PERFORMANCE WORK STATEMENT - HRC - 03JAN2020.docx.pdf

PERFORMANCE WORK STATEMENT

ENTERPRISE BUSINESS SOLUTIONS HRCONNECT SYSTEM EXAMINATION

03 JANUARY 2020

TABLE OF CONTENTS

PAGE NO.

PART 1. GENERAL INFORMATION

1.A. Labor Categories

1.B. Suitability Clearances

1.C. Audit Documentation

1.D. Quality Assurance

1.E. Confidentiality of Data and Conflict of Interest

1.F. Use and Ownership of Computer Software

1.G. Technical Information System Requirements

1.H. Elimination of Barriers in Information Technology

1.I. Government Furnished Property

1.J. Substitution of Key Contractor Personnel

1.K. Period of Performance

1.L. Contracting Officer’s Representative (COR), Alternate COR (ACOR) and Bureau Task Monitor

1.M. Submission of Invoices

1.N. Payment Schedule

1.O. Audit Site and Travel

1.P. Results of Prior Year Audits

1.Q. Performance Evaluation

PART 2. SPECIFIC WORK REQUIREMENTS

2.A. STATEMENTS ON STANDARDS FOR ATTESTATION ENGAGEMENTS (SSAE) NO 18

EXAMINATION OF THE DEPARTMENT OF THE TREASURY ENTERPRISE BUSINESS SOLUTIONS’

HRCONNECT SYSTEM

2.A.1. Purpose

2.A.2. Scope and Objectives

2.A.3. Background

2.A.4. Audit Site and Travel

2.A.5. Suitability Clearances and Confidentiality of Data

2.A.6. Deliverable Schedule

2.A.7. Task Requirement Descriptions

QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

PART 3. ATTACHMENTS

Attachment 1 Treasury Directive 40-01, Responsibilities of and to the Inspector General Attachment 2 Conditional Access to Sensitive Information Non-disclosure Agreement Attachment 3 Declaration of Independence and Conflict Of Interest Statement Attachment 4 List of Products and Services

Attachment 5 Treasury Security Manual, Chapter II, Section 2, Investigative Requirements for Federal Employees, Contractors, Subcontractors, Experts, Consultants and Paid/Unpaid Interns

Attachment 6 HRConnect system Control Objectives & Description of Controls Attachment 7 Policy Directive (PD) 715-04 Use Of OIG Information Technology

Resources Attachment 8 Contractor Processing Request Form Attachment 9 Contractor Processing Request Form (TD Form 15-03.10 and OF-306)

PART 1. GENERAL INFORMATION

1.A. Labor Categories

The contract associated with this Performance Work Statement (PWS) shall be considered a fixed-price contract with travel paid consistent with Federal Travel Regulations. The following categories of labor will be applicable to all work contained in this contract. The requirement for continuing education and training in the past two years as required below relates to the two year period prior to the release date of this contract. Personnel in all labor categories below, except for (4) Staff Auditor, (10) IS/IT Staff Auditor, and (13) Junior Computer Consultant, are considered key personnel.

1) Partner/Principal

The Partner/Principal is required to be a Certified Public Accountant (CPA) and licensed by the appropriate state licensing authority and be in good standing with the AICPA, State Board, etc. The minimum education requirements include: (a) a bachelor’s degree in accounting or business, and (b) 80 hours of continuing professional education (CPE) in the past two years that meets the government’s CPE requirements, with at least 24 of the 80 hours of continuing education and training in subjects directly related to government auditing, the government environment, or the specific or unique environment in which the audited entity operates. The minimum experience requirements in this category include: (a) being a partner or principal in the Contractor’s or subcontractor’s organization, and (b) having a minimum of seven years general audit1 experience and three years Federal government financial audit experience. The partner/principal is responsible for the work performed, i.e., overall project management and final report review.

2) Audit Manager

The Audit Manager is required to be a CPA and licensed by the appropriate state licensing authority.

The minimum education requirements include: (a) a bachelor’s degree in accounting or business, and

(b) 80 hours of CPE in the past two years that meets the government’s CPE requirements, with at least 24 of the 80 hours of continuing education and training in subjects directly related to government auditing, the government environment, or the specific or unique environment in which the audited entity operates. The minimum experience requirements include: (a) having a minimum of five years general audit experience; and (b) two years Federal government financial audit experience at a supervisory level. The responsibilities in this category include: (1) reviewing audit documentation, financial statements and reports; (2) conducting discussions with clients about the results of the work performed; (3) directing senior and staff auditors; (4) reviewing and approving work plans and programs; (5) ensuring that assignments are carried out within the budgeted time and within delivery commitments; (6) reviewing audit documentation and financial statements and related reports for accuracy and completeness; and (7) following the progress of the engagement and helping resolve accounting, auditing, and reporting problems as they arise. The Audit Manager is regularly assigned to other audit engagements in a managerial capacity.

3) Senior Auditor

The minimum education requirements include: (a) a bachelor’s degree in accounting or business, and

(b) 80 hours of CPE in the past two years that meets the government’s CPE requirements, with at least 24 of the 80 hours of continuing education and training in subjects directly related to government auditing, the government environment, or the specific or unique environment in which the audited entity operates. The minimum experience requirements include: (a) being a senior in the Contractor’s or subcontractor’s organization, (b) having a minimum of three years general audit experience, and (c)

1 The term “audit” used throughout this contract refers to financial audits, attestation engagements, and performance audits conducted in accordance with GAGAS as applicable.

one year of Federal government financial audit experience. The responsibilities in this category include: (1) independently performing a major segment of an audit; (2) directing the work of staff auditors; (3) instructing them in the work to be performed; and (4) reviewing the work done and directing revisions, if necessary. The Senior Auditor makes decisions on all but the most unusual accounting, auditing, and reporting matters and is regularly assigned to other audit engagements in the capacity of senior auditor.

4) Staff Auditor

The minimum education requirements include: (a) a bachelor’s degree in accounting or business and

(b) 80 hours of continuing education and training in the past two years that meets the government’s CPE requirements, with at least 24 of the 80 hours of continuing education and training in subjects directly related to government auditing, the government environment, or the specific or unique environment in which the audited entity operates. The responsibilities in this category include performing specific audit steps under the supervision of a senior auditor. All activities of the staff auditor are supervised.

5) Audit Specific Specialist(s)

The minimum experience requirements include: (a) having thorough knowledge and formal training in the required specific specialty, (b) a high level of experience in applying the specific specialty, and (c) recognized standing in the applicable field. The responsibilities in this category include providing auditors with professional expertise in such areas as health, safety, law, investigations, actuarial science, mining, engineering, appraising, mathematics, statistics, economics, writing, or other specialties that may be needed to plan, develop, and present technical assistance and training, expanded scope audits, economy and efficiency audits, program results audits, full scope audits, financial and compliance audits, indirect cost audits, and other types of audit services (e.g., audit coordination, audit orientation, pre-award surveys, pricing reviews, quality control reviews, evaluations, etc.) This category includes all specific specialties needed to complete assigned tasks that are not covered by the other labor categories in this contract.

6) Statistician

This person must be a member in good standing of a recognized professional statistical association as well as have a minimum of six years of current, significant sampling experience in a government audit or program evaluation environment. Demonstrated experience preferably includes the knowledge and ability to design samples that meet Government Auditing Standards and the GAO/CIGIE Financial Audit Manual (FAM) sampling requirements as well as applicable AICPA sampling auditing standards.

Information Systems/Information Technology (IS/IT) skill classifications

The IS/IT audit or evaluation classifications include individuals with specialized IS/IT technical knowledge, skills, and abilities who may not be CPAs, but who have responsibilities and a level of experience similar to, and who function at a level comparable to partners, managers, senior auditors, or staff auditors. For the purposes of labor classifications, IS/IT auditors who perform routine general application control reviews as well as those who use computer assisted audit techniques are not considered in these classifications, but rather are considered in the accounting, auditing, and related skills classifications as described above.

7) IS/IT Audit Partner (or equivalent title)

The minimum education requirements include: (a) a bachelor’s degree or advanced degree(s) in an appropriate technical field, and (b) 80 hours of CPE in the past two years that meets the government’s CPE requirements, with at least 24 of the 80 hours of continuing education and training in subjects directly related to government auditing, the government environment, or the specific or unique environment in which the audited entity operates. The IS/IT audit partner must be a Certified Information Systems Auditor (CISA) or be a CPA with equivalent experience such as performing general control evaluations of large systems, network security reviews, and extensive review of applications, and must also be actively pursuing the CISA certification. At least ten years technical experience is required, including all of the following areas: 1) IS audit process; 2) IT governance;

3) systems and infrastructure lifecycle management; 4) IT service delivery and support; 5) protection of information assets; and 6) business continuity and disaster recovery. Employee does not necessarily need to have a proprietary interest in the firm. This person has final authority in the conduct of engagements and full responsibility for the work performed.

8) IS/IT Audit Manager (or equivalent title)

The minimum education requirements include: (a) a bachelor’s degree or advanced degree(s) in an appropriate technical field, and (b) 80 hours of CPE in the past two years that meets the government’s CPE requirements, with at least 24 of the 80 hours of continuing education and training in subjects directly related to government auditing, the government environment, or the specific or unique environment in which the audited entity operates. The IS/IT audit manager must be a Certified Information Systems Auditor (CISA), a Certified Information System Security Professional (CISSP),or be a CPA with equivalent experience such as performing general control evaluations of large system, network security reviews, and extensive review of applications, and must also be actively pursuing the CISA certification. At least five years technical experience is required, including all of the following areas: 1) IS audit process; 2) IT governance; 3) systems and infrastructure lifecycle management;

4) IT service delivery and support; 5) protection of information assets; and 6) business continuity and disaster recovery.

The IS/IT manager is responsible for complex engagements, or the technical aspects of complex engagements, and may oversee two or more engagements simultaneously. He/she has demonstrated ability to assume full responsibility for directing engagements and special assignments. This individual reviews audit documentation and related reports for accuracy and completeness, and conducts discussions with clients about the results of the work performed; directs audit Seniors and Staff;

reviews and approves work plans and programs; ensures that assignments are carried out within the budgeted time and within delivery commitments. The IS/IT manager follows the progress of the engagement and helps resolve technical issues as they arise and is regularly assigned to other engagements in a managerial technical capacity.

9) IS/IT Audit Senior (or equivalent title)

The minimum education requirements include: (a) a bachelor’s degree in an appropriate technical field, and (b) 80 hours of CPE in the past two years that meets the government’s CPE requirements, with at least 24 of the 80 hours of continuing education and training in subjects directly related to government auditing, the government environment, or the specific or unique environment in which the audited entity operates. Also, required is at least two years of experience in IS/IT auditing. The IS/IT audit senior performs most assignments with a minimum of supervision; directs the work of staff auditors, instructing them in the work to be performed, reviews the work done and directs revisions, if necessary; and makes decisions on all but the most unusual matters. This person is regularly assigned to other engagements in the capacity of an IS/IT senior auditor.

10) IS/IT Staff Auditor (or equivalent title)

The minimum education requirements include a bachelor’s degree in an appropriate technical field and 80 hours of continuing education and training in the past two years that meets the government’s CPE requirements, with at least 24 of the 80 hours of continuing education and training in subjects directly related to government auditing, the government environment, or the specific or unique environment in which the audited entity operates. There are no minimum experience requirements.

This person performs specific procedures under the guidance of a senior auditor. All activities of the IS/IT staff auditor are supervised.

11) IS/IT System Software Specialist (or equivalent title)

The IS/IT System Software Specialist must have at least five years of experience working with systems software in a variety of different environments, including reviews of or installation and implementation of systems software. Experience should include operating systems and access control software, and the ability to read assembler code and related macros as part of the systems software installation and maintenance function. Specialist should have the ability to evaluate installation and implementation of systems software for potential information security exposures.

12) Senior Computer Consultant (or equivalent title)

The Senior Computer Consultant must have at least ten years of experience in computer consulting services, including such areas as system design, hardware and software evaluations, systems management, and systems implementation methods.

13) Junior Computer Consultant (or equivalent title)

The Junior Computer Consultant must have at least five years of experience in computer consulting services, including such areas as systems design, hardware and software evaluations, systems management, and system implementation methods.

As the Contractor adds staff (at any level), or promotes staff, a resume of each individual must be submitted to the Contracting Officer’s Representative (COR) for approval. Each resume shall include a description of the Contractor’s intended use of the individual performing work (e.g., partner, manager, etc.), provide sufficient information that documents that the individual meets the qualification requirements contained in this Section and includes specific qualifications, include the following:

experience in conducting financial statement audits in accordance with applicable audit requirements/guidance; experience in conducting Federal, State, Local, and/or private sector financial statement audits; total years of general audit experience and years of relevant experience (e.g., Federal); CPA, CISA, CISSP, CIA, CGAP, and other relevant certifications and credentials; date, school name, and type of education, (e.g., degree and major); and a detailed listing of continuing professional education (CPE) courses, which include the following: CPE program sponsor name, course title, course field of study, date completed, type of instructional/delivery method used, amount of CPE credit recommended, and amount of CPE credit in subjects directly related to government auditing, the government environment, or the specific or unique environment in which the audited entity operates. For instructor CPE credit, the CPA claiming CPE credits should comply with respective state board requirements.

1.B. Suitability Clearances

In order to perform work on the contract, all Contractor personnel must have a completed and favorably adjudicated background investigation or a security clearance, which is required by Treasury Security Manual – TD P 15-71, Chapter II, Section 2, Investigative Requirements for Federal Employees, Contractors, Subcontractors, Experts, Consultants and Paid/Unpaid Interns (Attachment 5). Therefore, Contractor personnel performing work under this contract are subject to a background investigation to determine their suitability and fitness for OIG work and the investigation must be favorably adjudicated. The minimum requirements and standards to properly determine the required background investigation is based on the sensitivity and risk level commensurate with public trust responsibilities and the potential adverse impact upon National Security that the Contractor could effect. The level to which such Contractors, subcontractors, experts, consultants, and paid/unpaid interns are investigated shall be comparable to that required for Federal employees who occupy the same positions and who have the same position sensitivity designation. Such standards require Contractor’s personnel to execute appropriate security forms through the Electronic Questionnaires for Investigations Processing (e-QIP) system (a web-based automated system that allows the user to electronically enter, update and transmit their personal investigative data over a secure internet connection to a requesting agency) prescribed by the Treasury/auditee personnel security component. Background investigations include a search of records of the Federal Bureau of Investigation, including a fingerprint-based search2, and any other appropriate biometric or database searches not precluded by law. A credit check (search of the records of commercial credit reporting agencies) will be done by the National Background Investigations Bureau. The cost and performance of a favorably adjudicated Tier 1, 2 or 3 federal background investigation is the responsibility of the OIG; however, the cost and performance of Tier 3 background, re-investigations, and clearances are the responsibility of the contractor and must be handled via the Defense Security Service (DSS), not the OIG. If a Contractor employee has been the subject of a valid background investigation by another Federal investigative agency, the OIG may accept certification from the agency if it meets OIG requirements. During each period of performance or as the Contractor adds staff (at any level), the Contractor, on Company letterhead, will send the OIG Personnel Security Officer the individual’s full name, date and place of birth, citizenship, social security number, date of last background investigation, type of background investigation or clearance level, and date clearance granted in order to verify that all personnel working under this contract possess the minimum federal background investigation. Once the OIG Personnel Security Officer receives this information, he (or she) will verify whether or not the person has a completed and favorably adjudicated background investigation or a security clearance. The form that initiates a background investigation is the Contractor Processing Request Form, TD Form 15-03.10 and OF-306 (Attachment 9).

Standards are established for investigations to determine eligibility for logical and physical access, suitability for Government employment, eligibility for access to classified information, eligibility to hold a sensitive position, and fitness to perform work or on behalf of the Government as a Contractor employee. These standards are consistent with Executive Order 13467, Reforming Processes Related to Suitability for Government Employment, Fitness for Contractor Employees, and Eligibility for Access to Classified National Security Information, amended by Executive Order 13764, Amending the Civil Service Rules, Executive Order 13488, and Executive Order 13467 To Modernize the Executive Branch-Wide Governance Structure and Processes for Security Clearances, Suitability and Fitness for Employment, and Credentialing, and Related Matters..

In accordance with the Treasury Security Manual (TD P 15-71, Chapter II, Section 2, Paragraph 5a and b Citizenship Requirements) (see Attachment 5) "Federal employees, Contractors, subcontractors, experts, consultants, and paid/unpaid interns hired for work within the United States or its territories and possessions and who require access to DO/bureau-owned or controlled facilities, IT systems or security items or products, shall either be U.S. citizens or have lawful permanent resident alien status (green card holders). DO/bureaus shall adhere to the following standard when allowing Federal employees, Contractors, subcontractors, experts, consultants, and paid/unpaid interns access to DO/bureau-owned or -controlled facilities, IT systems, or security items or products.

(1) Low Risk = U.S. Citizen or lawful Permanent Resident Alien3. (2) Moderate Risk = U.S. Citizen or lawful Permanent Resident Alien with at least three or more years of U.S. residency from the date of legal entry to the U.S. (3) High Risk = U.S. Citizen." There will be no exceptions to this policy. There is no waiver policy regarding non-citizens without lawful permanent resident status. [Citizenship requirements are contained in TD P 15-71, Chapter II, Section 2, Paragraph 5.]

Sensitivity and Risk Level and Clearance Level are contained in PART 2. If there are questions concerning the suitability of a Contractor employee during the pre-screening process or once the background investigation is completed, notification and an opportunity to respond will be provided to

2 Executive Order 13467, as amended, requires that all Federal employees, military members, or contractors be fingerprinted.

3 Effective with FY 2019 engagements, the Low Risk designation (Tier 1) is no longer available.

the contract employee. If the contract employee is found unsuitable, the Contractor employee will be promptly removed from his/her duties under the contract and a replacement will be requested.

In the absence of a written waiver by Contractor personnel, the provisions of the Privacy Act of 1974 (5 U.S.C. 552a) may preclude discussion of the details of background investigation(s) and/or COR action with the Contractor.

1.C. Audit Documentation

The Contractor will develop complete and accurate audit documentation in sufficient detail to provide a clear understanding of the work performed (including the nature, timing, extent, and results of audit procedures performed), audit evidence obtained, and its source, and support conclusions reached in accordance with documentation requirements included in GAO/CIGIE FAM and AICPA Standards.

After the tasks are completed, the Contractor will provide OIG with copies of any requested audit documentation (including electronic files, notes and other workpapers) that were created in performing this contract. Audit documentation shall be retained and safeguarded for a minimum of 6 years by the Contractor at no additional cost. Written authorization must be obtained from the OIG prior to destruction of any audit documentation.

For each audit finding, the Contractor will prepare and submit to the COR Notice(s) of Findings and Recommendations (NFR) that will show the condition, criteria, cause and effect (in accordance with Government Auditing Standards, Standards for Financial Audits, Developing Elements of a Finding), and recommendations for corrective action. The NFR should also show the source of information, be cross-referenced to the pertinent supporting documentation, and to the applicable sections of required reports. The NFR is used to notify the audited organization in writing of potential internal control deficiencies or instances of noncompliance and to obtain their written concurrence or non-concurrence with the facts or conditions found or the applicable criteria. A process control record is to be maintained by the Contractor over all NFRs issued, approvals obtained and their disposition. The Contractor should also refer to related NFRs for the same audit subject or functional area as well as prepare a NFR summary, where several NFRs are being used to support either a significant deficiency or material weakness.

The OIG representatives will have access to the Contractor’s audit documentation during and subsequent to the completion of the engagement. Based upon the results of this review, the Contractor may be required to perform corrective or additional work within the engagement scope, which will be performed at the Contractor’s expense.

At the request of the OIG or its representative, the Contractor will provide, within three working days of request, a copy of any requested audit documentation (including electronic files, notes and other workpapers) created in performing the audit. Accordingly, during and subsequent to the course of the audit, the Contractor’s audit reports and audit documentation will be subject to access and review by the OIG and the Government Accountability Office (GAO) or other interested parties, as authorized by the OIG.

In the event the Contractor is required by law, rule, regulation or Legal Demand in a proceeding or investigation to which the auditor is not a named party or respondent, to produce documents or personnel as witnesses or for interviews, or otherwise to make information relating to the service under the contract available to a third party not the OIG or the Government Accountability Office, the Department and OIG agrees to discuss, in good faith, reimbursement of the auditor for its professional time at its then current standard hourly rates, and expenses, including reasonable attorneys’ fees and expenses, incurred in producing documents or personnel or providing information pursuant to such requests requirements which, should the parties mutually agree upon reimbursement and upon a sum certain for such reimbursement, will be reflected in a contract modification, consistent with applicable law and subject to the availability of appropriated funds. Please note that the contractor must understand that these types of meetings are ONLY discussions and NOT negotiations. The

Contracting Officer is the ONLY person who can negotiate on behalf of the government. Negotiations conducted by any other individual will result in an Unauthorized Commitment, which must be ratified by the Office of the Procurement Executive (OPE) or their designee.

1.D. Quality Assurance When conducting the inspection, the COR will review all deliverables submitted by the Contractor in accordance with applicable standards and guidance including the GAO/PCIE FAM and audit and information technology checklists.

The contractor shall be responsible for maintaining satisfactory standards of employee competency, conduct, appearance, and integrity and shall be responsible for taking such disciplinary action with respect to its employees as may be necessary. Contractor should have establish procedures for ensuring controls over quality, timeliness, and cost, including details of the control programs.

1.E. Confidentiality of Data and Conflict of Interest Due to the sensitivity and confidentiality of much of the data handled by the Treasury, the Contractor will maintain confidentiality of all documents, data, and other information supplied to it by Treasury, in accordance with all applicable Federal guidelines and regulations. The Contractor agrees, in the performance of this contract, to keep all information obtained or otherwise reviewed as a result of this contract in the strictest of confidence. The Contractor acquires no possessory and no proprietary interests in such information. The Contractor agrees not to disclose any confidential information concerning the work under this contract to any persons or entities unless prior written approval is obtained from the Contracting Officer. The OIG acknowledges that Contractor must comply with professional standards, including Rule 1.700 of the AICPA Code of Professional Conduct.

Furthermore, the OIG acknowledges that Contractor may be required to provide information in one or more of the following circumstances related to the Contractor's performance under this contract: (a) review of Contractor’s professional practice under AICPA or state CPA society or Board of Accountancy authorization; or, (b) Contractor initiating a complaint with or responding to any inquiry made by, the professional ethics division or trial board of the AICPA or a duly constituted investigative or disciplinary body of a state CPA society or Board of Accountancy. The Contractor agrees not to publish, reproduce, or otherwise divulge such information in whole or in part, in any manner or form, at any time, during or following contract performance, nor to authorize or permit others to do so. The Contractor agrees to take such reasonable measures as are necessary to restrict access to such information to those employees of the Contractor needing such information to perform the work provided in this contract, on a “need to know” basis. The Contractor agrees to immediately notify the Contracting Officer, COR, and Bureau Task Monitor in the event that he or she determines or has reason to suspect a breach of any of these requirements or restrictions, and to provide written notification as soon as possible.

Confidentiality is essential to satisfactory performance. The Contractor will prevent any person other than the Contractor’s team members (or other person for whom access is necessary for the completion of the contract) from seeing or having access to information in the possession or under the control of the Contractor. The Contractor will prevent any person from disclosing the contents or description of documents, data, or information to any person not authorized under this contract by the Treasury to have access to such documents or information. The Contractor will prevent removal of any documents, data, or information from the Contractor’s premises without authorization by appropriate Treasury officials. All stored Treasury information shall be protected with NIST or NSA approved encryption when taken outside of the Treasury-controlled spaces.

The following data protection requirements apply to Information Technology audit or evaluation work done in performance of this contract.

a) Email transmission or receipt of Sensitive documents or sensitive information4

(1) Contractor must use the OIG furnished email account for all correspondences pertaining or containing sensitive documents or sensitive information.

(2) Prior to initiating field work, Contractor must issue a single notification in writing to the Treasury or bureau points-of-contact assigned to the engagement that any requested sensitive documents or sensitive information from the auditee be sent to the OIG furnished email account (unless a secure bureau SharePoint site is used).

(3) Contractor must not forward any sensitive information from the government furnished email account to Contractor or non-Treasury email accounts.

b) Contractor’s retention or processing of sensitive documents or sensitive information on OIG’ equipment or network

(1) OIG issued encrypted thumb drives

(a) Contractor must only use the OIG issued encrypted thumb drive(s) in support of the work specified in this contract and in accordance with OIG’s policy for the use of OIG IT resources (Attachment 7).

(b) Contractor must only use the OIG issued encrypted thumb drives to transfer Treasury data between OIG issued encrypted laptop(s) and Treasury owned equipment [i.e., from the bureaus’ systems to the OIG issued encrypted laptop(s)].

(c) Contractor may not use the OIG issued encrypted thumb drive(s) on non-Treasury owned equipment.

(2) Contractor must store OIG issued encrypted thumb drive(s) when not in use at a minimum, in a file cabinet, desk drawer, overhead storage bin, credenza, or similar locked compartment in a room or area with physical access control measures affording adequate protection and preventing unauthorized access by the public, visitors, or other persons without a need-to-know. Examples include, but are not limited to, a key-locked room, or restricted access work area controlled by a cipher lock or card reader.

(3) OIG issued encrypted laptop(s)

(a) Contractor must use OIG issued encrypted laptop(s) to process all sensitive documents or sensitive information in support of this contract

(b) Contractor must only use the OIG issued encrypted laptop(s) in support of the contract and in accordance with OIG’s policy for the use of OIG IT resources (Attachment 7).

(c) Contractor may not connect OIG issued encrypted laptop(s) to any non-Treasury network. Connection to Treasury networks will be based on a bona fide need and written approval from the appropriate Bureau IT government managers must be obtained prior to any connections.

(d) Contractor must store OIG issued encrypted laptop(s) when not in use at a minimum, in a file cabinet, desk drawer, overhead storage bin, credenza, or similar locked compartment in a room or area with physical access control measures affording adequate protection and preventing unauthorized access by the public, visitors, or other persons without a

4 Although most Treasury information uses the Sensitive But Unclassified (SBU) markings, sensitive information under this definition may include items marked For Official Use Only, Critical Infrastructure Sensitive, Limited Official Use, Controlled Unclassified Information, Sensitive, and other designations indicating a document requires special care due to the sensitive nature of its contents.

need-to-know. Examples include, but are not limited to, a key-locked room, or restricted access work area controlled by a cipher lock or card reader.

(4) OIG’s network and data storage

(a) Contractor must store all sensitive documents or sensitive information on OIG’s network.

(b) Contractor must only use the OIG’s network in support of the work specified in this contract and in accordance with OIG’s policy.

(5) OIG Remote Access

(a) Availability of remote access will be allowed only with the approval of the COR and the Director for Information Technology based on a demonstrated need to perform work related to this contract.

(b) Contractor must only access and use OIG’s network and resources via VPN account furnished by OIG in support of this contract and in accordance with OIG policy (Attachment 7).

c) Contractor will not retain any sensitive documents or sensitive information on Contractor equipment, network, or offices.

(1) Contractor will not store any Treasury provided material marked sensitive or other sensitive information on Contractor’s equipment, network, or offices. Any such items will be stored and retained under the OIG data retention policy.

(2) Contractor will retain work papers, analysis, annotations (which includes notes based on their review of sensitive or sensitive data), and meeting minutes on Contractor laptops and the Contractor network, as well as in hard copy format in order to support conclusions made in the audit or evaluation reports.

d) Contractor’s processing of non-sensitive Treasury data or non-sensitive information

(1) Contractor may process non-sensitive documents or non-sensitive information on Contractor’s network or computer equipment in performance of this contract.

(2) If the sensitivity of the information is not clearly evident, the Contractor must consult OIG as to what qualifies data or information to be sensitive.

(3) Contractor may use or process non-sensitive documents or non-sensitive information on OIG’s encrypted laptop(s), encrypted thumb drive(s) in support of work specified in this contract and in accordance with OIG’s policy (Attachment 7).

e) Workpapers containing sensitive documents or sensitive information

(1) Sensitive documents or sensitive information that Contractor determines, in its sole discretion, to retain in its work papers shall be stored and retained by OIG. OIG shall notify Contractor in writing of the address at which such work papers are stored and retained and shall notify Contractor, in writing, before any change in the location of the facility at which such work papers are stored and retained.

During the term of this contract, Contractor shall have unencumbered access to its work papers containing sensitive documents or sensitive information that are stored and retained by OIG. After the term of the contract, at the request of the Contractor, the OIG will provide, within three working days of Contractor's request, access to any requested work papers containing sensitive documents or sensitive information that are stored and retained by the

OIG.

(2) Notwithstanding any other provision of this contract, OIG shall not destroy Contractor's work papers before seven years after the date upon which the Treasury Audit contract is completed, unless it receives written notification from Contractor authorizing such destruction. This period may be extended only upon written notification to the OIG by the Contractor.

(3) OIG agrees to notify Contractor in advance of any access other than by OIG to Contractor’s work papers stored and retained by OIG. OIG further agrees to maintain Contractor’s work papers in a mutually agreeable manner so that Contractor reasonably can determine whether Contractor’s work papers have been accessed by anyone other than OIG without prior advance notification to Contractor.

1.F. Use and Ownership of Computer Software The Contractor will use and conform to computer software products that are compatible to those used by the COR, (we currently use Microsoft Office products and Adobe Acrobat; we also have a network license or IDEA). Software products that are not licensed to the COR can only be used if written approval is provided by the COR.

The Contractor may establish claim or copyright all computer software programs, computer data bases, and documents thereof, developed to facilitate, support, or perform under the contract, financial statement compilations, systems development monitoring, database analysis, data collection or the assessment of the reliability of computer processed data. However, the Contractor grants to the Government and others acting on its behalf, a fully paid, nonexclusive, irrevocable worldwide license for all such computer software products to reproduce, prepare derivative works, and perform publicly and display publicly, by or on behalf of the Government.

1.G. Technical Information System Requirements

1) The Contractor agrees to ensure that all electronic files and media used to store or transmit data to the COR and Bureau Task Monitor, are free of computer viruses.

2) All draft and final reports, including attachments, schedules and agency comments, and all other audit deliverables must also be submitted to the COR and Bureau Task Monitor on virus-free media or via email using the OIG’s standard word processing format which is Microsoft Word and or Adobe Acrobat (also see Part 2 Task Requirement Descriptions).

3) Contractors must have access to Internet E-mail and have the ability to send and receive deliverables and E-mail messages via Internet.

4) The Contractor agrees to allow the OIG to post the final audit reports on the OIG web site as an attachment to its transmittal and/or other Department/Bureau reports.

1.H. Elimination of Barriers in Information Technology In 1998, Congress amended the Rehabilitation Act of 1973 (Rehabilitation Act Amendments of 1998, Title IV, P.L. 105-220) by adding Section 508, Electronic and Information Technology, that requires Federal agencies to make their electronic and information technology accessible to people with disabilities. Inaccessible technology interferes with an individual’s ability to obtain and use information quickly and easily. Section 508 was enacted to eliminate barriers in information technology, to make available new opportunities for people with disabilities, and to encourage development of technologies that will help achieve these goals. Accordingly, Section 508 is to be complied with, when applicable (also see Part 2 Task Requirement Descriptions).

1.I. Government Furnished Property The OIG will furnish laptops and thumb drives with appropriate encryption for Contractor to meet the data protection requirements established in section 1.E.6. Contractor must agree to protect OIG equipment in accordance with OIG Policy Directive 715-04, Use of OIG Information Technology Resources (Attachment 7) and sign the Acceptance of User Responsibility contained therein. In addition, to use OIG laptops, Contractor must apply for an OIG PIV Card by completing a Contractor Processing Request Form (Attachment 8). The Contractor will be responsible for any costs incurred by the OIG to replace or repair lost or damaged property. The government will provide the Contractor work areas limited to desks, chairs, and data. The Contractor shall provide all other equipment, including computers for all work not covered in section 1.E.6 and supplies.

1.J. Substitution of Key Contractor Personnel During the first 180 calendar days of performance, the Contractor shall make no substitutions of key personnel unless the substitution is necessitated by illness, death, or termination of employment. The Contractor shall notify the COR within 5 calendar days after the occurrence of any of these events.

After the initial 180 calendar days the Contractor shall submit a written request to the COR at least 30 calendar days prior to a substitution of personnel assigned to this contract. The Contractor shall include the circumstances necessitating the proposed replacement of the key personnel and shall provide the name, resume, and CPE of the proposed replacement as described in PART 1.A., Labor Categories. It can be assumed that the COR would approve any personnel replacement that possesses the qualifications under the contract. Any disputes regarding the substitution of key personnel will be decided by the Contracting Officer.

1.K. Period of Performance

The overall period of performance shall be from March 1, 2020 through February 28, 2025; inclusive of a Base Year and Four (4) 1-year Options.

This acquisition includes (4) Four 1-year options, which may be unilaterally exercised by the

Government. Each option year shall not exceed one year in duration, unless mutually agreed upon and a formal modification issued. Exercising of any of the option years is contingent upon the government’s need and the contractor’s acceptable performance at the time the option is exercised.

All terms and conditions applicable to the base year shall extend to the options unless otherwise agreed upon.

The Base Year period of performance shall be from March 1, 2020 through February 28, 2021.

The Option Year 1 period of performance shall be from March 1, 2021 through February 28, 2022.

The Option Year 2 period of performance shall be from March 1, 2022 through February 28, 2023.

The Option Year 3 period of performance shall be from March 1, 2023 through February 29, 2024.

The Option Year 4 period of performance shall be from March 1, 2024 through February 28, 2025.

1.L. Contracting Officer’s Representative (COR), Alternate COR (ACOR) and Bureau Task Monitor The Contracting Officer designates the COR and ACOR, whom shall be a representative from the OIG. The responsibilities of the COR and ACOR will be identified in the COR / ACOR designation letter issued by the Contracting Officer. Neither the COR nor ACOR is authorized to direct any action that results in a change in the scope, price, terms or conditions of this contract. In addition, a Bureau Task Monitor will be identified as an Auditee representative. The responsibilities of the Bureau Task

Monitor include coordinating the day-to-day administrative activities of the audit (such as security, workspace, meetings, information requests, and distribution of auditee deliverables). The Bureau Task Monitor is not a COR and shall not be viewed as such by the contractor, its subcontractors, the government COR or any other individual associated with the contract.

1.M. Submission of Invoices A courtesy copy of the invoice shall be emailed to the COR prior to submission in the Invoice Processing Platform (IPP).

To constitute a proper invoice, the courtesy invoice must include the following minimum information and/or attached documentation:

a) Name of business concern/letterhead;

b) Invoice date and separate/distinct number;

c) Contract and line item number;

d) Description of services and dates upon which services were rendered;

e) Payment terms;

f) Name, title, phone number and complete mailing address of responsible official to whom payment is to be sent or to contact in case of a defective invoice;

g) Total charges for the billing period;

h) Name and hours of effort expended by each individual during the billing period and cumulative hours; and

i) Cumulative charges through the billing period.

1.N. Payment Schedule The following payment schedule will apply to the base and option periods of this contract, unless otherwise noted in Part 2:

Item When Due % of Payment

1. Planning Documents Upon approval of planning documents per deliverable schedule

30%

2. Draft Reports Upon approval of draft reports per deliverable schedule 50%

3. Final Reports Upon approval of final reports per deliverable schedule 20%

1.O. Audit Site and Travel The audit work will be performed at sites provided in Part 2.

Travel costs will be billed and paid separately consistent with the Federal Travel Regulations. However, all travel invoice documentation will first be submitted to the COR for pre-approval. After approval by the COR, the Contractor should submit its invoice/documentation (see PART 1.M.) within 45 days of audit completion.

Travel will be reimbursed to the Contractor “as needed,” to perform the necessary tasks associated with completion of the Deliverables of the Contract within an amount not to exceed amounts identified for the term of the Contract. The Contractor shall make every effort to obtain travel provisions in a manner that would be consistent with that of a Federal Employee adhering to the Federal Travel Regulations (FTR) with specific reference to the most economical travel, use of coach air versus first class accommodations, etc. To the extent possible, the Contractor shall request the Government Rate for hotel expenses when making travel arrangements. However, at no time is the Contractor authorized to represent him/herself as a Federal Government employee. However, the Contractor may represent him/herself as a Contractor for the Federal Government when making such requests for the Government Rate for hotel rooms and/or airline fares and similar expenses.

Reimbursement of expenses to the Contractor will follow the FTR per diem schedule for reimbursement for meals and expenses. The Contractor may invoice for miscellaneous expenses, taxi fares and any other expenses that are consistent with the FTR in effect at the time of travel. Travel vouchers submitted by the Contractor must be documented with receipts in a manner that is consistent with the FTR.

The Contractor shall submit invoices for travel expenses using a format that is mutually agreed upon by the contractor and government. If multiple travel vouchers are submitted for reimbursement at one time, the Contractor will appropriately summarize the individual vouchers with a summary chart listing the principal categories from the Federal Travel Voucher across the top of the summary chart and the names of the individual traveler down the stub column of the summary chart. The summary chart will be added across and down.

While the Contractor’s expenses for hotel and airfare will not be restricted to amounts allowed for Government employees traveling to similar destinations, the Government does reserve the right to deny extravagant expenses. Therefore, Contractors should contact the COR prior to incurring any unusual travel expenses.

The Contracting Officer will notify the Contractor of amounts disapproved for travel vouchers, if any, at the time the travel voucher is reviewed for payment by the COR.

1.P. Results of Prior Year Audits The Report on Department of the Treasury, Enterprise Business Solutions' Description of Its HRConnect System and on the Suitability of the Design and Operating Effectiveness of Its Controls for the period August 1, 2018 to June 30, 2019 is available on the TOIG website:

(https://www.treasury.gov/about/organizational-structure/ig/Pages/audit_reports_index.aspx). If you have a problem accessing our reports, please email Ade Bankole at BankoleA@oig.treas.gov.

1.Q. Performance Evaluation This contract is subject to a performance evaluation via The Contractor Performance Reporting System (CPARS) at www.cpars.csd.disa.mil. Following the end of each contract period and at contract completion, a completed Government evaluation shall be forwarded to the Contractor.