RFQ No. 2031JW26Q00011.pdf

Request for Quotation No. 2031JW26Q00011

Fiduciary Liability Insurance and Consulting Services

1.0 General

This procurement is unrestricted and conducted in accordance with FAR 12 in conjunction with

FAR 13.5, on a best value basis.

The Quoter shall provide all management, personnel, materials, labor, and equipment and facilities and shall do all that is necessary to satisfy the requirements described in Part II:

Performance Work Statement (PWS). The NAICS for this requirement is 524210 (Insurance

Agencies and Brokerages), Size Standard: $15M.

2.0 Contract Line Item Number (CLIN) Structure

The Quoter shall provide firm fixed pricing in accordance with the Contract Line Item Number

(CLIN) structure identified in the Standard Form 1449 Sections 19 and 20.

1.0 BACKGROUND

The Office of the Comptroller of the Currency (OCC), established in 1863, is a non-appropriated federal financial regulatory bureau of the U.S. Department of the Treasury. The OCC oversees two separate defined contribution plans: (1) the OCC 401(k) Plan; and (2) the Office of Thrift

Supervision (OTS) 401(k) Plan. Charles Schwab, Inc., is the third-party record keeper for the

OCC and OTS 401(k) Plans.

2.0 SCOPE

The OCC requires fiduciary liability insurance and consulting services specifically the services of a specialty lines insurance broker that is both qualified and experienced in providing fiduciary liability. The term “experienced and qualified” refers to necessary industry expertise in fiduciary liability insurance. The consulting services includes expert training and consultative sessions to

401(k) Committee members.

The fiduciary liability insurance and errors and omissions coverages shall protect the OCC and its employees from claims of legal liability arising from the sponsorship and administration of the Agency 401(k) Plan. This is in accordance with Employee Retirement Income Security Act of 1974 (ERISA) guidelines even though as a governmental plan OCC is not subject to ERISA.

PART I – SUPPLIES OR SERVICES AND PRICES/COSTS

PART II – PERFORMANCE WORK STATEMENT

In addition, the OCC requires a thorough assessment and comparative analysis of both the quality of competitive fiduciary liability insurance coverage and the premiums, on behalf of the

OCC.

3.0 TASK

The Contractor shall provide the services as follows:

Fiduciary Liability Insurance

1. Review the terms of the current OCC fiduciary liability insurance policies and provide all existing coverage identified, at a minimum.

2. Provide quotes for the primary (base) fiduciary liability insurance coverage for at least

$10 million. The contractor may include but are not limited to ladder arrangements (i.e., $10 million, $15 million, $25 million, etc.) to spread the risk among multiple insurance companies.

3. Provide Errors and Omissions Coverage. Errors and omissions coverage protects the

OCC against claims for negligence, mistakes, faulty advice, or failure to provide promised results.

4. Provide a copy of the policy coverage as designated by the OCC. The policy coverage shall be on an annual basis, by June 9th, and provided to the OCC Contracting Officer’s

Representative (COR).

5. Review the terms of all existing OCC fiduciary liability insurance policies and provide consulting services.

Consulting Services

6. The specialty lines insurance broker shall provide consulting services to the OCC and expert Fiduciary Liability Insurance training sessions to 401(k) Sub-Committee members.

The specialty lines insurance broker shall:

a. On an ad-hoc basis, in the event OCC has fiduciary liability insurance policy questions, provide direct access and facilitate meetings between the OCC and insurance carrier(s).

b. Participate (virtually) in OCC’s 401(k) Sub-Committee meetings on at least a quarterly basis during the duration of the period of performance. Please note, the

OCC will collaborate with the specialty lines insurance broker to determine the meeting agenda talking points, to include but not limited to the items listed in item “c” noted below.

c. Conduct quarterly Fiduciary Liability Insurance consultative and training sessions, covering topics to include but not limited to:

i. Role of a Fiduciary o Fiduciary Duty o Fiduciary Responsibility

ii. Trends in litigation and coverage options (cybersecurity, etc.) in industry.

iii. Best practices to reduce plan risk profile and mitigate lawsuits.

iv. Evaluation and recommendation on OCC existing coverage.

d. The specialty lines insurance broker must respond to inquiries from OCC, within

5 business days.

ICT Accessibility

7. Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of

1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities. As such, the following requirements apply to this solicitation:

a. Reports shall be delivered in electronic, plain text (not scanned images) of PDF, Microsoft Word, and/or Microsoft Excel format. These deliverable reports shall conform to the OCC Guide for Creating Section 508 Compliant PDF/Word

Documents (see attached) and shall enable OCC users with assistive technology (such as JAWS or Dragon) to have a consistent layout structure to comprehend the information being presented in those various deliverable reports.

4.0 PERFORMANCE REQUIREMENTS SUMMARY

The Contractor shall be responsible for fulfilling the requirements of the Performance Work

Statement (PWS). Below is a chart that identifies the qualitative performance standards

(objectives), the OCC’s intended quality assurance procedures and frequency of inspections

(measures), and what the Government believes is the minimum satisfactory rating (expectations).

Task Areas

(Performance

Requirements)

Standard (s) and

Acceptable Quality Level

(AQL)

Surveillance

Method Disincentive

Services

Consultative

Fiduciary Liability

Insurance and

Training

Conduct Consultative and

Training Services are provided as required by the

PWS.

AQL: The Contractor shall be provided with two opportunities to improve performance. COR has discretion in evaluating customer complaints regarding what constitutes satisfactory level of service.

Customer

Feedback

More than 3 instances of customer complaints may result in an unsatisfactory

CPARs rating.

Provide a copy of the fiduciary liability

Policy shall meet the specifications of coverage, Customer

Feedback

Not providing the fiduciary liability insurance policy on insurance policy coverage as required by the OCC on an annual basis, by June

9th, to the OCC

COR.

providing at least $10 million in Fiduciary Liability

Insurance coverage, as identified in the OCC PWS and clearly explain an exception of errors and omissions coverage.

100% inspection of policy documents an annual basis, by June 9th, and/or explanation of the reason for not providing errors and omission coverage will result in an unsatisfactory CPARs rating.

Consulting Services for renewal of the fiduciary liability insurance policies

Provide consulting services to OCC during the renewal process of the fiduciary liability insurance policies to ensure renewed policies offer best value to OCC and are consistent with industry standards.

Customer

Feedback

More than 3 instances of customer complaints on consulting services provided may result in an unsatisfactory CPARs rating.

5. COMPLIANCE WITH APPLICABLE LAWS, REGULATIONS, AND STANDARDS

A. Secure User-to-Cloud Communications Standards. All user-to-cloud service communications

(e.g., via internet) must be encrypted with the latest industry standard browser protocol.

B. General Requirements

Location. Information collected, used, stored, maintained, or otherwise processed by the contractor in the performance of this contract shall be accessed, transferred, stored, or processed only within the United States. In addition, the maintenance and support operations of the contractor's technology and information must take place, and originate from, within the United

States. The contractor shall not host any portion of the information, information system, infrastructure, or environment in facilities outside the contiguous United States, Alaska, Hawaii, and other U.S. Territories.

Authorization to Use, Store, or Share Sensitive Information. The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all government data, equipment, etc. by treating the information as sensitive. All information gathered or created under this contract shall be considered as Controlled but Unclassified (CUI) information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets.

Confidentiality. The contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

Deliverables. The deliverables in this contract will be considered sensitive and shall not be shared with any other organization without prior approval from the OCC CO.

C. Security and Privacy Authorization

Authorization Boundary. The contractor shall provide a diagram specific for the OCC, that clearly demarcates the information system authorization boundary and depicts all of its connections and components, including the means for monitoring and controlling communications at the external boundary and at key internal boundaries within the system. The contractor shall address all components and managed interfaces of the information system authorized for operation (e.g., routers, firewalls). The diagram must include a predominant border drawn around all system components and services included in the authorization boundary.

If there are OCC-specific components (e.g., components developed or customized for the OCC, OCC-hosted components, etc.) and/or other components supporting this solution that are not in the scope of the contractor's existing security documentation, then identify those components in the diagram as well, as part of a separate OCC-specific boundary since those are unique to OCC and shall be part of the OCC-specific security authorization. The diagram must be easy to read and understand. Formal names of components as they are known at the service provider organization in functional specifications, configuration guides, other documents and live configurations shall be named on the diagram and described. The contractor shall provide a key for symbols used.

External Service Provider Compliance & Monitoring Background. The FISMA and OMB policies require that federal agencies using external service providers to process, store, or transmit federal information or operate information systems on behalf of the federal government, assure that such systems meet the information security protections commensurate with the information and system sensitivity. Federal agencies are responsible and accountable for the information security risk incurred by the use of information system services provided by external providers.

Such risk is addressed by incorporating the Risk Management Framework (RMF)1 and security requirements for external information systems and services as part of the terms and conditions of the contracts with external providers. Federal agencies can also require external providers to provide appropriate evidence to demonstrate that they have complied with protecting federal information. Prior to the implementation of the contractor's system or services, the OCC ensures compliance with the RMF by issuing an Authorization to Operate (ATO) or Authorization to Use

(ATU), based on its review and analysis of the external provider's security documentation

(described in detail in the next section) and assessment of customer (OCC's) security responsibilities. NIST Special Publication 800-37, as amended, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and

Privacy.

Non-Federal External Service Provider Security Documentation. Non-federal organizations with primarily non-federal customers have limitations with respect to complying with all federal requirements. As a result, the OCC obtains assurance through other industry standard security reviews, including Statement on Standards for Attestation Engagements (SSAE) No. 18.

D. Configuration Management

Security Configuration Settings. The contractor shall establish and enforce security configuration settings for information technology products employed in the Fiduciary Liability Insurance

Services.

Security Updates and Patches. The contractor shall ensure that the Fiduciary Liability Insurance

Services is properly maintained and monitored, to include immediate response to critical security patches, routine maintenance windows to allow for system updates, and compliance with the defined configuration management and change control processes. All patches and system updates shall be properly tested in a development environment before being implemented in the production environment.

Least Functionality. The contractor shall restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services for information technology products employed in the Fiduciary Liability Insurance Services.

E. Continuous Monitoring

Compliance Reviews and Audits. The contractor shall permit and support compliance reviews and audits under applicable laws to allow the OCC to meet legal and compliance obligations and shall implement processes that allow visibility into the privacy and security controls employed and their effectiveness. The contractor shall provide the OCC or authorized designated officials with information requested by auditors in a timely manner, consistent with the respective auditor's deadline, in support of security compliance reviews and various annual audits, e.g., FISMA, Financial Statement Audit, A-123, etc.

In addition, the contractor shall provide the OCC or authorized designated officials logical and physical access to the contractor's facilities, installations, technical capabilities, operations, records, and databases pertinent to this contract within seven (7) calendar days upon request for these purposes.

F. Data Protection

Data Encryption. Where encryption is required, as specified by the OCC, the contractor shall ensure that encryption is established and maintained for data at rest and in transit for the duration of the contract. The encryption employed shall be equivalent to those approved in Federal

Information Processing Standards (FIPS) Publication 140.

Need to Know. Sensitive information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected.

Such measures include controls listed in NIST SP 800-171, Protecting Controlled Unclassified

Information in Nonfederal Systems and Organizations, as amended, in the following areas:

Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel

Security, Physical Protection, Risk Assessment, Security Assessment, System and

Communications Protection, and System and Information Integrity.

Data Separation. Unless otherwise directed by the OCC and/or controls are implemented to ensure adequate separation, any storage of data shall be contained within the resources allocated by the contractor to support the OCC and may not be on systems that are shared with other commercial or government clients.

General Use of Personally Identifiable Information (PII). The contractor shall not use any PII, including low-sensitivity PII (e.g., E-mail Groups and Lists), for any purpose other than those activities necessary to the performance of this contract.

Use of Contractor Equipment. Use of contractor-owned laptops or other equipment (e.g., media storage devices, servers, etc.) to process, transmit, or store OCC information or to access the

OCC network or other OCC information resources without OCC's formal authorization is prohibited. This does not include the use of non-OCC laptops or PCs to use OCC-approved virtual desktop infrastructure to remotely access the OCC network.

G. Incident Response

Notification. The contractor must report all information security incidents that potentially or actually cause the compromise of OCC information, even if the contractor believes the security incident may be limited, small, or insignificant with respect to OCC data or systems. The OCC will determine when the contractor's reported security incident requires additional focus and attention.

Within one hour from the time the contractor validates that an information security incident has occurred, the contractor must report the security incident information to the OCC Cyber Defense

Center (CDC): Computer.Security@occ.treas.gov, (202) 649-7930, regardless of day or time.

The contractor must provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC with the following text in the subject line of the email: “Supplementary Information/Report related to previously reported incident # [insert number].”

Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit

Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive

Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

When notifying the OCC CDC, copy the Contracting Officer if possible or, if reporting by phone or Contracting Officer's email is not immediately available, contact the Contracting Officer immediately after reporting the incident to the OCC CDC.

Information, System and Tool Availability. The contractor shall make available any information, systems and tools necessary for the OCC to respond to incidents in a manner consistent with

NIST SP 800-61, as amended. In the case of a reported security incident, the contractor shall provide the OCC with access to the contractor's system and/or facilities within 72 hours of the

OCC's request.

H. Information Ownership

Government Access. The government will retain unrestricted rights to government data. The

OCC retains ownership of any user created/loaded data and deliverables (e.g., documents, applications, custom code, diagrams, workflows, data sets, etc.) hosted on contractor's equipment, systems, infrastructure, etc., as well as maintains the right to request full copies of these at any time.

Removal of OCC Data. The contractor acknowledges the OCC's exclusive right of ownership of the information and is required to transfer, return, and/or delete all agency data collected, processed, stored or maintained by the contractor on behalf of OCC upon termination of services, and shall provide written certification and supporting documentation attesting to the transfer, return and/or deletion of agency information or data generated, collected, processed, maintained, or stored by the contractor and any subcontractors, per instructions the "Security and Privacy

Vendor Deliverables" section.

Documents and Deliverables. The preliminary and final OCC-specific deliverables and all associated working papers and other material deemed relevant by the agency that have been generated in the performance of this contract, are the property of the U.S. Government. The contractor shall not release any information without the written consent of the Contracting

Officer. All work papers, preliminary and final deliverables must be submitted to the COR at the conclusion of the contract in an acceptable and usable format, which may include the original format.

eDiscovery. The contractor must ensure data preservation requirements (i.e., halt destruction and maintain data the contractor may not otherwise have to maintain) related to litigation holds are met. The contractor shall also ensure that metadata associated with litigation holds are preserved.

Metadata is electronically-stored information that describes the history, tracking, or management of an electronic document. It is created automatically when a user creates, modifies, accesses, or takes other actions with respect to an electronic document.

The contractor shall provide immediate access to all government data and government-related data impacting government data for review or scan, or conduct of a forensic evaluation, and physical access to any contractor facility with government data.

I. System Access

Government Right to Terminate Access. The OCC, at its discretion, may suspend or terminate the access to any systems and/or facilities when an information security incident or other electronic access violation, use or misuse issue gives cause for such action. The suspension or termination may last until such time as OCC determines that the situation has been corrected or no longer exists.

The system shall implement multi-factor authentication for remote users.

Training Requirements: None

J. Supply Chain Risk Management

Background. In accordance with Federal requirements, the OCC requires supply chain entities to implement necessary security safeguards to: (i) reduce the likelihood of unauthorized modifications at each stage in the supply chain; and (ii) protect information systems and information system components, prior to taking delivery of such systems/components. This control also applies to information system services.

Supply Chain Safeguards.

The contractor will:

a. Implement security and privacy controls for systems, facilities, and external connections to systems as necessary to ensure compliance with the laws, regulations, standards, and requirements specified in Sections C.

Security and Privacy Authorization, F. Data Protection, and I. System

Access.

b. Implement personnel screening processes to ensure suitability in accordance with relevant standards and requirements.

c. Use of tamper-evident packaging during shipping/warehousing.

d. Avoid the purchase of custom configurations to reduce the risk of acquiring information systems, components, or products that have been corrupted via supply chain actions targeted at specific organizations.

e. Vet the processes and security practices of subordinate suppliers, critical information system components, and services.

f. Employ a diverse set of suppliers to limit the potential harm from any given supplier in the supply chain.

g. Implement contract language regarding the prohibition of tainted or counterfeit components.

h. Restrict purchases from specific suppliers or countries per requirements issued by the U.S. Department of Homeland Security (DHS) and/or Federal

Acquisition Security Council, as these requirements pertain to the management of supply chain risk for Federal Agencies.

i. Use trusted/controlled distribution, delivery and warehousing options to reduce supply chain risk.

K. Security and Privacy Vendor Deliverables – Located on next page.

Removal of Data Deliverables

Section Deliverable Frequency Due Date

H. Information Ownership.

Removal of OCC Data

F. Data Protection.

Contractor Equipment

Certification of OCC Data

Removal from Contractor’s

(including any subcontractors), Possession, Equipment, and/or

Environment. Data removal instructions include transfer of information to another party per specific instructions from the CO; return of information, deliverables, etc., to the CO;

and deletion of OCC data from contractor equipment

(e.g., laptops and other contractor-owned equipment previously approved by the

OCC for this use) using NIST

SP 800-88, Guidelines for

Media Sanitization, as amended.

Once NLT 15 days after termination/expiration of contract

Authorization Boundary Deliverables

C. Security and

Privacy

Authorization.

Authorization

Boundary

OCC-specific Demarcated Security Authorization

Boundary for the solution

Initially, and as changes occur

Initial: Within

30 Days of

Award

Non-Federal External Service Provider (ESP) Security Documentation

C. Security and

Privacy

Authorization. SSAE

18 Requirements

E. Continuous

Monitoring. Annual

SOC 2 Type 2

Reviews

Statement on Standards for Attestation

Engagements (SSAE) 18 SOC Type II report.

The Contractor may substitute the National

Institute of Standards and Technology (NIST)

800-171 report for the SSAE 18 SOC Type II

Report. The preferred coverage period for the report is July 1 through June 30 with a bridge letter covering the three months to September

30.

Annually

Within 30 Days of

Award

6. REQUIREMENTS FOR PROVIDING FIDUCIARY INSURANCE AFTER

CONTRACT AWARD: THE CONTRACTOR AT A MINIMUM SHALL PERFORM

AND PROVIDE A WRITTEN ASSESSMENT WITH ITS QUOTE THAT INCLUDES

BUT IS NOT LIMITED TO:

1. Solicit quote(s) for fiduciary liability insurance and errors and omission coverages, from qualified insurance companies with capital in excess of $1 billion. The insurance policy shall be effective on an annual basis, by June 9th.

2. If errors and omissions coverage is not available, the Contractor must provide a detailed written explanation as to why it is not available.

3. Identify insurance companies capable of providing fiduciary liability coverage options for the primary base of $10 million in coverage.

4. The Contractor’s assessment may include possible ladder arrangements (i.e., $10 million, $15 million, $25 million, etc.) to spread the risk among multiple insurance companies.

5. Assess each insurance companies’ expertise in fiduciary liability insurance and coverage options, these options must consider multiple deductible, coverage, and premium options.

a. A comparison of strengths and weaknesses of the different fiduciary liability insurance coverage offered.

b. A comparison of the costs of coverage; and

c. An analysis of the terms and amount of coverage that would be most beneficial to the OCC from a cost and technical standpoint.

6. Clearly state and explain any coverage exclusions.

7. Provide full draft insurance policies with the quote and a detailed explanation of all related costs.

8. The Contractor shall respond in writing or verbally as requested by the government to all questions concerning its quote. Responses shall be provided by the Contractor within 5 business days of submission of the questions by the OCC, unless the OCC grants additional time. The Contractor shall also participate in virtual meetings as requested by the OCC to clarify any questions related to its quote.

9. The specialty lines insurance broker shall provide consulting services to the OCC and expert Fiduciary Liability Insurance training sessions to 401(k) Sub-Committee members.

a. On an ad hoc basis, address the fiduciary liability insurance policy questions, provide direct access and facilitate meetings between the OCC and insurance carrier(s).

b. Participate (virtually) in OCC’s 401(k) Sub-Committee meetings on at least a quarterly basis during the duration of the period of performance.

c. Conduct quarterly Fiduciary Liability Insurance consultative and training sessions.

10. Provide the policy coverage amount as designated by the OCC, effective on an annual basis, by June 9th.

7. GOVERNMENT FURNISHED INFORMATION

The following information will be provided, as an attached document, to assist with underwriting an insurance policy:

• Total OCC and OTS 401(k) Plan assets

• Total OCC 401(k) Plan participants (active and separated).

• Total OTS 401(k) Plan participants (active and separated).

As a governmental plan, the Employee Retirement Income Security Act does not apply to the

OCC and OTS 401(k) Plans.

8. DELIVERABLES

Task

Deadline/

Frequency

Deliverable Performance Indicators and Standards

Quarterly Conduct Fiduciary Liability

Insurance Consultative and Training

Services

Accuracy, Completeness, Timeliness.

Services are provided accurately in entirety and on a quarterly basis.

Task

Deadline/

Frequency

Deliverable Performance Indicators and Standards

Annually Provide a copy of the fiduciary liability insurance policy coverage as required by June 9th, annually, to the

OCC COR.

Accuracy, Completeness, Timeliness.

Policy shall meet the specifications of coverage, providing at least $10 million in coverage, as identified in the OCC PWS and clearly explain an exception of errors and omissions coverage.

Ad-hoc

Basis

On an ad-hoc basis, address fiduciary liability insurance policy questions, provide direct access and facilitate meetings between the OCC and insurance carrier(s).

Accuracy, Completeness, Timeliness.

Services are provided accurately in entirety on an ad-hoc basis.

FEDERAL ACQUISITION REGULATION CLAUSES

52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make the full text available. Also, the full text of a clause may be accessed electronically at the following address:

https://www.acquisition.gov/browse/index/far.

(End of clause)

52.204-13 System for Award Management Maintenance Oct 2018

52.204-18 Commercial and Government Entity Code Maintenance Aug 2020

52.204-21 Basic Safeguarding of Covered Contractor Information Systems Nov 2021

52.204-27 Prohibition on a ByteDance Covered Application Jun 2023

52.212-4 Contract Terms and Conditions-Commercial Products and Commercial

Services

Nov 2023

52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 1 day of contract end date.

FAR 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 1 day of contract end date; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 30 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 66 months.

PART III - OTHER CONTRACTUAL TERMS AND CONDITIONS

https://www.acquisition.gov/browse/index/far

DEPARTMENT OF THE TREASURY ACQUISITION REGULATION (DTAR)

CLAUSES

DTAR 1052.210-70 CONTRACTOR PUBLICITY (APR 2015)

The Contractor, or any entity or representative acting on behalf of the Contractor, shall not refer to the supplies or services furnished pursuant to the provisions of this contract in any news release or commercial advertising, or in connection with any news release or commercial advertising, without first obtaining explicit written consent to do so from the Contracting Officer.

Should any reference to such supplies or services appear in any news release or commercial advertising issued by or on behalf of the Contractor without the required consent, the

Government shall consider institution of all remedies available under applicable law, including

31 U.S.C. 333, and this contract. Further, any violation of this clause may be considered as part of the evaluation of past performance.

(End of Clause)

DTAR 1052.232-7003 ELECTRONIC SUBMISSION OF PAYMENT REQUESTS (APR

2015)

(a) Definitions. As used in this clause—

(1) “Payment request” means a bill, voucher, invoice, or request for contract financing payment with associated supporting documentation. The payment request must comply with the requirements identified in FAR 32.905(b), “Content of Invoices” and the applicable Payment clause included in this contract.

(b) Except as provided in paragraph (c) of this clause, the Contractor shall submit payment requests electronically using the Invoice Processing Platform (IPP). Information regarding IPP, including IPP Customer Support contact information, is available at www.ipp.gov or any successor site.

(c) The Contractor may submit payment requests using other than IPP only when the Contracting

Officer authorizes alternate procedures in writing in accordance with Treasury procedures.

(d) If alternate payment procedures are authorized, the Contractor shall include a copy of the

Contracting Officer's written authorization with each payment request.

OFFICE OF THE COMPTROLLER OF THE CURRENCY CLAUSES (OCC)

1052.201-8000 CONTRACTING OFFICER’S REPRESENTTIVE (COR) DELEGATION

AND AUTHORITY (DEC 2013)

a. The contracting officer's representative will be identified via separate letter to the contractor.

b. Performance of work under this contract is subject to the technical direction of the

COR, as delegated in writing. The term "technical direction" includes, without limitation, direction to the contractor that directs or redirects the labor effort, shifts the work between work areas or locations, fills in details and otherwise serves to ensure that tasks outlined in the work statement are accomplished satisfactorily.

c. Technical direction must be within the scope of the specification(s)/work statement. The COR does NOT have authority to issue technical direction that:

1. changes any of the terms, conditions, or specification(s)/work statement of the contract;

2. in any manner causes an increase or decrease in the contract price, or the time required for contract performance;

3. interferes with the contractor's right to perform under the terms and conditions of the contract; or,

4. directs, supervises or otherwise controls the actions of the contractor's employees.

d. Technical direction may be oral or in writing. The COR shall confirm oral direction in writing within five work days, with a copy to the contract administrator.

e. The contractor shall proceed promptly with performance resulting from the technical direction issued by the COR. If, in the opinion of the contractor, any direction of the COR, falls within the limitations in (c), above, the contractor shall immediately notify the contracting officer no later than the beginning of the next Government work day.

f. Failure of the contractor and the contracting officer to agree that technical direction is within the scope of the contract shall be subject to the terms of the clause entitled "Disputes".

1052.204-8000 (OCC) PROPER IDENTIFICATION OF CONTRACTOR PERSONNEL

(AUG 2020)

a. All contractor personnel shall provide proper identification in both oral and written communications. Oral communications include, but are not limited to, in-person, Skype video and audio communications, and teleconference communications.

Additionally, when calling into meetings contractor personnel shall identify that they are a contractor by stating their name followed by stating contractor support for their respective OCC business unit.

b. For written communications, all contractor personnel shall use a signature block that includes identification as a contractor, the name of the contractor personnel’s company, office telephone number, alternate contact (mobile) number (if applicable), and identification of the current assigned Contacting Officer Representative (COR) as stated in the contract.

Name: [Insert Name]

Job Title: [Insert Title] (Contractor)

Company Name: [Insert Name of Company]

COR’s Name: [Insert Name of the current COR]

Telephone: Office: (XXX) XXX-XXXX

Work Cell: Mobile: (XXX) XXX-XXXX

1052.204-8008 (OCC) CITIZENSHIP OR RESIDENCY REQUIREMENTS OF

CONTRACTOR PERSONNEL (SEP 2021)

The contractor shall ensure that all employees, agents, and subcontractors having unescorted access to the Office of the Comptroller of the Currency’s facilities or access to information systems, security items, or Controlled Unclassified Information (E.O. 13556) are United States

Citizens or are lawful Permanent Resident Aliens (green card) with at least three or more years of U.S. residency from the date of legal entry in the U.S. Contractors who require privileged IT access shall be U.S. citizens and shall complete the Privileged User training prior to receiving elevated permissions.

1052.204-8001 (OCC) CONTRACTOR’S COMMITMENT TO EQUAL OPPORTUNITY

AND CONTRACTING (MAY 2025)

This clause applies to the contractor’s compliance with Section 342(c)(2) of Dodd-Frank Wall

Street Reform and Consumer Protection Act (PL 111-203) (Dodd-Frank).

The Contractor shall ensure, to the maximum extent possible consistent with applicable law, the fair inclusion of minorities and women in its workforce. The Contractor shall insert the substance of this clause in all subcontracts under this Contract when the dollar value exceeds $150,000.

Within thirty (30) calendar days of a written request from the OCC’s Office of Minority and

Women Inclusion (OMWI), or such longer time as the OMWI determines, and without any additional consideration required from the Agency, the Contractor shall provide documentation, satisfactory to the Agency, of the actions it (and, as applicable, its subcontractors) has undertaken to demonstrate its good-faith efforts to comply with the aforementioned provisions.

For purposes of this contract, “good-faith efforts” may include actions by the contractor intended to identify and, if present, remove barriers to minority and women employment or expansion of employment opportunities for minorities and women within its workforce. Efforts to remove such barriers may include, but are not limited to, recruiting minorities and women, providing job-related training, or engaging in other activities that could lead to those results.

A failure to demonstrate to the OCC and the OMWI Director such good-faith efforts may result in the actions prescribed in Section 342(c)(3) of Dodd–Frank.

For purposes of this clause, the terms “minority,” “minority-owned business” and “women-owned business” shall have the meanings set forth in Section 342(g) of Dodd–Frank.

1052.209-8000 (OCC) ORGANIZATIONAL CONFLICTS OF INTEREST (NOV 2009)

(a) Purpose. The purpose of this clause is to ensure that the Contractor (1) is not biased because of its financial, contractual, organizational, or other interests that relate to the work under this contract, and (2) does not obtain any unfair competitive advantage over other parties by virtue of its performance of this contract.

(b) Scope. The restrictions described herein shall apply to performance or participation by the contractor and any of its affiliates or their successors in interest (hereinafter collectively referred to as “Contractor”) in the activities covered by this clause as a prime contractor, subcontractor, cosponsor, joint venture, consultant, or in similar capacity. For purpose of this clause, affiliation occurs when a business concern is controlled by or has the power to control another or when a third party has the power to control both.

[ ] To the extent the contractor prepares and furnishes complete specifications covering non-developmental items to be used in a competitive acquisition, the contractor shall not be allowed to furnish these items either as a prime contractor or subcontractor.

[ ] To the extent work to be performed under this contract requires evaluation of offers for products or services, a contract will not be awarded to a contractor that will evaluate its own offer(s) for products or services, or those of a competitor, without proper safeguards to ensure objectivity to protect the

Government’s interests. Contractor agrees to the terms and conditions set forth in the Performance Work Statement/Statement of Work that is established to ensure objectivity to protect the Government’s interests. (FAR 9.505-3)

[ ] If the contractor under this contract assists in the preparation of a statement of work or specifications, the contractor shall be ineligible to perform or participate in any capacity in any contractual effort (solicited or unsolicited) that is based on such performance work statement/statement of work or specifications.

[ ] If the contractor provides Advisory and Assistance Services (AAS), it shall be ineligible thereafter to participate in any capacity in Government contractual efforts (solicited or unsolicited) which stem directly from such work, and the contractor agrees not to perform similar work for prospective offerors with respect to any such contractual efforts. Furthermore, unless so directed in writing by the Contracting Officer, the contractor shall not perform any such work under this contract on any of its products or services, or the products or services of another firm for which the contractor performs similar work. Nothing in this subparagraph shall preclude the contractor from competing for follow-on contracts for AAS.

[ X ] If the Contractor, in the performance of this contract, obtains access to information, such as OCC plans, policies, reports, studies, financial or similar

OCC information plans, internal data protected by the Privacy Act of 1974 (5

U.S.C. 552a), or data which has not been released or otherwise made available to the public, the Contractor agrees that without prior written approval of the OCC

Contracting Officer it shall not: (A) use such information for any private purpose unless the information has been released or otherwise made available to the public; (B) compete for work for the OCC based on such information for a period of one year after either the completion of this contract or until such information is released or otherwise made available to the public, whichever is first; (C) submit an unsolicited proposal to the OCC or the Government which is based on such information until one year after such information is released or otherwise made available to the public; and (D) release such information unless such information has previously been released or otherwise made available to the public by the

OCC. In addition, the Contractor agrees that to the extent it receives or is given access to proprietary data, data protected by the Privacy Act of 1974 (5 U.S.C.

552a), or other confidential or privileged technical, business, or financial information under this contract, it shall treat such information in accordance with any restrictions imposed on such information.

(c) The Contractor shall be ineligible to participate in any capacity in OCC contracts, subcontracts, or proposal (solicited and unsolicited) which stem directly from the

Contractor’s performance of work under this contract. This restriction shall apply to ________ (Contracting Officer shall insert the company name upon award of the contract). This clause shall remain in effect for one year after the completion of this contract. At the conclusion of this period, the OCC, consistent with applicable conflict of interest regulations, will evaluate whether at that time there are any conflicts that may limit the contractor's ability to perform work for the OCC.

(d) The financial, contractual, organizational and other interests of contractor personnel performing work under this contract shall be deemed to be the interests of the contractor or the purposes of determining the existence of an

Organizational Conflict of Interest. Any subcontractor that performs any work relative to this contract shall be subject to this clause. The contractor agrees to place in each subcontract affected by these provisions the necessary language contained in this clause.

(e) Definitions. For purposes of application of this clause only, the following definitions are applicable:

(1) System includes system, major component, subassembly or subsystem, project, or item;

(2) Nondevelopmental items as defined in FAR 2.101;

(3) Technical direction” (TD) includes, but is not limited to, the activities in FAR

9.505-1(b);

(4) Consultant services as defined in FAR 31.205-33(a);

(5) Contractor, for the purposes of this clause, means the firm signing this contract, its subsidiaries and affiliates, joint ventures involving the firm, any entity with which the firm may hereafter merge or affiliate, and any other successor or assignee of the firm;

(6) Affiliates means officers or employees of the prime contractor and first tier subcontractors involved in the program and technical decision-making process concerning this contract; and

(7) Interest means organizational or financial interest.

(f) Disclosure after award.

The Contractor agrees that, if changes, including additions, to the facts disclosed by it prior to award of this contract, occur during the performance of this contract, it shall make an immediate and full disclosure of such changes in writing to the

OCC. Such disclosure may include a description of any action which the

Contractor has taken or proposes to take to avoid, neutralize, or mitigate any resulting conflict of interest.

In the event that the Contractor was aware of facts required to be disclosed or the existence of an actual or potential organizational conflict of interest and did not disclose such facts or such conflict of interest to the OCC, the OCC may terminate this contract for default.

(g) Remedies. For breach of any of the above restrictions or for nondisclosure or misrepresentation of any facts required to be disclosed concerning this contract, including the existence of an actual or potential, organizational conflict of interest at the time of or after award, the OCC may terminate the contract for default, disqualify the Contractor from subsequent related contractual efforts, and pursue such other remedies as may be permitted by law or this contract.

(h) Waiver. Requests for waiver under this clause shall be directed in writing to the

Contracting Officer and shall include a full description of the requested waiver and the reasons in support thereof. If it is determined to be in the best interests of the OCC, the Contracting Officer may grant such a waiver in writing.

(i) Subcontracts

(1) The Contractor shall include a clause, substantially similar to this clause, including this paragraph (f), in all subcontracts and agreements related to performance of work under this Contract.

(2) Prior to the award under this contract of any subcontracts by the

Contractor or as part of a teaming or other arrangement, the Contractor shall determine in writing whether interests disclosed by a subcontractor, teaming agreement or other arrangement present an actual or significant potential for an organizational conflict of interest. Where an actual or significant potential organizational conflict of interest is identified, the Contractor shall take actions to avoid, neutralize, or mitigate the organizational conflict to the satisfaction of the

Contractor. If the conflict cannot be avoided or neutralized, the Contractor must obtain the approval of the OCC contracting officer prior to entering into the subcontract.

1052.237-8000 (OCC) NON-PERSONAL SERVICES (NOV 2022)

(a) This is a non-personal services contract. The contractor personnel rendering services under this contract are not subject, either by the contract terms or by the manner of its administration, to the supervision and control of the Office of the Comptroller of the Currency (OCC).

(b) The OCC and contractor understand and agree that the services to be provided under this contract by the contractor to the OCC are non-personal services. The parties recognize that no employer/employee relationship exists or will exist under this contract. The contractor agrees to provide the specified services fully described herein and is accountable to the OCC only for providing such services, materials, or work ordered. For the purpose of this contract, the contractor’s personnel shall not be subject to the supervision of an OCC office or employee while engaged in the performance of its duties.

1052.239-8000 (OCC) INFORMATION AND COMMUNICATION TECHNOLOGY

(ICT) ACCESSIBILITY (JAN 2023)

(a) Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C 794d) , as amended by the Workforce Investment Act of 1998, all Information and Communication Technology (ICT) products and services developed, acquired, maintained, or used under this contract/order must comply with the Information and Communication Technology (ICT) Accessibility Provisions, set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the “Access Board”) in 36 CFR Part 1194 (36 CFR 1194.1 and 36 CFR 1194.2). Information about Section 508 is available at https://www.section508.gov/. The complete text of Section 508

Final Provisions can be accessed at https://www.access-board.gov/ict/about/.

(b) The Section 508 accessibility standards applicable to this contract/order are identified in the

Statement of Work/Performance Work Statement. If it is determined by the Government that ICT products and services provided by the Contractor do not conform to the described accessibility standards in the submitted Accessibility Conformance Report (ACR), using the Voluntary

Product Assessment Template (VPAT), remediation of the products or services to the level of conformance specified in the Contractor’s ACR/VPAT will be the responsibility of the

Contractor at its own expense.

https://www.govinfo.gov/content/pkg/USCODE-2019-title29/html/USCODE-2019-title29-chap16-subchapV-sec794.htm https://ecfr.federalregister.gov/current/title-36/chapter-XI/part-1194?toc=1 https://ecfr.federalregister.gov/current/title-36/chapter-XI/part-1194/section-1194.1 https://ecfr.federalregister.gov/current/title-36/chapter-XI/part-1194/section-1194.2…