Attachment 1 - TRIP Modeling PWS_(REV 0001).pdf

PERFORMANCE WORK STATEMENT (PWS)

U.S. Department of the Treasury Federal Insurance Office (FIO)

Terrorism Risk Insurance Program (TRIP) Terrorism Risk Modeling

I. BACKGROUND

Following the terrorist attacks of September 11, 2001, insurers and reinsurers largely withdrew from the U.S. terrorism risk insurance market, threatening planned construction, property acquisition, business projects, and other economic activity. In response, Congress enacted the Terrorism Risk Insurance Act of 2002 (TRIA), creating the Terrorism Risk Insurance Program (TRIP) within the U.S. Department of the Treasury. TRIP is a federal backstop for insurance losses arising from a certified act of terrorism, under which Treasury may reimburse insurers for a portion of their losses once certain financial thresholds have been met. TRIP was established primarily to incentivize the private market to offer insurance for terrorism risk, while providing a transitional period for the private market to resume pricing terrorism risk and build capacity to absorb future insurance losses.1 Under the Terrorism Risk Insurance Program Reauthorization Act of 2019, effective December 20, 2019, TRIP has been extended through December 31, 2027. The Federal Insurance Office (FIO) assists the Secretary of the Treasury in administration of TRIP.2

The execution of this contract will aid FIO’s efficient and effective administration of TRIP, as well as FIO’s continued monitoring and evaluation of the terrorism risk insurance market. Additionally, this requirement, in part, is based on certain recommendations made to FIO by the Advisory Committee on Risk-Sharing Mechanisms (ACRSM). The ACRSM is a federal advisory committee which is statutorily required to provide FIO with advice, recommendations, and encouragement with respect to the creation and development of nongovernmental risk-sharing mechanisms to protect against losses arising from acts of terrorism.3 In a May 2020 report, the ACRSM recommended, among other things, that FIO perform further work in the area of terrorism risk modeling in order to improve FIO’s administration of TRIP and to facilitate the ability of private insurers to assess and evaluate terrorism risk. The ACRSM report suggested that dissemination of the results of this work would potentially allow for more accurate pricing by the private insurance industry, further private assumption of terrorism risk exposure, and a resulting decrease in Government

1 Terrorism Risk Insurance Act of 2002 (TRIA), Pub. L. No. 107-297, 116 Stat. 2322 (2002), as amended, 15 U.S.C. § 6701 note. See generally FIO, Report on the Effectiveness of the Terrorism Risk Insurance Program (June 2020), 3-8, https://home.treasury.gov/system/files/311/2020-TRIP-Effectiveness-Report.pdf.

2 Federal Insurance Office Act of 2010, 31 U.S.C. § 313(c)(1)(D) (2012).

3 Terrorism Risk Insurance Program Reauthorization Act of 2015, Pub. L. 114-1, 129 Stat. 3, § 110.

https://home.treasury.gov/system/files/311/2020-TRIP-Effectiveness-Report.pdf exposure under TRIP.4 FIO discussed ACRSM’s recommendations in its June 2020 Report on the Effectiveness of the Terrorism Risk Insurance Program.5

II. OBJECTIVES

The objectives of this contract require the development and execution of the following tasks in the respective period of contract performance:

BASE YEAR

Terrorism Risk Insurance Model (PWS section III.A)

OPTION YEAR 1

Terrorism Risk Insurance Model – Cyber Component (PWS section III.B) Terrorism Risk Insurance Model – Annual Maintenance (PWS section III.C) Report to FIO – Annual Data Collection for the Terrorism Risk Insurance Program (III.E)

OPTION YEAR 2

Terrorism Risk Insurance Model – Annual Maintenance (PWS section III.C) Terrorism Risk Insurance Model – Cyber Component – Annual Maintenance (PWS section III.D) Report to FIO – Terrorism Risk Exposure Modeling by Private Industry (PWS section III.F)

OPTION YEAR 3

Terrorism Risk Insurance Model – Annual Maintenance (PWS section III.C) Terrorism Risk Insurance Model – Cyber Component – Annual Maintenance (PWS section III.D)

OPTION YEAR 4

Terrorism Risk Insurance Model – Annual Maintenance (PWS section III.C) Terrorism Risk Insurance Model – Cyber Component – Annual Maintenance (PWS section III.D)

III. SCOPE

A. Terrorism Risk Insurance Model (Base Year): The Contractor shall develop a Terrorism Risk Insurance Model to be provided to FIO that incorporates commercially available geocoded property and employment data covering the United States (as defined for purposes of the Terrorism Risk Insurance Act). The model shall be capable of generating loss estimates (as described further below) derived from the geocoded property and employment data used within the model based upon identified attack modes taking place at any specified location in the United States as identified through queries made by FIO. For each location, the model shall provide data output estimating the loss that would result from the attack mode taking place at a specified location, both at that specified location and emanating from the specified location given the nature of the attack. Minimum qualification for the model shall include the following features:

4 The report containing the ACRSM’s recommendations can be found at https://home.treasury.gov/system/files/311/5-20-ACRSM-Report- Final.pdf.https://home.treasury.gov/system/files/311/5-20-ACRSM-Report-Final.pdf.

5 FIO, Report on the Effectiveness of the Terrorism Risk Insurance Program (June 2020), 79-81, https://home.treasury.gov/system/files/311/2020-TRIP-Effectiveness-Report.pdf.

https://home.treasury.gov/system/files/311/5-20-ACRSM-Report-Final.pdf https://home.treasury.gov/system/files/311/2020-TRIP-Effectiveness-Report.pdf

1. Has the ability to run model scenarios and produce the information described in Section III.A.2-4 based on the following attack modes at specified locations:

a. Conventional explosive attacks, including but not limited to the following bomb sizes (a single weight within the specified range is acceptable):

1. 500-750-pound vehicle bomb;

2. 1,500-2,000-pound vehicle bomb;

3. 10,000-12,000-pound vehicle bomb; and

4. 20,000-50,000-pound vehicle bomb.

b. Nuclear, biological, chemical, and radiological attacks, including but not limited to the following attack scenarios (a single weight within the specified range is acceptable):

1. 10-25-kilogram outdoor anthrax slurry attack

2. 75-100-kilogram outdoor anthrax slurry attack

3. 300-500-kilogram outdoor sarin gas release

4. 1,000-2,500-kilogram outdoor sarin gas release

5. 1,500-2,500 curies cesium-137 dirty bomb

6. 15,000-20,000 curies cesium-137 dirty bomb

7. 1-3 kiloton nuclear bomb attack

8. 5-10 kiloton nuclear bomb attack

2. Estimates total property and casualty insurance losses (meaning losses within the property and workers’ compensation lines of insurance subject to TRIP) resulting from the attack modes listed in Section III.A.1. taking place at any specified location in the United States. These estimates shall be made available by line of insurance.

3. Estimates the portion of total property and casualty insurance losses sustained by policyholders that elected to obtain terrorism risk insurance coverage. These estimates shall be made available by line of insurance.

4. Estimates the financial impact on TRIP for each of the attack modes listed in Section III.A.1., including information related to recoupment and Treasury’s share of the insurance losses.

5. The Contractor shall provide FIO with a list of any additional features (e.g. different attack modes, projected terrorism risk target locations, or other features), included in any commercial off-the-shelf (COTS) model offered by the Contractor, which would also be included in the Terrorism Risk Insurance Model.

6. The Contractor may provide FIO with access to a COTS model that is compliant with the features identified in this PWS.

7. Any Terrorism Risk Insurance Model provided to FIO, regardless of how it is provided, must permit FIO to utilize the model for as many queries, without limitation, as FIO shall determine in its sole discretion to make.

8. Geocoded property and employment information utilized in the model shall be sourced and provided by the Contractor.

9. The Contractor shall provide FIO with access to the Terrorism Risk Insurance Model through a web- or cloud-based interactive application, or an application that provides similar functionality to FIO.

10. The Contractor shall provide training, including but not limited to, accessing, use, and querying of the Terrorism Risk Insurance Model. Training shall consist of one webinar session via WebEx (or other mutually agreed upon technology) that includes an electronic training manual. Any WebEx sessions shall be recorded and submitted to the COR for future viewing by FIO employees.

11. OPTIONAL CLIN: The Contractor shall develop the Terrorism Risk Insurance Model in a U.S. Treasury IT environment, to be accessed via Treasury IT systems. The Contractor shall coordinate all development and life cycle activities in accordance with Treasury policies, including participating in any required Authority to Operate activities. The Contractor will be provided Treasury-issued laptops to gain access to the Treasury IT environment.

12. The Contractor shall also apply the following modeling assumptions for the Terrorism Risk Insurance Model and base any take-up rates of terrorism risk insurance incorporated within the Terrorism Risk Insurance Model upon:

a. Information collected by Treasury, which will be provided by FIO.

This information is on a state or metropolitan area basis and is not available on a geocoded location basis. It is thus understood that the take up information utilized by the Terrorism Risk Insurance Model will be on a different basis than the geocoded property and employment information otherwise utilized by the model.

b. The Contractor may, based upon its research and evaluation, and subject to consultation with and agreement by FIO, modify the take-up rates for specific locations within a given state jurisdiction or metropolitan area that it believes are significantly different from the overall take-up rate of such jurisdiction as reflected in the data that will be provided by FIO.

c. Alternatively, the Terrorism Risk Insurance Model may be constructed in such a way that FIO can enter take-up rates of its own choosing when posing a query to the model.

d. The Terrorism Risk Insurance Model shall not address the probability of any individual attack occurring at any location in the United States using any attack mode. To the extent that, in responding to this PWS, the Contractor proposes to use a pre-existing COTS Model that contains such features, those features may continue to be included in the COTS Model.

e. The Terrorism Risk Insurance Model shall only include loss calculations associated with property insurance and workers’ compensation insurance subject to TRIP. The model shall not seek to model losses potentially subject to liability insurance within the scope of TRIP (within the exception of cyber liability insurance, as indicated in connection with the Terrorism Risk Insurance Model – Cyber Component, as discussed in Section III.B).

B. Terrorism Risk Insurance Model – Cyber Component (Option Year 1). The Terrorism Risk Insurance Model shall also evaluate potential losses arising from cyber-attacks. The cyber portion of the model shall include, but shall not be limited to, the following features:

1. Has the ability to run model scenarios and produce the information described in Section III.A.2-4 based on the following attack modes:

a. Cyber-attacks directed at cloud computing platforms and other third-party service providers, including but not limited to:

1. Microsoft

2. Amazon

3. IBM

b. Attacks directed to vulnerabilities in commonly used computer operating system applications, including but not limited to:

1. Microsoft Windows

2. Mac OS

c. Ransomware attacks resulting in damage within the United States.

2. Estimates the portion of total property and casualty insurance losses sustained by policyholders that elected to obtain terrorism risk coverage, based on the attack modes listed in III.B.1. These estimates shall be made available by line of insurance.

3. Estimates the financial impact on TRIP for each of the attack modes listed in III.B.1, including information related to recoupment and Treasury’s share of insurance losses.

4. The Contractor shall apply the same modeling assumptions addressing take-up rates and probability of attacks identified in III.A.12.

5. The Contractor shall provide FIO with a list of additional types of attacks (e.g. compromised applications, programs, etc.) included in the Contractor’s commercially available models which would also be included in the Terrorism Risk Insurance Model – Cyber Component.

6. The Contractor shall provide training, including but not limited to, accessing, use and querying of the Terrorism Risk Insurance Model – Cyber Component. Training shall consist of one (1) webinar session via WebEx (or other mutually agreed upon technology) that includes an electronic training manual. Any WebEx sessions shall be recorded and submitted to the COR for future viewing by FIO employees.

7. The Contractor shall provide FIO with access to the Terrorism Risk Insurance Model – Cyber Component through a web- or cloud-based interactive application, or an application that provides similar functionality to FIO.

C. Terrorism Risk Insurance Model – Annual Maintenance. (Option Years 1 - 4). The Contractor shall perform annual maintenance on the Terrorism Risk Insurance Model. The following activities are representative activities of maintenance to be performed as needed:

1. Updating the data sets used in the Terrorism Risk Insurance Model

2. Correcting any errors in the Terrorism Risk Insurance Model

3. Deploying any required patches, bug fixes and upgrades necessary to ensure functionality of the Terrorism Risk Insurance Model as when first delivered to and accepted by Treasury.

4. Updating employment information

5. Updating the geocoded property information

6. Implementing changes in attack mode estimates that may be developed

D. Terrorism Risk Insurance Model – Cyber Component – Annual Maintenance. (Option Years 2-4). The Contractor shall perform annual maintenance on the Terrorism Risk Insurance Model – Cyber Component. The following activities are representative maintenance to be performed as needed:

1. Updating the data sets used in the Terrorism Risk Insurance Model – Cyber Component.

2. Deploying any required patches, bug fixes and upgrades necessary to ensure functionality of the Terrorism Risk Insurance Model – Cyber Component as when first delivered to and accepted by Treasury.

3. Correcting any errors in the Terrorism Risk Insurance Model – Cyber Component

4. Implementing changes in attack mode estimates that may be developed

E. Report to FIO – Annual Data Collection for the Terrorism Risk Insurance Program (Option Year 1) (NOTE: FIO is not seeking a contractor to build a new data collection system, perform any data collection or otherwise alter the TRIP Data Collection process. FIO only requires the Contractor to review the current TRIP Data Collection process and make recommendations.) The Report shall analyze FIO’s annual data collection for TRIP and provide recommendations to FIO including, but not limited to, the following areas:

1. FIO’s potential collection of additional data elements from the insurance industry to better evaluate and assess the terrorism risk market.

2. FIO’s potential collection of additional data elements from the insurance industry to increase the ability of the private market to assume terrorism risk exposure.

3. Additional analyses by FIO of the data collection that could produce information that further enhances FIO’s evaluation of the terrorism risk market, including the ability of the private market to assume increased terrorism risk exposure.

4. Any additional publicly available data sources that FIO should consider for purposes of data collection and analysis.

5. The extent to which any recommended changes to the annual FIO data call would result in significant additional effort for the insurance industry. If significant additional effort is required, the Contractor shall evaluate and quantify (in terms of time and financial expense) the potential increased effort.

6. How FIO’s dissemination of FIO’s (a) additional information derived from FIO’s annual data collection and (b) analysis based on FIO’s utilization of the Terrorism Risk Insurance Models identified in this PWS could assist the private insurance industry in the evaluation of terrorism risk exposure and the provision of additional private capacity for terrorism risk.

F. Report to FIO – Terrorism Risk Exposure Modeling by Private Industry (Option Year 2). The Report shall summarize and analyze terrorism risk insurance modeling being conducted by the private insurance industry, including but not limited to an analysis of the following issues:

1. The data and information used by the private insurance industry in terrorism risk modeling.

2. Recommendations on how the private insurance industry can improve terrorism risk modeling.

3. Analyses and recommendations regarding how improved terrorism risk modeling could increase the ability of the private insurance market to assume terrorism risk. These analyses and recommendations should assess the use of data currently being collected by the private insurance industry and/or through potential new data collections.

4. Analyses and recommendations on private reinsurance capacity for terrorism risk. These analyses and recommendations should assess how the data currently being collected by the private insurance industry and/or new data collections by either the private insurance industry or FIO can be used to support additional private reinsurance capacity for terrorism risk.

G. CONTRACT PHASE-OUT On notice of the Contracting Officer and within the time frame specified by the Contracting Officer, the Contractor shall support a phase out or transition of operations and shall cooperate with the Treasury and/or any successor(s).

This shall include but not be limited to:

1. A Close-Out Plan for orderly cessation of operations or a Transition Plan for transfer of the performance of services by the Contractor to another Contractor(s) or Treasury. The plans shall address provisions for coordination of efforts and assistance including archiving of systems and records and the performance of "parallel” systems testing.

2. Participating in close-out or transition activities, including planning sessions, application demonstrations, training, and ad hoc information sharing.

3. A final report outlining all work accomplished under this contract and any problems encountered. The Contractor shall also make recommendations regarding the future performance of services specified herein.

4. Online access and or copies of selected data, data files, reports, and/or hard copy materials received, produced, and maintained throughout the life of the contract.

5. To further facilitate the close out or transition to Treasury or a successor, the Contractor shall allow Treasury and/or other contractor staff reasonable access, as determined by the Contracting Officer, to the staff and facilities of the Contractor.

H. OPTIONAL CLIN: Migration of TRIP Terrorism Risk Model: In addition to maintenance, FIO may require the Contractor to migrate any data and/or system comprising the TRIP Terrorism Risk Model. Representative duties associated with migration include, but are not limited to:

1. Support and provide overall planning and coordination for the migration,

2. Providing test scenarios and writing test cases and test scripts; assisting with executing the test cases and test scripts against the target system;

3. Developing the requirements traceability matrix (RTM);

4. Performing a production readiness review of the receiving system prior to cutover;

5. Performing setup and configuration of system components;

6. Providing overall project management support in coordinating migration and interface efforts, including, but not limited to:

a. Develop comprehensive plans to include implementation, training, risk management, and contingency steps required for a successful completion.

b. Execute the integrated project plan and project schedule related to migration activities.

c. Participate with all Treasury Implementation teams to include their respective support vendors during all aspects of the migration effort

d. Comply with Federal laws, policies, regulations, and standards applicable to Treasury for information, information systems, personnel, physical and technical security, and hardware and software.

e. Report performance against project milestones related to migration activities

f. Provide all reporting necessary to successfully satisfy all requirements specified in the Performance Work Statement (PWS).

g. Make at least one (1) presentation to Treasury management as requested

7. For any gaps discovered, identify, and document each gap along with a proposed solution or workaround, including potential risks and estimated cost to Treasury for the implementation and/or operation of the proposed solution.

8. Ensure appropriate training and support for personnel and that all manuals applicable to the implementation effort are available when needed,

9. Provide technical assistance when needed,

10. Schedule any special computer processing required for the migration,

11. Perform site surveys before migration,

12. Ensure that all prerequisites have been fulfilled before the migration date,

13. Perform any required data conversion before loading data into the system,

14. Prepare site facilities for migration

I. DELIVERABLES

1. All deliverables will be reviewed by FIO to ensure accuracy, functionality, completeness, professional quality, and overall compliance with the requirements identified in this Statement of Work. The Contractor shall ensure the accuracy and completeness of all deliverables.

Report deliverables must be submitted electronically via email to FIO.

2. The Contractor shall be responsible for the following deliverables.

a. Quality Control Plan: The Contractor shall develop a Quality Control Plan that includes, but is not limited to, the following elements:

1) Performance Standards/Deliverables

2) Performance Monitoring/Auditing

3) Corrective Actions for Non-conforming Performance

4) Contractor Personnel Roles and Responsibilities

5) Data Analysis, including but not limited to the following: Trends in cost, schedule and/or performance.

b. Contract Kick-off Meeting

c. Review Meetings: The Contractor will participate in at least three (3) review meetings, as identified below:

1) Review Meeting 1: This meeting will occur after approximately sixty (60) days of contract performance in the respective period of performance. At this time, the Contractor will supply a proposed outline of any modeling work under development during the Period of Performance and draft reports for the Government’s review and approval and lead a discussion regarding the outline.

2) Review Meeting 2: This meeting will occur after approximately 180 days of contract performance in the respective period of performance. At this meeting, the Contractor will provide a demonstration of any model under development during the Period of Performance along with a draft Report for the Government’s review and approval along with a briefing of the Report’s contents. The Government will be able to ask questions regarding the operation of any model under development and the Report’s contents during the meeting.

3) Review Meeting 3: This meeting will occur after approximately 325 days of contract performance in the respective Period of Performance. At this meeting, the Contractor will supply the completed model developed in the period of performance, and any final Report scheduled for delivery in the period of performance, along with a briefing on any model delivered Model and any Report contents.

d. Status Reports: The Contractor shall submit monthly status reports to the Contracting Officer Representative (COR), due on or before the 15th of each month, with information including, but not limited to, the following:

1) Contract number

2) Contractor name

3) Period covered by report

4) Summary description of activities and accomplishments by the Contractor during the report period

5) Summary description of any outstanding action items owed by Treasury that may affect Contractor performance

6) Description of problems and issues encountered during the report period

7) Status of problems or issues identified in previous monthly report(s).

3. Deliverables Table

Deliverables Due Date Actual Deliverable

BASE YEAR

Kick-Off Meeting No later than 10 days from award

Meeting via WebEx or other Technology

Review Meeting 1, Terrorism Risk Insurance Model Outline (Custom Models Only)

No later than 60 days from award

Meeting via WebEx or other Technology

Review Meeting 2, Terrorism Risk Insurance Model Demonstration (Custom Models Only)

No later than 180 days from award

Meeting via WebEx or other Technology

Review Meeting 3, Delivery of Final Terrorism Risk Insurance Model (Custom Models Only)

No later than 325 days from award

Electronic delivery of fully functioning model and source code.

Delivery of Final Terrorism Risk Insurance Model (COTS Models Only)

No later than 75 days from award

Electronic delivery of fully functioning software and access to Model.

Quality Control Plan (For Custom Models only)

No later than 15 days after award

Electronic document in Microsoft Word.

Training on Terrorism Risk Insurance Model (For Custom Models Only)

No later than 364 days after award

WebEx meeting and electronic training manual in Microsoft Word.

Insurance Model (For COTS Models Only)

No later than 100 days after award

Status Reports Each month on or before the 15th

OPTION YEAR 1

Kick-Off Meeting

No later than 10 days from the Exercise of Option Year 1

Meeting via WebEx or other Technology

Review Meeting 1, Terrorism Risk Insurance Model – Cyber Component Outline (Custom Models Only) and FIO Report – Annual Data Collection for the Terrorism Risk Insurance Program

No later than 60 days from the Exercise of Option Year 1

Review Meeting 3, Delivery of Final Terrorism Risk Insurance Model – Cyber Component (Custom Models Only) and FIO Report – Annual Data Collection

No later than 325 days from award

Terrorism Risk Insurance Model

– Cyber Component: Electronic delivery of model and source code (delivery of source code only applies for the Terrorism Risk Insurance Program if a custom-built solution is procured.)

FIO Report – Annual Data Collection for the Terrorism Risk Insurance Program: Electronic document in Microsoft Word.

Delivery of Terrorism Risk

Component (COTS Models Only)

No later than 75 days from award

Electronic delivery of fully functioning software and access to Model.

Quality Control Plan (Custom Models Only)

No later than 15 days after award

Word

Training – Terrorism Risk

Component (Custom Models Only)

No later than 364 days after Exercise of Option Year 1

Insurance Model (For COTS Models Only)

No later than 100 days after award

Annual Maintenance – Terrorism Risk Insurance Model Ongoing Maintenance on system per contract requirements

Status Reports Each month on or before the 15th

Optional CLIN: Migration Services As requested.

Migration of all TRIP Terrorism Risk Modeling data and/or system to designated IT environment with full functionality

OPTION YEAR 2

Kick-Off Meeting

No later than 10 days from the Exercise of Option Year 2

Review Meeting 1, FIO Report No later than 60 days from the Exercise of Option Year 2

– Terrorism Risk Exposure Modeling by Private Industry

Review Meeting 2, FIO Report No later than 180 days from the exercise of Option Year 2

Modeling by Private Industry

Review Meeting 3, FIO Report

No later than 325 days from award

Modeling by Private Industry – Delivery of Final Report Quality Control Plan No later than 15 days after award

Word

Risk Insurance Model Ongoing Maintenance on System

Optional CLIN: Migration Services As requested.

Migration of all TRIP Terrorism Risk Modeling data and/or system to designated IT environment with full functionality.

Risk Insurance Model – Cyber Component

Ongoing Maintenance on System.

Status Reports Each month on or before the 15th

Transition Out As requested.

Migration of all TRIP data and any system to designated receiver.

Delivery of any code, development documents and final report to COR.

OPTION YEAR 3

Risk Insurance Model Ongoing Maintenance on System

Annual Maintenance – Terrorism Risk Insurance Model – Cyber Component

Ongoing Maintenance on System.

OPTION YEAR 4

Annual Maintenance – Terrorism Risk Insurance Model Ongoing Maintenance on System

Annual Maintenance – Terrorism Risk Insurance Model – Cyber Component

Ongoing Maintenance on System.

IV. PERIOD OF PERFORMANCE

The Government anticipates that the period of performance will consist of a one-year base period and four one-year option periods.

V. PLACE OF PERFORMANCE

The work to be performed under this contract shall be at the Contractor’s facility.

Meetings will be conducted virtually.

VI. TYPE OF CONTRACT

The Government anticipates the award of a firm-fixed price contract for this work.

VII. SECURITY REQUIREMENTS

Contractor personnel performing work shall comply with requirements as established in Homeland Security Presidential Directive-12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24, and Federal Information Processing Standards Publication (FIPS PUB) Number 201. Contractor shall be responsible for acquiring and securing personnel clearances if required.

A. Information Technology Security: To be considered in compliance with Treasury requirements, the Contractor’s Data Center and system must undergo a Security Assessment and Authorization (SA&A). The SA&A must be performed in accordance with all applicable laws, regulations, and policies. (see https://csrc.nist.gov/publications/ detail/sp/800-53a/rev-4/final for SA&A requirements). This includes the requirement of the Contractor to abide by Treasury’s Rules of Behavior and to notify Treasury in the event sanctions are applied under the Contractor’s internal process to any employee of the Contractor determined to be in violation of the Rules of Behavior. The SA&A may reveal actions that the contractor will need to take for compliance with all applicable laws, regulations, and policies:

1. NIST SP 800-53 Rev 5, Security and Privacy Controls for Federal Information Systems and Organizations, which can be found at https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf

2. NIST SP 800-53A, Revision 4, Guide for Assessing the Security Controls in Federal Information Systems

3. NIST SP 800-18 Rev. 1, Guide for Developing Systems Security Plans for Federal Information Systems

4. NIST SP 800-160, Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems

5. NIST SP 800-30, Rev. 1, Risk Management Guide for Information Technology Systems https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf rq3sb Highlight

6. NIST SP 800-34, Contingency Planning Guide for information Technology Systems

7. NIST SP 800-37 Rev. 2, Guide for Applying the Risk Management Framework to Federal Information Systems

8. NIST SP 800-60, Rev. 1, Guide for Mapping Types of Information, and Information Systems to Security Categories

9. NIST SP 800-61, Rev. 2, Computer Security Incident Handling Guide

10. Federal Information Security Management Act of 2002 (FISMA)

11. Treasury Directive Publication (TD P) 85-01, Treasury Information Technology Security Program, Volume I Policy, Part 1 Sensitive Systems

12. DO-910 v1.0, Department of the Treasury Departmental Offices Information Technology Security Policy Handbook

13. OMB Circular A-130, Appendix III, Security of Federal Automated Information Systems and Security Assessment and Authorization certification and accreditation process needed to assure its security and compliance with the Federal Information Security Management Act (FISMA) and NIST SP 800-53.

The contractor must also have a backup data center capable of meeting these requirements as well.

B. Security Categorization (For Custom Build Models Only – The Requirements in this Section Do Not Apply to Commercial Off the Shelf (COTS) Solutions): The clauses listed below apply to the Prime Contractor and any of its subcontractors employed during this contract. The clauses below also apply to tasks, work requests or other identified method of requesting work be performed that flow from this document. No Contractor personnel may perform any work under this Contract until the Government grants specific permission to do so, regardless of existing clearance or investigation.

1. This Contract is categorized as unclassified at the Moderate (Tier 2/MBI) Level. This Contract does not have the requirements to issue Task Orders (/work/other identified method of requesting work). This Contract does not have Tasks that require different levels of investigations.

2. Contractors are required to comply with the Treasury Directive P 15-71, Treasury Security Manual in the handling, protection, and safeguarding of government information in their possession. The TD P 15-71 will be followed as it specifies Treasury-specific personnel, physical, industrial and information security policy, processes and requirements that apply to this contract.

C. General Security (For Custom Build Models Only – The Requirements in this Section Do Not Apply to Commercial Off the Shelf (COTS) Solutions):

1. Department of Treasury, otherwise known as the Department, retains the right to request removal of Contractor personnel, regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government. Lack of the ability to obtain or maintain the required investigation level is included in the reasons the Department may remove a contractor employee.

2. The reason for removal shall be documented in writing by the Contracting Officer.

Additionally, the Contractor must notify the OSP of all terminations/resignations within 24 hours of occurrence. When and if such removal occurs, the Contractor is responsible for assigning qualified replacement personnel in a timely manner or ensuring that performance of the contract is not adversely affected.

3. The Contractor shall return all Departmentally issued identification cards, building passes, keys, and any other government issued material of those terminated employees to the COR. If government issued material is not available to be returned, a report must be submitted to the COR referencing the number, name of individual to whom it was issued, the last known location, and disposition of the items. Failure to return government materials may result in remedial actions against the contractor.

4. Contractor personnel shall visibly wear Departmentally issued identification badges when working in Government facilities.

rq3sb Highlight

5. If any current or prospective employee is found to be ineligible for access to Government facilities or information by the Department, the COR will notify the contractor that the employee shall not continue to work or to be assigned to work under the contract.

6. The Department may require drug screening for probable cause at any time.

7. The contractor must also ensure that, prior to the end of the contract, all Departmental information, systems, and equipment is returned to the appropriate Department personnel.

8. All contractors must be vetted and approved by OSP prior to beginning work on any portion of this contract.

9. Any employee assigned to support the Department shall comply with Personal Identity Verification One and Two (PIV-1, PIV-2) requirements as described in Homeland Security Presidential Directive 12 (HSPD-12), “Policy for a Common Identification Standard for Federal Employees and Contractors,” and “Federal Information Processing Standard 201, Personal Identity Verification Standards for Federal Employees and Contractors,” dated August 2013.

10. T2/Moderate Risk contract employees must be a U.S. Citizen or Lawful Permanent Resident Alien with at least three or more years of U.S. residency from the legal entry date in the U.S. Contractor personnel will have access to Department facilities, information and equipment limited to that which is needed to perform contract scope.

11. The Contractor shall provide the CO the name of all entities to be used as subcontractors for each type of work to be performed prior to performing any work under this contract in accordance with the FAR Subpart 44.4.

12. The Government reserves the right to accept or reject any subcontractors proposed.

Contractors should not serve as the escort for their subcontractors or for any other contractor; escorts used should be Departmental Federal employees.

13. The Contractor is responsible for obtaining the approval of the CO prior to release of any information received or generated under the contract per 48 CFR 252.204-7000. The CO should complete this item as required by internal agency directives to direct the prime contractor to the appropriate office that has public release authority. refer them to the CO.

14. Prime contractors should serve as focal point for their subcontractors’ public release requests and SBU (also known as Controlled Unclassified Information (CUI)) must be protected in accordance with EO 13556, 32 CFR 2002 (full implementation expected to be reached in November 2018), and Treasury Security Manual (TD P 15-71).

15. For Official Use Only must be protected in accordance with the providing Agency’s directives.

16. Data contained within all Department computer systems are governed by Agency Security Regulations as well as the Federal Privacy Act of 1974. Contractor personnel assigned to this project will be held accountable for adherence to these regulations.

17. If the security classification or security requirements are changed by the Government after the date of this Contract, and if the changes cause an increase or decrease in security costs or otherwise affects any other term or condition of this Contract, any resulting financial burden will be the sole responsibility of the Contractor.

18. Contractors and their subcontractors must perform all initial, annual, contemporaneous, specialized and termination training required per Department guidance and TD P 15-71 as appropriate for their position. This is in addition to any training their company requires them to have.

19. Per the TD P 15-71, the Contractor shall report to the COR within 24 hours any adverse information coming to its attention concerning employees working under this contract, to include loss or suspension of favorable adjudication, or security issues involving the scope being completed for the contract. Reports based on rumor or innuendo should not be made. The subsequent termination of an employee does not obviate the requirement of the contractor to submit this report. The report shall include each employee’s name, social security number, and the adverse information.

20. The Contractor shall also report within 24 hours any event the Contractor becomes aware of that would be deemed a potential security incident, violation or any compromise involving Treasury systems, material, or data or systems with Treasury material or data on them.

21. The Contractor shall comply with all Federal laws and regulations regarding computer security, information security and privacy.

22. While the Contractor’s personnel are at the government facility, the Contractor is responsible for compliance with all laws, rules, and regulations governing conduct with respect to security – not only as they relate to its employees and agents, but also to other personnel who are government employees or agents of the government and to property at the site regardless of ownership.

23. While on government premises and in possession of government property, the Contractor is responsible for such property and any damages or compromise thereto by Contractor’s employees.

24. The Contractor and its employees shall exercise the utmost discretion in all matters relating to their duties and functions, and in the safeguarding of pre-decisional or sensitive information (privacy, etc.) from inadvertent release.

25. At the completion of the contract vehicle, the Contractor shall send a written notice from the authorized principle of the company attesting that all file records pertaining to this contract in possession of the Contractor was destroyed.

26. The contractor will avoid any improprieties located in FAR Part 3 and 52.203-16 regarding gratuities, kickbacks, conflicts of interest and other ethics issues.

27. Work on this contract may require personnel to have access to private information covered by the Privacy Act, Title 5 of the U.S. Code, Section 552a (in addition to other types of non-public information). All Contractor personnel shall adhere to the requirements of the Privacy Act as well as any applicable Department or Federal rule/regulation regarding private information or other types of non-public information.

28. As a condition for access for Government‐Owned Systems and data, all Contractor personnel must pass background investigations in accordance with OMB Circular A‐130 which requires screening of all individuals involved with sensitive applications or data in Federal automated information systems.

29. Contractor will abide by requirements set forth in the applicable guidance for the protection of unclassified information. If Contractor fails to follow requirements above, this may result in revocation of favorable public trust adjudication for offending employees and potential negative actions against the contract vehicle itself.

30. Per FAR 52.222-54, the contractor is required to comply with enrollment and verification requirements for all contractors except those previously verified by acceptable means.

31. The contractor agrees and understands that the latest version (if superseded) of the U.S.C., CFRs, Executive Orders, Treasury policies and all other government issued documents that are referenced above will be followed.

VIII. SECTION 508 COMPLIANCE

Any electronic documents must adhere to the applicable accessibility standards at 36 CFR 1994, unless an agency exception to this requirement exists. 36 CFR 1194 implements Section 508 of the Rehabilitation Act of 1973, as amended, and is viewable at http://www.section508.gov.

http://www.section508.gov/

IX. KEY PERSONNEL

1. The following labor categories are considered key personnel: Program Manager and Director of Research.

2. The Contractor must identify the employee(s) who will be designated as Key Personnel under this contract. The Contractor must provide FIO with the resumes of all personnel to be associated with this project that includes employment history, technical ability, and training and specific subject matter/system knowledge. Each individual must demonstrate experience with services of similar scope, size and complexity as the services defined in this performance work statement.

3. Labor Category Descriptions: The labor categories considered as Key Personnel must comply with the respective labor category definitions, as follows:

a. Program Manager: Minimum qualifications: Master’s Degree in relevant subject area and ten (10) years’ experience as a Program Manager. Plans, organizes, and controls the overall activities of the program. Responsible for technical work, quality of work, and scheduling. Primary client interface conferring with client management on strategic issues and to maximize efficiency in achieving program requirements. Ensures that all program activities conform to the terms and conditions of the contract procedures and requirements, including cost, schedule, and quality parameters. Provides guidance, direction, and ultimate management for all projects, and reviews all services and products for conformance to client requirements.

b. Director of Research: Minimum Qualifications: Ph.D. and fifteen (15) years’ experience of increasing responsibility managing research requirements.

The Director of Research ensures that all research projects are conducted with sound methods and approaches. The Director approves the blueprint for the research project and oversees data collection, data analysis and reporting.

X. NON-DISCLOSURE AGREEMENTS

Contractor personnel will have access to privileged and confidential materials of the United States Government. These printed and electronic documents are for internal use only, are not to be copied or released without permission, and remain the sole property of the United States Government. Some of these materials are protected by the Privacy Act of 1974 (revised by Pub.L. 93-5791) and 38 U.S. Code. Unauthorized disclosure of Privacy Act or Title 38 covered materials is a criminal offense. To protect this information from unauthorized release or use, the Contractor shall provide an executed non-disclosure agreement to the COR with a copy to the Contracting Officer (CO) prior to commencement of work. A copy of the Non-Disclosure Agreement applicable to this contract is included as Attachment 1. Each subcontractor involved in this contract shall also complete and execute the Non-Disclosure Agreement as well and the Contractor shall also provide a copy of such Non-Disclosure Agreement to the CO prior to commencement of work by the subcontractor.

XI. TRAVEL

Travel expenses are NOT authorized for this work

XII. DATA RIGHTS (For Custom Build Models Only – The Requirements in this Section Do Not Apply to Commercial Off the Shelf (COTS) Solutions):

The Government has unlimited rights to all documents and other material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership, including copyright, shall belong belonging exclusively to the Government. These documents and materials may not be used or sold by the Contractor without written permission from the CO. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

ATTACHMENT 1

NON-DISCLOSURE AGREEMENT

The following form is required to be executed and submitted by each Contractor employee or contract personnel:

CONFIDENTIAL INFORlYIATION AGREEMENT

Contract/Contract No./Task Order No.:

1, ________________ _ __ , am an I _I employee/_/ contract employee of ____________ _ _ _ ____ ("Contractor"). Contractor has contracted with the Department of the Treasury (Treasury), the "Customer", to perform various contract administration suppmt and related services. I understand and acknowledge that, as a result of my employment with Contractor, I may have access to certain confidential, proprietary, and other information including, within specified parameters and only as allowed by law, access to Treasury's computer programs and software, processes, technical information, plans, specifications, files, directives, financial records, and, possibly, the tenants of federal buildings. Confidential information shall not include information to the extent that:

(i) it is or becomes publicly available through a source other than Contractor; (ii) it is required to be disclosed pursuant to law or regulation, government authority, duly authorized subpoena or court order;

(iii) is approved for disclosure by prior written consent of the Treasury; or (iv) information that the Contractor subsequently learned from a third party that does not impose an obligation of confidentiality upon Contractor and that either (a) does not reference or identify the Treasury or Treasury's Customer Client, other Contractors, or any files or employees of the same; or (b) which references or identifies Treasury, or Treasury's Customer Client, other Contractors, or any files or employees of the same, but which after reasonably inquiry cannot be determined to be Confidential Information covered by this Agreement.

I will not at any time, either during or after my employment or contract/contract with the Contractor, nse or disclose to others or any other source outside Treasury, any confidential information obtained as a result of the contract/contract between Contractor and Treasury or as the result of any access to Treasury's Customer Client's or other Contractor's files, computers or personnel.

I acknowledge I have been assigned to or I am working on the contract/contract indicated above at the direction of Treasury and that any product of my work is intended to be privileged and confidential work product. I am aware that unauthorized disclosure of information could damage the integrity of this contract, or project(s), as well as other Governmental interests and that the transmission or revelation of such information to unauthorized persons could subject me to prosecution under applicable laws.

I agree that I will not divulge, publish, or reveal by work, conduct or any other means, such confidential, proprietary, and sensitive information or knowledge, except as necessary to do so in the performance of my official duties related to this contract and project and in accordance with the laws of the United States, unless specifically authorized in writing, in each and every case, by the contract's project manager, contracting officer, or a duly authorized representative of the United States Government. I take this obligation freely, without any mental reservation or purpose of evasion and in the absence of duress.

Upon completion of the contract, or project, I will safeguard and not disclose to any other source, customers, clients or patties, other than to Treasury, or properly authorized personnel of Treasury's Customer Client or of another Federal agency…