain Safeguards. The contractor will:

a. Implement security and privacy controls for systems, facilities, and external connections to systems as necessary to ensure compliance with the laws, regulations, standards, and requirements specified in Sections C. Security and Privacy Authorization, F. Data Protection, and I. System Access.

b. Implement personnel screening processes to ensure suitability in accordance with relevant standards and requirements.

c. Use of tamper-evident packaging during shipping/warehousing.

d. Avoid the purchase of custom configurations to reduce the risk of acquiring information systems, components, or products that have been corrupted via supply chain actions targeted at specific organizations.

e. Vet the processes and security practices of subordinate suppliers, critical information system components, and services.

f. Employ a diverse set of suppliers to limit the potential harm from any given supplier in the supply chain.

g. Work with ISSOs to remediate high and critical vulnerabilities identified through the OCC’s vendor risk process.

h. Implement contract language regarding the prohibition of tainted or counterfeit components.

i. Restrict purchases from specific suppliers or countries per requirements issued by the U.S. Department of Homeland Security (DHS) and/or Federal Acquisition Security Council, as these requirements pertain to the management of supply chain risk for Federal Agencies.

j. Use trusted/controlled distribution, delivery and warehousing options to reduce supply chain risk.

L. Security and Privacy Vendor Deliverables

Authorization Boundary Deliverables

Non-Federal External Service Provider (ESP) Security Documentation Deliverables

Removal of Data Deliverables

Non-Federal ESP Security Documentation [Commercial ESP or Public Cloud ESP w/Nonfederal Customer Base and No FedRAMP ATO]

C. Security and Privacy Authorization. SSAE No. 19 Requirements.

E. Continuous Monitoring. Annual SOC 2 Type 2 Reviews

Annual: NLT May 1

M21-31 Logging Requirement

E. Continuous Monitoring

1.12 PAYMENT OF POSTAGE AND FEES

All postage and fees related to submitting information, including forms, reports, etc., to the CO or the COR shall be paid by the Contractor.

1.13 MARKING

All information submitted to the CO, or the COR shall be clearly marked to show the following:

1. Name of the Contractor

2. Contract Number

3. Consignee’s name and address

4. Date of Submission

1.14 REPORT COVER SHEET

Each report submitted by the Contractor shall have a cover sheet containing the following information:

1. Title of report

2. Report number or type

3. Period covered by the report

4. Contract number

5. Name and address of the Contractor

6. Name of the COR

7. Date of Submission

1.15 BUSINESS HOURS AND COVERAGE

The Contractor shall provide customer service between the hours of 7:00 AM - 6:00 PM ET, Monday through Friday.

Note: The Contractor customer service must comply with the U.S. Persons requirement.

1.16 LEGAL HOLIDAYS

The following legal holidays are observed:

*Holidays that fall on Saturday are observed on Friday and…