Fiduciary Liability Insurance and Consulting PWS_Draft.pdf

Request for Quotation No. 2031JW26Q00011

Fiduciary Liability Insurance and Consulting Services

1.0 BACKGROUND

The Office of the Comptroller of the Currency (OCC), established in 1863, is a non-appropriated federal financial regulatory bureau of the U.S. Department of the Treasury. The OCC oversees two separate defined contribution plans: (1) the OCC 401(k) Plan; and (2) the Office of Thrift

Supervision (OTS) 401(k) Plan. Charles Schwab, Inc., is the third-party record keeper for the

OCC and OTS 401(k) Plans.

2.0 SCOPE

The OCC requires fiduciary liability insurance and consulting services specifically the services of a specialty lines insurance broker that is both qualified and experienced in providing fiduciary liability. The term “experienced and qualified” refers to necessary industry expertise in fiduciary liability insurance. The consulting services includes expert training and consultative sessions to

401(k) Committee members.

The fiduciary liability insurance and errors and omissions coverages shall protect the OCC and its employees from claims of legal liability arising from the sponsorship and administration of the Agency 401(k) Plan. This is in accordance with Employee Retirement Income Security Act of 1974 (ERISA) guidelines even though as a governmental plan OCC is not subject to ERISA.

In addition, the OCC requires a thorough assessment and comparative analysis of both the quality of competitive fiduciary liability insurance coverage and the premiums, on behalf of the

OCC.

3.0 TASK

The Contractor shall provide the services as follows:

Fiduciary Liability Insurance

1. Review the terms of the current OCC fiduciary liability insurance policies and provide all existing coverage identified, at a minimum.

2. Provide quotes for the primary (base) fiduciary liability insurance coverage for at least

$10 million. The contractor may include but are not limited to ladder arrangements (i.e., $10 million, $15 million, $25 million, etc.) to spread the risk among multiple insurance companies.

3. Provide Errors and Omissions Coverage. Errors and omissions coverage protects the

OCC against claims for negligence, mistakes, faulty advice, or failure to provide promised results.

PART II – PERFORMANCE WORK STATEMENT

4. Provide a copy of the policy coverage as designated by the OCC. The policy coverage shall be on an annual basis, by June 9th, and provided to the OCC Contracting Officer’s

Representative (COR).

5. Review the terms of all existing OCC fiduciary liability insurance policies and provide consulting services.

Consulting Services

6. The specialty lines insurance broker shall provide consulting services to the OCC and expert Fiduciary Liability Insurance training sessions to 401(k) Sub-Committee members.

The specialty lines insurance broker shall:

a. On an ad-hoc basis, in the event OCC has fiduciary liability insurance policy questions, provide direct access and facilitate meetings between the OCC and insurance carrier(s).

b. Participate (virtually) in OCC’s 401(k) Sub-Committee meetings on at least a quarterly basis during the duration of the period of performance. Please note, the

OCC will collaborate with the specialty lines insurance broker to determine the meeting agenda talking points, to include but not limited to the items listed in item “c” noted below.

c. Conduct quarterly Fiduciary Liability Insurance consultative and training sessions, covering topics to include but not limited to:

i. Role of a Fiduciary o Fiduciary Duty o Fiduciary Responsibility

ii. Trends in litigation and coverage options (cybersecurity, etc.) in industry.

iii. Best practices to reduce plan risk profile and mitigate lawsuits.

iv. Evaluation and recommendation on OCC existing coverage.

d. The specialty lines insurance broker must respond to inquiries from OCC, within

5 business days.

ICT Accessibility

7. Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of

1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities. As such, the following requirements apply to this solicitation:

a. Reports shall be delivered in electronic, plain text (not scanned images) of PDF, Microsoft Word, and/or Microsoft Excel format. These deliverable reports shall conform to the OCC Guide for Creating Section 508 Compliant PDF/Word

Documents (see attached) and shall enable OCC users with assistive technology (such as JAWS or Dragon) to have a consistent layout structure to comprehend the information being presented in those various deliverable reports.

4.0 PERFORMANCE REQUIREMENTS SUMMARY

The Contractor shall be responsible for fulfilling the requirements of the Performance Work

Statement (PWS). Below is a chart that identifies the qualitative performance standards

(objectives), the OCC’s intended quality assurance procedures and frequency of inspections

(measures), and what the Government believes is the minimum satisfactory rating (expectations).

Task Areas

(Performance

Requirements)

Standard (s) and

Acceptable Quality Level

(AQL)

Surveillance

Method Disincentive

Services

Consultative

Fiduciary Liability

Insurance and

Training

Conduct Consultative and

Training Services are provided as required by the

PWS.

AQL: The Contractor shall be provided with two opportunities to improve performance. COR has discretion in evaluating customer complaints regarding what constitutes satisfactory level of service.

Customer

Feedback

More than 3 instances of customer complaints may result in an unsatisfactory

CPARs rating.

Provide a copy of the fiduciary liability insurance policy coverage as required by the OCC on an annual basis, by June

9th, to the OCC

COR.

Policy shall meet the specifications of coverage, providing at least $10 million in Fiduciary Liability

Insurance coverage, as identified in the OCC PWS and clearly explain an exception of errors and omissions coverage.

Customer

Feedback

100% inspection of policy documents

Not providing the fiduciary liability insurance policy on an annual basis, by June 9th, and/or explanation of the reason for not providing errors and omission coverage will result in an unsatisfactory CPARs rating.

Consulting Services for renewal of the fiduciary liability insurance policies

Provide consulting services to OCC during the renewal process of the fiduciary liability insurance policies to ensure renewed policies offer best value to OCC and are consistent with industry standards.

Customer

Feedback

More than 3 instances of customer complaints on consulting services provided may result in an unsatisfactory CPARs rating.

5. COMPLIANCE WITH APPLICABLE LAWS, REGULATIONS, AND STANDARDS

A. Secure User-to-Cloud Communications Standards. All user-to-cloud service communications

(e.g., via internet) must be encrypted with the latest industry standard browser protocol.

B. General Requirements

Location. Information collected, used, stored, maintained, or otherwise processed by the contractor in the performance of this contract shall be accessed, transferred, stored, or processed only within the United States. In addition, the maintenance and support operations of the contractor's technology and information must take place, and originate from, within the United

States. The contractor shall not host any portion of the information, information system, infrastructure, or environment in facilities outside the contiguous United States, Alaska, Hawaii, and other U.S. Territories.

Authorization to Use, Store, or Share Sensitive Information. The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all government data, equipment, etc. by treating the information as sensitive. All information gathered or created under this contract shall be considered as Controlled but Unclassified (CUI) information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets.

Confidentiality. The contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

Deliverables. The deliverables in this contract will be considered sensitive and shall not be shared with any other organization without prior approval from the OCC CO.

C. Security and Privacy Authorization

Authorization Boundary. The contractor shall provide a diagram specific for the OCC, that clearly demarcates the information system authorization boundary and depicts all of its connections and components, including the means for monitoring and controlling communications at the external boundary and at key internal boundaries within the system. The contractor shall address all components and managed interfaces of the information system authorized for operation (e.g., routers, firewalls). The diagram must include a predominant border drawn around all system components and services included in the authorization boundary.

If there are OCC-specific components (e.g., components developed or customized for the OCC, OCC-hosted components, etc.) and/or other components supporting this solution that are not in the scope of the contractor's existing security documentation, then identify those components in the diagram as well, as part of a separate OCC-specific boundary since those are unique to OCC and shall be part of the OCC-specific security authorization. The diagram must be easy to read and understand. Formal names of components as they are known at the service provider organization in functional specifications, configuration guides, other documents and live configurations shall be named on the diagram and described. The contractor shall provide a key for symbols used.

External Service Provider Compliance & Monitoring Background. The FISMA and OMB policies require that federal agencies using external service providers to process, store, or transmit federal information or operate information systems on behalf of the federal government, assure that such systems meet the information security protections commensurate with the information and system sensitivity. Federal agencies are responsible and accountable for the information security risk incurred by the use of information system services provided by external providers.

Such risk is addressed by incorporating the Risk Management Framework (RMF)1 and security requirements for external information systems and services as part of the terms and conditions of the contracts with external providers. Federal agencies can also require external providers to provide appropriate evidence to demonstrate that they have complied with protecting federal information. Prior to the implementation of the contractor's system or services, the OCC ensures compliance with the RMF by issuing an Authorization to Operate (ATO) or Authorization to Use

(ATU), based on its review and analysis of the external provider's security documentation

(described in detail in the next section) and assessment of customer (OCC's) security responsibilities. NIST Special Publication 800-37, as amended, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and

Privacy.

Non-Federal External Service Provider Security Documentation. Non-federal organizations with primarily non-federal customers have limitations with respect to complying with all federal requirements. As a result, the OCC obtains assurance through other industry standard security reviews, including Statement on Standards for Attestation Engagements (SSAE) No. 18.

D. Configuration Management

Security Configuration Settings. The contractor shall establish and enforce security configuration settings for information technology products employed in the Fiduciary Liability Insurance

Services.

Security Updates and Patches. The contractor shall ensure that the Fiduciary Liability Insurance

Services is properly maintained and monitored, to include immediate response to critical security patches, routine maintenance windows to allow for system updates, and compliance with the defined configuration management and change control processes. All patches and system updates shall be properly tested in a development environment before being implemented in the production environment.

Least Functionality. The contractor shall restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services for information technology products employed in the Fiduciary Liability Insurance Services.

E. Continuous Monitoring

Compliance Reviews and Audits. The contractor shall permit and support compliance reviews and audits under applicable laws to allow the OCC to meet legal and compliance obligations and shall implement processes that allow visibility into the privacy and security controls employed and their effectiveness. The contractor shall provide the OCC or authorized designated officials with information requested by auditors in a timely manner, consistent with the respective auditor's deadline, in support of security compliance reviews and various annual audits, e.g., FISMA, Financial Statement Audit, A-123, etc.

In addition, the contractor shall provide the OCC or authorized designated officials logical and physical access to the contractor's facilities, installations, technical capabilities, operations, records, and databases pertinent to this contract within seven (7) calendar days upon request for these purposes.

F. Data Protection

Data Encryption. Where encryption is required, as specified by the OCC, the contractor shall ensure that encryption is established and maintained for data at rest and in transit for the duration of the contract. The encryption employed shall be equivalent to those approved in Federal

Information Processing Standards (FIPS) Publication 140.

Need to Know. Sensitive information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected.

Such measures include controls listed in NIST SP 800-171, Protecting Controlled Unclassified

Information in Nonfederal Systems and Organizations, as amended, in the following areas:

Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel

Security, Physical Protection, Risk Assessment, Security Assessment, System and

Communications Protection, and System and Information Integrity.

Data Separation. Unless otherwise directed by the OCC and/or controls are implemented to ensure adequate separation, any storage of data shall be contained within the resources allocated by the contractor to support the OCC and may not be on systems that are shared with other commercial or government clients.

General Use of Personally Identifiable Information (PII). The contractor shall not use any PII, including low-sensitivity PII (e.g., E-mail Groups and Lists), for any purpose other than those activities necessary to the performance of this contract.

Use of Contractor Equipment. Use of contractor-owned laptops or other equipment (e.g., media storage devices, servers, etc.) to process, transmit, or store OCC information or to access the

OCC network or other OCC information resources without OCC's formal authorization is prohibited. This does not include the use of non-OCC laptops or PCs to use OCC-approved virtual desktop infrastructure to remotely access the OCC network.

G. Incident Response

Notification. The contractor must report all information security incidents that potentially or actually cause the compromise of OCC information, even if the contractor believes the security incident may be limited, small, or insignificant with respect to OCC data or systems. The OCC will determine when the contractor's reported security incident requires additional focus and attention.

Within one hour from the time the contractor validates that an information security incident has occurred, the contractor must report the security incident information to the OCC Cyber Defense

Center (CDC): Computer.Security@occ.treas.gov, (202) 649-7930, regardless of day or time.

The contractor must provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC with the following text in the subject line of the email: “Supplementary Information/Report related to previously reported incident # [insert number].”

Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit

Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive

Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

When notifying the OCC CDC, copy the Contracting Officer if possible or, if reporting by phone or Contracting Officer's email is not immediately available, contact the Contracting Officer immediately after reporting the incident to the OCC CDC.

Information, System and Tool Availability. The contractor shall make available any information, systems and tools necessary for the OCC to respond to incidents in a manner consistent with

NIST SP 800-61, as amended. In the case of a reported security incident, the contractor shall provide the OCC with access to the contractor's system and/or facilities within 72 hours of the

OCC's request.

H. Information Ownership

Government Access. The government will retain unrestricted rights to government data. The

OCC retains ownership of any user created/loaded data and deliverables (e.g., documents, applications, custom code, diagrams, workflows, data sets, etc.) hosted on contractor's equipment, systems, infrastructure, etc., as well as maintains the right to request full copies of these at any time.

Removal of OCC Data. The contractor acknowledges the OCC's exclusive right of ownership of the information and is required to transfer, return, and/or delete all agency data collected, processed, stored or maintained by the contractor on behalf of OCC upon termination of services, and shall provide written certification and supporting documentation attesting to the transfer, return and/or deletion of agency information or data generated, collected, processed, maintained, or stored by the contractor and any subcontractors, per instructions the "Security and Privacy

Vendor Deliverables" section.

Documents and Deliverables. The preliminary and final OCC-specific deliverables and all associated working papers and other material deemed relevant by the agency that have been generated in the performance of this contract, are the property of the U.S. Government. The contractor shall not release any information without the written consent of the Contracting

Officer. All work papers, preliminary and final deliverables must be submitted to the COR at the conclusion of the contract in an acceptable and usable format, which may include the original format.

eDiscovery. The contractor must ensure data preservation requirements (i.e., halt destruction and maintain data the contractor may not otherwise have to maintain) related to litigation holds are met. The contractor shall also ensure that metadata associated with litigation holds are preserved.

Metadata is electronically-stored information that describes the history, tracking, or management of an electronic document. It is created automatically when a user creates, modifies, accesses, or takes other actions with respect to an electronic document.

The contractor shall provide immediate access to all government data and government-related data impacting government data for review or scan, or conduct of a forensic evaluation, and physical access to any contractor facility with government data.

I. System Access

Government Right to Terminate Access. The OCC, at its discretion, may suspend or terminate the access to any systems and/or facilities when an information security incident or other electronic access violation, use or misuse issue gives cause for such action. The suspension or termination may last until such time as OCC determines that the situation has been corrected or no longer exists.

The system shall implement multi-factor authentication for remote users.

Training Requirements: None

J. Supply Chain Risk Management

Background. In accordance with Federal requirements, the OCC requires supply chain entities to implement necessary security safeguards to: (i) reduce the likelihood of unauthorized modifications at each stage in the supply chain; and (ii) protect information systems and information system components, prior to taking delivery of such systems/components. This control also applies to information system services.

Supply Chain Safeguards.

The contractor will:

a. Implement security and privacy controls for systems, facilities, and external connections to systems as necessary to ensure compliance with the laws, regulations, standards, and requirements specified in Sections C.

Security and Privacy Authorization, F. Data Protection, and I. System

Access.

b. Implement personnel screening processes to ensure suitability in accordance with relevant standards and requirements.

c. Use of tamper-evident packaging during shipping/warehousing.

d. Avoid the purchase of custom configurations to reduce the risk of acquiring information systems, components, or products that have been corrupted via supply chain actions targeted at specific organizations.

e. Vet the processes and security practices of subordinate suppliers, critical information system components, and services.

f. Employ a diverse set of suppliers to limit the potential harm from any given supplier in the supply chain.

g. Implement contract language regarding the prohibition of tainted or counterfeit components.

h. Restrict purchases from specific suppliers or countries per requirements issued by the U.S. Department of Homeland Security (DHS) and/or Federal

Acquisition Security Council, as these requirements pertain to the management of supply chain risk for Federal Agencies.

i. Use trusted/controlled distribution, delivery and warehousing options to reduce supply chain risk.

K. Security and Privacy Vendor Deliverables – Located on next page.

Removal of Data Deliverables

Section Deliverable Frequency Due Date

H. Information Ownership.

Removal of OCC Data

F. Data Protection.

Contractor Equipment

Certification of OCC Data

Removal from Contractor’s

(including any subcontractors), Possession, Equipment, and/or

Environment. Data removal instructions include transfer of information to another party per specific instructions from the CO; return of information, deliverables, etc., to the CO;

and deletion of OCC data from contractor equipment

(e.g., laptops and other contractor-owned equipment previously approved by the

OCC for this use) using NIST

SP 800-88, Guidelines for

Media Sanitization, as amended.

Once NLT 15 days after termination/expiration of contract

Authorization Boundary Deliverables

C. Security and

Privacy

Authorization.

Authorization

Boundary

OCC-specific Demarcated Security Authorization

Boundary for the solution

Initially, and as changes occur

Initial: Within

30 Days of

Award

Non-Federal External Service Provider (ESP) Security Documentation

C. Security and

Privacy

Authorization. SSAE

18 Requirements

E. Continuous

Monitoring. Annual

SOC 2 Type 2

Reviews

Statement on Standards for Attestation

Engagements (SSAE) 18 SOC Type II report.

The Contractor may substitute the National

Institute of Standards and Technology (NIST)

800-171 report for the SSAE 18 SOC Type II

Report. The preferred coverage period for the report is July 1 through June 30 with a bridge letter covering the three months to September

30.

Annually

Within 30 Days of

Award

6. REQUIREMENTS FOR PROVIDING FIDUCIARY INSURANCE AFTER

CONTRACT AWARD: THE CONTRACTOR AT A MINIMUM SHALL PERFORM

AND PROVIDE A WRITTEN ASSESSMENT WITH ITS QUOTE THAT INCLUDES

BUT IS NOT LIMITED TO:

1. Solicit quote(s) for fiduciary liability insurance and errors and omission coverages, from qualified insurance companies with capital in excess of $1 billion. The insurance policy shall be effective on an annual basis, by June 9th.

2. If errors and omissions coverage is not available, the Contractor must provide a detailed written explanation as to why it is not available.

3. Identify insurance companies capable of providing fiduciary liability coverage options for the primary base of $10 million in coverage.

4. The Contractor’s assessment may include possible ladder arrangements (i.e., $10 million, $15 million, $25 million, etc.) to spread the risk among multiple insurance companies.

5. Assess each insurance companies’ expertise in fiduciary liability insurance and coverage options, these options must consider multiple deductible, coverage, and premium options.

a. A comparison of strengths and weaknesses of the different fiduciary liability insurance coverage offered.

b. A comparison of the costs of coverage; and

c. An analysis of the terms and amount of coverage that would be most beneficial to the OCC from a cost and technical standpoint.

6. Clearly state and explain any coverage exclusions.

7. Provide full draft insurance policies with the quote and a detailed explanation of all related costs.

8. The Contractor shall respond in writing or verbally as requested by the government to all questions concerning its quote. Responses shall be provided by the Contractor within 5 business days of submission of the questions by the OCC, unless the OCC grants additional time. The Contractor shall also participate in virtual meetings as requested by the OCC to clarify any questions related to its quote.

9. The specialty lines insurance broker shall provide consulting services to the OCC and expert Fiduciary Liability Insurance training sessions to 401(k) Sub-Committee members.

a. On an ad hoc basis, address the fiduciary liability insurance policy questions, provide direct access and facilitate meetings between the OCC and insurance carrier(s).

b. Participate (virtually) in OCC’s 401(k) Sub-Committee meetings on at least a quarterly basis during the duration of the period of performance.

c. Conduct quarterly Fiduciary Liability Insurance consultative and training sessions.

10. Provide the policy coverage amount as designated by the OCC, effective on an annual basis, by June 9th.

7. GOVERNMENT FURNISHED INFORMATION

The following information will be provided, as an attached document, to assist with underwriting an insurance policy:

• Total OCC and OTS 401(k) Plan assets

• Total OCC 401(k) Plan participants (active and separated).

• Total OTS 401(k) Plan participants (active and separated).

As a governmental plan, the Employee Retirement Income Security Act does not apply to the

OCC and OTS 401(k) Plans.

8. DELIVERABLES

Task

Deadline/

Frequency

Deliverable Performance Indicators and Standards

Quarterly Conduct Fiduciary Liability

Insurance Consultative and Training

Services

Accuracy, Completeness, Timeliness.

Services are provided accurately in entirety and on a quarterly basis.

Annually Provide a copy of the fiduciary liability insurance policy coverage as required by June 9th, annually, to the

OCC COR.

Accuracy, Completeness, Timeliness.

Policy shall meet the specifications of coverage, providing at least $10 million in coverage, as identified in the OCC PWS and clearly explain an exception of errors and omissions coverage.

Ad-hoc

Basis

On an ad-hoc basis, address fiduciary liability insurance policy questions, provide direct access and facilitate meetings between the OCC and insurance carrier(s).

Accuracy, Completeness, Timeliness.

Services are provided accurately in entirety on an ad-hoc basis.