24Q00023_Request for Quotations_12.14.23 final.pdf

SEE ADDENDUMIS CHECKED

CODE 18a. PAYMENT WILL BE MADE BY

CODE

FACILITYCODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

OFFEROR

OCC

Washington DC 20219

400 7TH STREET SW

Acquisitions Management Comptroller of the Currency

CODE 16. ADMINISTERED BYCODE

X

X

513210

SIZE STANDARD:

% FOR:SET ASIDE:UNRESTRICTED OROCC

RFPIFB

10. THIS ACQUISITION ISCODE

RFQ

14. METHOD OF SOLICITATION

13b. RATING

NAICS:

SMALL BUSINESS

01/10/2024 1700 ET

12/14/2023

ANDRE ADAMS

(No collect calls)

INFORMATION CALL:

FOR SOLICITATION 8. OFFER DUE DATE/LOCAL TIMEb. TELEPHONE NUMBER a. NAME

4. ORDER NUMBER3. AWARD/ 6. SOLICITATION

2031JW24Q00023

5. SOLICITATION NUMBER

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 1. REQUISITION NUMBER PAGE OF

1 93 OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

TELEPHONE NO.

17a. CONTRACTOR/

15. DELIVER TO

Washington DC 20219

400 7TH STREET SW

Acquisitions Management

9. ISSUED BY

7.

2. CONTRACT NO.

EFFECTIVE DATE

$47

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

ISSUE DATE

DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

11.

SEE SCHEDULE

12. DISCOUNT TERMS

THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13a.

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

8(A)

Comptroller of the Currency

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

The Contractor shall provide the services as indicated herein.

Period of Performance: 04/01/2024 to 03/31/2029

(Use Reverse and/or Attach Additional Sheets as Necessary)

HEREIN, IS ACCEPTED AS TO ITEMS:

XX

DATED

ROMENA R. MOY

. YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ARE

ARE

31c. DATE SIGNED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

OFFER

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

ARE NOT ATTACHED.

ARE NOT ATTACHED.

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

30b. NAME AND TITLE OF SIGNER (Type or print)

30a. SIGNATURE OF OFFEROR/CONTRACTOR

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

25. ACCOUNTING AND APPROPRIATION DATA

29. AWARD OF CONTRACT:

REF.

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32c. DATE 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

40. PAID BY39. S/R VOUCHER NUMBER38. S/R ACCOUNT NUMBER

37. CHECK NUMBER

FINALPARTIAL

36. PAYMENT

FINALPARTIAL

35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER33. SHIP NUMBER

COMPLETE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42d. TOTAL CONTAINERS42c. DATE REC'D (YY/MM/DD)

42b. RECEIVED AT (Location)

42a. RECEIVED BY (Print)

41c. DATE41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

STANDARD FORM 1449 (REV. 2/2012) BACK

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

93 2 of

Community Reinvestment Act Request for Quotation No. 2031JW24Q00023

PART I - SUPPLIES OR SERVICES AND PRICES/COSTS

1.0 GENERAL

The North American Industry Classification System code for this requirement is 513210, Software Publishers, with a size standard of $47 million.

1.1 TYPE OF CONTRACT

This is a firm-fixed-price and time-and-materials type contract.

1.2 CONTRACT LINE ITEM NUMBER (CLIN) DESCRIPTION

This following line items are firm-fixed-priced:

BASE YEAR: April 1, 2024 – March 31, 2025

CLIN DESCRIPTION EST.

QTY.

UNIT

PRICE

EXTENDED

PRICE

0001 Software Licenses

0002 Maintenance and Technical Support

0003 Training

0004 Travel

0005 Software Changes Labor Hour

OPTION YEAR ONE: April 1, 2025 – March 31, 2026

UNIT

PRICE

EXTENDED

PRICE

1001 Software Licenses

1002 Maintenance and Technical Support

1003 Training

1004 Travel

1005 Software Changes Labor Hour

OPTION YEAR TWO: April 1, 2026 – March 31, 2027

UNIT

PRICE

EXTENDED

PRICE

2001 Software Licenses

2002 Maintenance and Technical Support

2003 Training

2004 Travel

2005 Software Changes Labor Hour

OPTION YEAR THREE: April 1, 2027 – March 31, 2028

UNIT

PRICE

EXTENDED

PRICE

3001 Software Licenses

3002 Maintenance and Technical Support

3003 Training

3004 Travel

3005 Software Changes Labor Hour

OPTION YEAR FOUR: April 1, 2028 – March 31, 2029

UNIT

PRICE

EXTENDED

PRICE

4001 Software Licenses

4002 Maintenance and Technical Support

4003 Training

4004 Travel

4005 Software Changes Labor Hour

Total:

1.0 BACKGROUND

The Office of the Comptroller of the Currency (OCC) is responsible for regulating and supervising nationally chartered banks and federal savings associations (collectively, banks). As part of bank supervision, the OCC is responsible for assuring compliance with bank regulations including the Community Reinvestment Act of 1977 (CRA).

The CRA encourages certain insured depository institutions to help meet the credit needs of the communities in which they are chartered, including low- and moderate-income (LMI) neighborhoods, consistent with the safe and sound operation of such institutions.

The CRA requires federal banking agencies to:

• Assess the institution's record of meeting the credit needs of its entire community, including LMI neighborhoods, consistent with the safe and sound operation of such institution; and

• Take such record into account in its evaluation of an application for a deposit facility by such institution.

2.0 REQUIREMENTS SUMMARY

This requirement is for a commercial off the shelf (COTS), Software as a Service (SaaS) software application and data sets to assist the OCC Bank Examiners in their evaluation of banks’ compliance with the Community Reinvestment Act (CRA). The requirement includes software licensing, maintenance and technical support, and training.

The contractor shall adapt the software to meet the OCC data and reporting requirements in this statement of work (SOW). Much of data required by the OCC is publicly available and shall be maintained by the contractor. However, the software shall also have the capability to allow OCC users to load data specific to OCC evaluations to be used in reporting. This data is sensitive but not classified, and therefore the software shall meet the cyber security requirements listed in this SOW. The data uploaded by the OCC is non-public data and shall not be used for purposes other than listed in this SOW.

The software and data shall be ready for productive use by the OCC by September 30, 2024, with testing and training to be conducted in the transition period prior to productive use.

From the date of contract award to the date of final productive use, the Contractor shall submit to the Contracting Officer (CO) and Contracting Officer Representative (COR) a weekly status report in Microsoft PowerPoint that includes:

• Weekly activities;

PART II – STATEMENT OF WORK

• Status of deliverables (i.e., submitted, late, or planned);

• Key risks and mitigation plans; and

• Key issues and action items.

Within 14 business days after the date of contract award, the contractor shall submit to the COR a template for the weekly status report, and the OCC will review and provide changes and comments within 7 days. Both the Contractor and COR shall agree on the final format that will be used for the weekly status report. The status report is due on the first business day following the week for of the status update.

3.0 COTS SOFTWARE TECHNICAL SPECIFICATIONS

3.1 The following describes the technical requirements for the CRA analysis software:

3.1.1 The COTS software shall be a Software as a Service (SaaS).

3.1.2 The COTS software shall be fully tested, debugged, and verified to operate with stability in its performance of functions requested herein.

3.1.3 The system user interface shall be web browser based (HTML5 or greater) and shall be accessible using any modern browser.

3.1.4 The product shall ensure all user to cloud service communications be encrypted with the latest OCC approved browser protocol. This is currently TLS 1.2.

3.1.5 The product shall meet Homeland Security Presidential Directive 12 (HSPD-12) requirements for user identification standards by supporting multifactor-factor logins for all users. The preferred solution is to interface with the OCC cloud based identity as a service (IDaaS) solution (OKTA) for identity access management, using standard Security Assertion Markup Language (SAML) version 2.0. SAML is an XML-based standard for exchanging authentication and authorization data between an identity provider (IdP) (e.g., the OCC IDaaS solution provider) and a service provider.

3.1.6 The OCC has implemented Cloud Access Security Broker (CASB) to safeguard OCC production applications. The Contractor shall work with OCC staff to configure Netskope Cloud Security for production application monitoring and access protection.

3.1.7 The system shall support 150 OCC named users.

3.1.8 Online resources such as job aides and knowledge articles must be available to assist the users to create queries and reports.

3.1.9 The solution shall meet the requirements in Section 8.0 to ensure that all OCC information and data is secured and protected from unauthorized use and disclosure.

3.1.10 The software must allow the OCC to import data collected from Banks. Imported data will include residential mortgage data from Home Mortgage Disclosure, small business and small farm loan data from the Community Reinvestment Act (CRA), small business reporting that may be required under Regulation B (Section 1071) and consumer loan data; deposits and branch office data (FDIC), community development loans, investments, and services; and assessment area geographic delineation data. The following is a partial list of data formats commonly encountered:

3.1.10.1 Standard Federal Financial Institutions Examination Council (FFIEC) submissions format (for CRA small business and small farm data, and pre- 2018 HMDA fields);

3.1.10.2 Micro format (for CRA small business and small farm data);

3.1.10.3 Standard Consumer Financial Protection Bureau (CFPB) format (including all HMDA fields pertaining to 2018 and future data, except as subject to the partial exemptions in Appendix B);

3.1.10.4 Standard CFPB format for reporting small business data under 1071;

3.1.10.5 ASCII Fixed format;

3.1.10.6 ASCII Delimited format; and

3.1.10.7 Excel spreadsheet formats.

3.1.11 The software must allow for the export of non-proprietary data into ASCII files which may be imported into other software applications (e.g. Excel, Word, etc.). Exported data shall include but not be limited to: the results of “canned” and ad-hoc queries, reports, and tables.

3.1.12 The software must enable the user to perform random statistical samples of data.

3.1.13 The software shall be available for use by users 99.95% of the time during standard business hours on an annual basis, as defined in Section 5.2.

3.1.14 The software shall be approved by OCC’s Authority to Operate (ATO) process before being allowed into production as described in Section 8.

4.0 DATA AND FUNCTIONAL SPECIFICATIONS

4.1 DATABASES AND SOURCES: The software shall provide the capability to analyze data and produce queries, tables, and reports as listed in this SOW based on the databases and sources listed in this section.

4.1.1 The software must provide the following types of data:

4.1.1.1 Geographic boundary data from the Office of Management, Budget (OMB);

4.1.1.2 Demographic data from the 2015 American Community Survey (ACS), and 2020 US Census, including updates as available from the American Community Survey (ACS) and US Census, and reflecting the applicable OMB Metropolitan Area (MA) delineations for the U.S., Puerto Rico, United States Virgin Islands, Guam, and the Northern Mariana Islands;

4.1.1.3 Dunn and Bradstreet (D&B) small business data, updated annually as provided by D&B; and

4.1.1.4 Federal Deposit Insurance Corporation (FDIC) Summary of Deposits (SOD) and Branch Office and Remote Services Facilities (RSF) Data, updated annually.

4.1.1.5 Census data as defined in Section 4.2 below

4.1.1.6 Bank Level and Aggregate Lending Data (Home Mortgage Disclosure Act (HMDA) application and loan data)

4.1.1.7 Small business, small farm, and consumer loan data reported under the (CRA (CRA data) or reported under the Consumer Financial Protection Bureau rule implementing and Section 1071 of the Dodd-Frank Act (1071)));

4.1.1.8 Assessment area delineations, reported under HMDA and CRA. A bank’s assessment area(s) is the area that the bank has delineated or has been determined by the user to be the area wherein the bank operates a main office, branches and/or deposit-taking remote service facilities (RSF), as well as originating and purchasing loans. The software user shall be able to select the census tracts, counties or county equivalent (i.e., cities or townships), metropolitan statistical areas (MSA), metropolitan divisions (MD), and multistate MSAs (MMSA) (hereinafter referred to as ‘geographies”) which make up a bank’s Assessment Area(s).

4.1.1.9 The software must be able to accept and process the following types of data, if provided in a prescribed format:

4.1.1.9.1 Assessment area delineations;

Bank level lending data (applications and loans) not reported under HMDA, CRA, or 1071;

4.1.1.9.2 Community development lending, investment, and services data;

4.1.1.9.3 Bank Deposits reported for the area (FDIC Deposit Market Share Reporting;

4.1.1.9.4 Peer Data – Home Mortgage Lending (HMDA Reporting);

4.1.1.9.5 Peer Data – Small Business Lending (CRA Reporting); and

4.1.1.9.6 Peer Data – Small Loans to Farms (CRA Reporting).

4.2 DATA USED IN THE ANALYSIS FUNCTIONS: The application shall provide the capability to analyze data and produce queries, tables, and reports using the data listed in this section.

4.2.1 GEOGRAPHIC DATA LEVELS – Basis for geocoding data by location and income, race, and ethnicity. The data shall include:

4.2.1.1 Census tract (CT) as defined by the U.S. Census Bureau;

4.2.1.2 County, county equivalents, and states;

4.2.1.3 MAs which include metropolitan divisions (MD), metropolitan statistical areas (MSA), and multistate MSAs (MMSA), as defined and updated by

OMB;

4.2.1.4 Assessment area(s), as reported under HMDA or CRA or provided by the bank;

4.2.1.5 Distressed nonmetropolitan middle-income census tracts, and underserved nonmetropolitan middle-income census tracts, as defined and updated by the OCC, FDIC, and Board of Governors of the Federal Reserve (FRB) (collectively, agencies); and

4.2.1.6 Designated disaster areas, as identified by the Federal Emergency Management Agency (FEMA).

4.2.1.7 INCOME LEVELS for borrowers and geographic data levels based on the area median family income (AMFI) for the assessment area, CT, MD, MSA, or statewide nonmetropolitan area, as applicable. It will be used to determine CT income level and applicant/borrower income level. The data shall include:

4.2.1.7.1 For individuals, families, and census tracts;

4.2.1.7.2 Low-income means income less than 50% of the applicable Area

Median Family Income (AMFI);

4.2.1.7.3 Moderate-income means income at least 50% but less than 80% of the applicable AMFI;

4.2.1.7.4 Middle-income means income at least 80% but less than 120% of the applicable AMFI; and

4.2.1.7.5 Upper-income means income equal to 120% or more of the applicable AMFI;

4.2.1.7.6 For businesses and farms; and

4.2.1.7.7 Small business or small farm means a business or farm with gross annual revenues of $1 million or less.

4.2.2 PERSONS, FAMILIES, AND HOUSEHOLDS by number and percentage. Geocoded based on data from 2015 ACS, and 2020 US Census, including updates as available from the ACS and US Census, and reflecting the applicable OMB MA delineations.

Also sourced from data reported under HMDA, depending on the use in analytical functions. The data shall include:

4.2.2.1 Population:

4.2.2.1.1 Total population

4.2.2.1.2 Persons below the poverty level

4.2.2.1.3 Persons in group quarters

4.2.2.1.4 Unemployed labor

4.2.2.1.5 Civilians not in work force

4.2.2.1.6 People over 16

4.2.2.1.7 People 65 and older

4.2.2.2 Families and Households:

4.2.2.2.1 Total families

4.2.2.2.2 Families that are below the poverty level

4.2.2.2.3 Families with non-farm self-employment income

4.2.2.2.4 Families with farm self-employment income

4.2.2.2.5 Families receiving social security income

4.2.2.2.6 Families receiving public assistance income

4.2.2.2.7 Total households

4.2.2.2.8 Households that are below the poverty level

4.2.2.2.9 Households with non-farm self-employment income

4.2.2.2.10 Households with farm self-employment income

4.2.2.2.11 Households receiving social security income

4.2.2.2.12 Households receiving public assistance income

4.2.2.3 Race for borrower and co-borrower

4.2.2.3.1 American Indian or Alaska Native

4.2.2.3.2 Asian

4.2.2.3.2.1 Asian Indian

4.2.2.3.2.2 Chinese

4.2.2.3.2.3 Filipino

4.2.2.3.2.4 Japanese

4.2.2.3.2.5 Korean

4.2.2.3.2.6 Vietnamese

4.2.2.3.2.7 Other Asian

4.2.2.3.3 Black or African American

4.2.2.3.4 Native Hawaiian/Pacific Islander

4.2.2.3.4.1 Native Hawaiian

4.2.2.3.4.2 Guamanian/Chamorro

4.2.2.3.4.3 Samoan

4.2.2.3.4.4 Other Pacific Islander

4.2.2.3.5 White

4.2.2.3.6 Not Provided

4.2.2.3.7 Not Applicable

4.2.2.4 Ethnicity for borrower and co-borrower, the following are the minimum ethnicity breakdowns required and conform to Regulation C, HMDA requirements, and OMB definitions currently in effect. The data shall include:

4.2.2.4.1 Hispanic or Latino

4.2.2.4.1.1 Mexican

4.2.2.4.1.2 Puerto Rican

4.2.2.4.1.3 Cuban

4.2.2.4.1.4 Other Hispanic or Latino

4.2.2.4.2 Not Hispanic or Latino

4.2.2.4.3 Not provided by mail, internet, telephone

4.2.2.4.4 Not Applicable

4.2.2.5 Sex of borrower and co-borrower

4.2.2.5.1 Male

4.2.2.5.2 Female

4.2.2.5.3 Information not provided by applicant in mail, internet, or telephone application

4.2.2.5.4 Not applicable

4.2.2.5.5 Applicant selected both male and female

4.2.3 HOUSING – by number and percentage. Geocoded based data from 2015 ACS, and

2020 US Census, and subsequent updates from ACS and US Census, if available, and reflecting the applicable OMB MA delineations. The data shall include:

4.2.3.1 Total housing units

4.2.3.2 Single family housing units

4.2.3.3 Multifamily housing units

4.2.3.4 Owner-occupied housing units

4.2.3.5 Renter-occupied housing units

4.2.3.6 Vacant housing units

4.2.3.7 Vacant housing units-boarded up

4.2.3.8 Median housing unit age

4.2.3.9 Median gross rent

4.2.3.10 Median housing value

4.2.3.11 Units with rent greater than 30 percent of renter’s gross income

4.2.3.12 Units with mortgage cost greater than 30 percent of owner’s gross income

4.2.4 BUSINESSES/FARMS – by number and percentage. Geocoded based on data from

Dun & Bradstreet (D&B), updated annually.

4.2.4.1 All non-farms

4.2.4.2 Non-farms with gross annual revenues less than or equal to $ l million

4.2.4.3 Non-farms with gross annual revenues greater than $1 million

4.2.4.4 All farms

4.2.4.5 Farms with gross annual revenues less than or equal to $1 million

4.2.4.6 Farms with gross annual revenues greater than $1 million

4.2.5 DEPOSIT AND BRANCH OFFICE DATA. FDIC Summary of Deposit (SOD) and

Bank Branch Office Data. The data shall include dollar volume and/or number, as applicable, percentage, geocoded based on location of branch. The data shall include:

4.2.5.1 Total bank deposits

4.2.5.2 Bank branch deposits

4.2.5.3 Bank branch office location. data, geocoded by low-, moderate-, middle-, and upper-income, and not applicable geographies, FDIC opening and closing data, geocoded by low-, moderate-, middle-, and upper-income, and NA geographies. SOD Deposit data at the census tract level.

4.2.5.4 Aggregate dollar amount and percentage of deposits.

4.2.5.5 Number and percentage of bank branch offices by low-, moderate-, middle-, and upper-income census tracts.

4.2.6 APPLICATION AND LOAN DATA by dollar volume, number, and percentage.

Geocoded based PM data from 2015 ACS, and 2020 US Census, and subsequent updates from ACS and US Census, if available, and reflecting the applicable OMB MA delineations. The data shall include:

4.2.6.1 Date

4.2.6.1.1 Application date

4.2.6.1.2 Action taken date

4.2.6.2 Loan Type

4.2.6.2.1 Conventional

4.2.6.2.2 Federal Housing Administration (FHA)-insured

4.2.6.2.3 Veterans Affairs (VA)-guaranteed

4.2.6.2.4 Farm Service Agency (FSA)/US Department of Agriculture Rural

Housing Service (RHS) -guaranteed

4.2.6.3 Property Type

4.2.6.3.1 One to four family (other than manufactured housing)

4.2.6.3.2 Manufactured housing

4.2.6.3.3 Multifamily

4.2.6.4 Loan Purpose

4.2.6.4.1 Home purchase

4.2.6.4.2 Home improvement

4.2.6.4.3 Refinancing

4.2.6.4.4 Cash-out refinancing

4.2.6.4.5 Other purpose

4.2.6.4.6 Small business

4.2.6.4.7 Small farm

4.2.6.4.8 Consumer

4.2.6.5 Owner Occupancy

4.2.6.5.1 Principal residence

4.2.6.5.2 Second residence

4.2.6.5.3 Investment property

4.2.6.6 Loan Amount ( (two decimal places)

4.2.6.7 Lien Status

4.2.6.7.1 Secured by a first lien

4.2.6.7.2 Secured by a subordinate lien

4.2.6.8 Credit Score for borrower and co-borrower

4.2.6.9 Credit Scoring Model

4.2.6.9.1 Equifax Beacon 5.0

4.2.6.9.2 Experian Fair Isaac

4.2.6.9.3 FICO Risk Score Classic 04

4.2.6.9.4 4. FICO Risk Score Classic 98

4.2.6.9.5 VantageScore 2.0

4.2.6.9.6 VantageScore 3.0

4.2.6.9.7 More than one credit scoring model

4.2.6.9.8 Other credit scoring model

4.2.6.9.9 Not applicable

4.2.6.9.10 Exempt

4.2.6.10 Action Taken

4.2.6.10.1 Originated

4.2.6.10.2 Approved, but not accepted

4.2.6.10.3 Denied

4.2.6.10.4 Withdrawn

4.2.6.10.5 Closed for incompleteness

4.2.6.10.6 Loan purchased by institution

4.2.6.10.7 Preapproval request denied

4.2.6.10.8 Preapproval request approved, but not accepted

4.2.6.11 Reasons for Denial

4.2.6.11.1 Debt-to-income ratio

4.2.6.11.2 Employment history

4.2.6.11.3 Credit history

4.2.6.11.4 Collateral

4.2.6.11.5 Insufficient cash

4.2.6.11.6 Unverifiable information

4.2.6.11.7 Application incomplete

4.2.6.11.8 Mortgage insurance denied

4.2.6.11.9 Other

4.2.6.12 Location

4.2.6.12.1 Street address

4.2.6.12.2 City

4.2.6.12.3 State

4.2.6.12.4 Zip code

4.2.6.12.5 County

4.2.6.12.6 Census tract

4.2.6.13 Total Loan Costs

The amount of total costs of the loan as disclosed based upon 12 CFR 1026.38(f)(4).

4.2.6.14 Total Points and Fees

The total points and fees charged in dollars and calculated according to 12 CFR 1026.32(b)(1).

4.2.6.15 Origination Charges

The total of all itemized amounts that are designated borrower-paid at or before closing, as disclosed according to 12 CFR 1026.38(f)(1).

4.2.6.16 Discount Points

The points paid to the creditor to reduce the interest rate, expressed in dollars, and disclosed according to 12 CFR 1026.38(f)(1).

4.2.6.17 Lender Credits

The amount of lender credits as disclosed according to 12 CFR 1026.38(h)(3).

4.2.6.18 Interest Rate

The interest rate applicable to the approved application or to the loan at closing or account opening.

4.2.6.19 Prepayment Penalty Term

For loans or applications subject to 12 CFR 1026, other than reverse mortgages or purchased loans, the term in months of any prepayment penalty as defined in 12 CFR 1026.38(b)(6)(i) or (ii).

4.2.6.20 Debt-to-Income Ratio for borrower and co-borrower

The ratio of the applicant’s or borrower’s total monthly debt to the total monthly income relied on in making the credit decision, excluding purchased loans.

4.2.6.21 Loan Term

The scheduled number of months after which the legal obligation will mature or terminate or would have matured or terminated.

4.3 ANALYSIS FUNCTIONS: The software shall produce queries, tables, and reports based on the analysis functions described in this section.

4.3.1 The software shall enable the users to analyze loan data by using software queries, which present CRA data and apply and consider defined performance thresholds, by:

4.3.1.1 Geographic Distribution. At a minimum, queries that detail the geographic distribution of a bank’s lending activity (defined as total applications by action taken, e.g., originations, purchases, denials, etc.) shall provide the breakdown of data by number, dollars, and percentages based on the demographic composition of defined areas (for example, assessment areas, majority-minority census tracts), including:

4.3.1.1.1 For each loan purpose (home mortgage, small business, small farm, and consumer);

4.3.1.1.2 Across geographic data levels and in total at the bank level; and

4.3.1.1.3 By the income level, race, or ethnicity classification for the census tract.

4.3.1.2 Borrower Distribution. At a minimum, queries which detail the borrower distribution of a bank’s lending activity shall provide the breakdown of data by number, dollars, and percentages by demographic composition of defined areas, including:

4.3.1.2.1 For each loan purpose (home mortgage, small business, small farm, and consumer);

4.3.1.2.2 Across borrower income level classifications; and

4.3.1.2.3 By borrower race, borrower ethnicity, or borrower income level.

4.3.1.3 Lending Activity. At a minimum, queries which detail the volume of loans originated and purchased, in both dollar amount and number of loans and reported by loan product (home mortgage, small business, small farm, consumer, community development), within a defined area.

4.3.1.4 Lending Inside and Outside Bank Assessment Areas. At a minimum, queries which detail the volume (dollar amount and number of loans) of all loan products (home mortgage, small business, small farm, and consumer) originated and purchased inside and outside bank assessment areas. The data are reported by each loan product with the total volume of lending inside and outside of the bank assessment areas reported.

4.3.1.5 Lending Gaps. At a minimum, queries which identify defined areas with no bank loans originated or purchased within a defined period of time.

4.3.1.6 Community Development Loans. The software shall enable the user to import and aggregate community development loan volume (number and dollar amount) within a defined area. It shall give the user sufficient data to analyze community development lending by comparing the dollar amount to a user-defined preset comparator (for example, allocated tier one capital) within a defined area.

4.3.1.7 Community Development Investments. The software shall enable the user to import and aggregate community development investment volume (number and dollar amount) within a defined area. It shall give the user sufficient data to analyze community development investment by comparing the dollar amount to a user-defined preset comparator (for example, allocated tier one capital) within a defined area.

4.3.1.8 Branch and ATM Distribution. The software shall enable the user to access and use FDIC branch and deposit data or import bank-provided branch information. The software shall be able to analyze the bank’s branch distribution by comparing the percentage of bank branches and ATMs within each geographic area combined by common income level (low-, moderate-, middle-, and upper income areas, such as census tracts) to the percentage of the defined area’s population within those geographic areas.

4.3.1.9 Branch Openings and Closings. The software shall enable the user to import bank-provided information on branch openings and closings during the defined evaluation period. The total of branch openings and closings within a defined area will be identified and the net of branch openings and closings (the number of closings subtracted from the number of openings) within each geographic area combined by common income level (low-, moderate-, middle-, and upper-income areas, such as census tracts).

4.3.1.10 Peer Bank, Market Share, and Market Rank. The software shall enable the user to produce peer and market share analyses, including aggregate lending distributions, market rank and market share for lending activity and deposits, within defined areas (such as assessment area(s)) by geographic data level, census tract income classification, and by borrower income or revenue level, race, and ethnicity.

4.3.1.11 Assessment areas. The software shall construct a bank’s Assessment

Area(s) based on imported bank provided or reported data.

4.3.1.12 Aggregation of Data. The software shall enable the user to combine loan data for multiple charters, years (including different ACS/Census periods), regions, and products for bank and market share analysis. Lending data from years 2017 and through 2021 shall be analyzed using the 2015 ACS data.

Data in years 2022 and forward shall be analyzed using the 2020 Census data, or updated ACS or Census data, as updated and applicable. All OMB revisions will be incorporated into the data as they become effective.

4.3.1.13 The software analysis queries shall also make available to the user any additional or revised information under the CRA regulation (12 CFR 25), Section 1071 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Regulation B amended), and the Home Mortgage Disclosure Act (Regulation C), as amended, subsequent to the effective date of any such changes.

4.4 OCC CRA TABLES: The software shall produce customized tables required for the written

CRA Public Evaluations as required in this SOW. The user must have access to all small business, small farm, and home mortgage (HMDA reported) loan data through the software. If necessary, the user shall be able to import bank-provided small business, small farm, and HMDA loan data. The tables must meet the specifications as identified in Appendix C.

4.5 GEOCODING: The software shall be able to internally geocode address files based on the geographic data levels in the Databases and Sources section.

4.6 MAPPING FUNCTION: The software shall have the ability to internally map geocoded loan and deposit data within and outside the defined parameter(s) of assessment area(s). The software shall also have the ability to identify and map census tracts and broader areas meeting user-defined criteria related to the volume of loan applications received by banks and the volume of loans originated based on the Database and Sources and Data Used in the Analysis Functions sections, for example, census tracts with no loans originated by a bank or a very low volume of loans originated and census tracts with no applications reported by a bank or a very low volume of applications received by the bank. The software shall enable the user to analyze data on an individual bank basis and an aggregate peer basis. The software shall also enable the user to identify customized “peer” banks based upon criteria defined by the user. For example, census tracts with no loans originated by a bank or a very low volume of loans originated and census tracts with no applications reported by a bank or a very low volume of applications received by the bank. The software shall enable the user to overlay other information on maps, including the geographic parameters of the bank’s assessment area(s), natural and man-made geographic features, including lakes and rivers, parks, and highways and roads. The software shall also enable the user to identify and overlay other landmarks, such as prisons, universities, colleges, and other schools, shopping malls, athletic facilities, and industrial plants / areas. The software shall allow the user to request standardized maps that are predeveloped by the contractor and continually available to the user. The software shall enable the user to develop maps based upon custom criteria.

4.7 REPORTING FUNCTIONS:

4.7.1 The software shall be able to produce all reports on standard 8”x 11” paper in portrait and landscape, that are exportable to MS Word documents, MS Excel Spreadsheets, or

PDF.

4.7.2 The application shall allow user defined ad hoc reporting (custom reports) of demographic data and financial data. Reports shall be constructed to combine, or allow for the combination of, data as listed in the Data Used in the Analysis Section above.

The ad hoc (custom) reporting function shall provide the Examiner with expanded sorting and information processing capabilities. The sorting criteria shall include, but not be limited to, racial composition of tracts, income composition of tracts, number and percentage of loan originations, number and percentage of loan applications, denials, loans per owner-occupied units or other housing characteristics, number and percentage of loans to type of borrower, etc. Using fields as defined in Section 4.2 above, “canned” reports, at a minimum, shall be broken down as follows (where applicable data are to be reported as numbers and percents):

4.7.2.1 DEMOGRAPHIC DATA REPORTS. These data must be incorporated into user-defined tables in addition to being available through standalone reports. The reports shall include the following:

4.7.2.1.1 Entire Delineated Assessment Area(s)

4.7.2.1.2 Geographies within Delineated Assessment Area(s)

4.7.2.1.3 Geographies immediately surrounding Delineated Assessment

Area(s)

4.7.2.1.4 Income Classifications (Low, Moderate, Middle, Upper w/in

Geographies)

4.7.2.1.5 Annual updated median family income for at least three years

4.7.2.2 MARKET SHARE REPORTS. These data must be incorporated into user-defined tables in addition to being available through standalone reports. The reports shall include the following:

4.7.2.2.1 Summary of all Lenders within Delineated Assessment Area(s)

4.7.2.2.2 Peer Analysis by selected lenders

4.7.2.2.3 By Census Tract

4.7.2.2.4 By Income Classifications

4.7.2.3 SUMMARY REPORTS. (Individual Institution and Aggregate Data, separately). The reports shall include the following:

4.7.2.3.1 Total Applications and Action Taken by:

4.7.2.3.1.1 Geographies

4.7.2.3.1.2 Geographic Income Classifications

4.7.2.3.1.3 Race

4.7.2.3.1.4 Ethnicity

4.7.2.3.2 Volumes and comparisons of Action taken by:

4.7.2.3.2.1 Loan Purpose

4.7.2.3.2.2 Loan Type

4.7.2.3.2.3 Race

4.7.2.3.2.4 Ethnicity

4.7.2.3.3 Volumes and comparisons of Denial reasons by:

4.7.2.3.3.1 Loan Purpose

4.7.2.3.3.2 Loan Type

4.7.2.3.3.3 Race

4.7.2.3.3.4 Ethnicity

4.7.2.3.3.5 Applicant Income Classifications

4.7.2.3.4 BATCH REPORTING. The ability to generate sets of the above reports with reduced keystrokes.

5.0 COTS SOFTWARE MAINTENANCE AND TECHNICAL SUPPORT

The contractor shall provide maintenance and technical support of its software. Such maintenance and support shall include correction of errors; provision of contractor sponsored modifications, improvements, revisions and new releases.

5.1 MODIFICATIONS, IMPROVEMENTS AND REVISIONS: Within thirty (30) calendar days of issuance, the contractor shall provide the users with release notes for all modifications, improvements, revisions, and new releases issued during the term of the contract. The release notes will provide an overview of the changes, clear explanation of functionality and user impacted, feature enhancements or new features, issues fixed, and any ongoing issues/challenges/limitations.

5.2 DOWNTIME: Scheduled down time due to system upgrades or maintenance shall be reported to the OCC seven (7) calendar days prior to occurrence and shall be scheduled during non-business hours. Business hours are 7:00 a.m. to 7:00 p.m. ET, Monday through Friday.

5.3 SUPPORT: The contractor shall provide telephone help desk support to software users.

Live telephone support shall be available Monday through Friday (excluding Federal holidays) from 8:00 a.m. to 5:00 p.m. (ET). The contractor shall have a method to receive support inquiries (for example, email, online form, voice mail) between 5:00 p.m. and 8:00 a.m. (ET) and shall confirm receipt on the next business day.

The contractor shall provide a single point-of-contact for employees to assist with technical questions and escalate issues as needed. This point-of-contact will also be responsible for scheduling any required testing and/or training. The point-of-contact will be responsible for all communications, including notifying the OCC of upcoming changes to the software.

The following Federal holidays are observed by the OCC:

New Year’s Day January 1 Martin Luther King, Jr. Birthday Third Monday in January Presidents Day Third Monday in February Memorial Day Last Monday in May Juneteenth July 19 Independence Day July 4 Labor Day First Monday in September Columbus Day Second Monday in October Veterans Day November 11 Thanksgiving Day Fourth Thursday in November Christmas Day December 25

5.4 DATA MAINTENANCE: The CRA and HMDA data provided by the contractor shall reflect the most current regulations and statutes. The contractor shall provide the latest CRA and HMDA revisions to the software within 90 calendar days when a CRA or HMDA change is implemented into law.

6.0 TRAINING ON SOFTWARE

The contractor shall provide training classes for the initial deployment, plus ongoing training for new users, software updates and modifications. Within sixty (60) calendar days of contract award, the contractor shall provide a training plan that includes the courses to be provided, course description, delivery location, delivery method, and schedule. The contractor shall work with the COR to schedule all training times and locations.

6.1 COURSE DESCRIPTION: The contractor shall provide comprehensive training classes for the users that cover the full functionality of its CRA software with special emphasis on the following processes and tasks:

6.1.1 construction of banks’ assessment area(s)

6.1.2 loan data analysis queries and reporting functions

6.1.3 demographic data queries and reporting functions

6.1.4 importing loan data from other sources

6.1.5 exporting data to other applications

6.1.6 ad hoc query and reporting capabilities

6.1.7 mapping of data and assessment areas

6.1.8 technical functions, i.e. file maintenance, file compression, archiving, etc.

6.1.9 system administration overview

The contractor shall have the capability to record online training for future playback as requested by the OCC.

6.2 LOCATION: The contractor shall provide training classes that are a mix of virtual/online and in-person classes with the majority of initial end user training conducted in-person at OCC Headquarters located in Washington, DC. Additional courses may be scheduled in-person at one or more of the below OCC offices:

6.2.1 Denver

6.2.2 New York City

6.2.3 Chicago

6.2.4 Dallas

The OCC will determine the locations of in-person classes. The OCC will provide training sites, all necessary equipment, and software. The contractor shall provide a qualified instructor and all necessary training materials. At a minimum, the contractor's training materials shall include either an online or written tutorial.

6.3 CLASS SIZE: In person class size will be approximately 15 employees per instructor present.

6.4 SCHEDULING: The OCC will work with the contractor to schedule all training classes on mutually agreeable training dates. In the event agreement cannot be reached;

however, the OCC shall have the unilateral right to specify the training date, provided the OCC notifies the contractor at least 30 days in advance of the date the training is required.

6.5 TRAVEL: The OCC will reimburse the contractor for travel to/from training sites per the Federal travel regulations.

7.0 IT ACCESSIBILITY REQUIREMENTS

1. Section 508:

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities.

As such, the following requirements apply to this solicitation:

a. Products, platforms, and services delivered as part of this work statement that are ICT, or contain ICT, must conform to the Revised 508 Standards, which are located at 36 C.F.R. § 1194.1 & Apps. A, C & D, and available at https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines.

b. E102 / 702.10 – Web Content Accessibility Guidelines (WCAG) 2.0 guidelines success criteria level A & AA are incorporated as a requirement. The referenced WCAG criteria is available at http://www.w3.org/TR/WCAG20/.

c. A completed Accessibility Conformance Report (ACR) found at https://www.itic.org/policy/accessibility/vpat, using Voluntary Product Accessibility Template (VPAT) Revised Section 508 Edition, Version 2.4, is required to assist the

Government in determining that the ICT products or services support Section 508 accessibility standards.

d. E202 – No General Exceptions Authorized by OCC.

The following items are identified as containing ICT:

• Software Applications & Operating Systems

• Web-based Intranet and Internet Information and Applications

• Information, Documentation, and Support

2. Applicable Functional Performance Criteria: All functional performance criteria apply when using an alternative design or technology that achieves substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4-6 of the Revised 508 Standards, or when Chapters 4-6 do not address one or more functions of ICT.

3. Applicable requirements for software and Web products:

• E207 – WCAG Level A & AA Success Criteria

• E302 – Functional Performance Criteria

• E502 – Interoperability with Assistive Technology

• E503 – Application

• E504 – Authoring Tool

• E501 – Web-based applications, independent of platform services

4. Applicable requirements for electronic documents and/or support services:

• E205 – WCAG Level A & AA Success Criteria

• E302 – Functional Performance Criteria

• E602 – Support Documentation

• E603 – Support Services

8.0 SECURITY AND COMPLIANCE

1. Compliance with Applicable Laws, Regulations, and Standards

Federal Laws. The contractor and all of its respective subcontractors shall follow and remain compliant at all times with the Federal Acquisition Regulation (FAR), Privacy Act of 1974 (5 U.S.C. 552a - the Act), Federal Information Security Modernization Act of 2014 (Public Law 107-347) (FISMA).

FIPS. The contractor and all of its respective subcontractors shall follow Federal Information Processing Standards (FIPS), National Institute of Standards and Technology (NIST) standards and guidelines, and other laws, mandates, or executive orders pertaining to the protection of sensitive information and information systems.

OCC Enterprise Cloud Secure Communication Standards. All user-to-cloud service communications must be encrypted with the latest OCC-approved browser protocol.

Secure User-to-Cloud Communications Standards. All user-to-cloud service communications (e.g., via internet) must be encrypted with the latest industry standard browser protocol.

2. General Requirements

Location. Information collected, used, stored, maintained, or otherwise processed by the contractor in the performance of this contract shall be accessed, transferred, stored or processed only within the United States. In addition, the maintenance and support operations of the contractor's technology and information must take place, and originate from, within the United States.

The contractor shall not host any portion of the information, information system, infrastructure, or environment in facilities outside the contiguous United States, Alaska, Hawaii, and other U.S. Territories.

Authorization to Use, Store, or Share Sensitive Information. The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all government data, equipment, etc. by treating the information as sensitive. All information gathered or created under this contract shall be considered as Controlled but Unclassified (CUI) information.

It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets.

Confidentiality. The contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

Deliverables. The deliverables in this contract will be considered CUI and shall not be shared with any other organization without prior written approval from the Contracting Officer’s Representative (COR).

3. Security and Privacy Authorization

FIPS 199 System Security Category - FedRAMP. It is anticipated that the Federal Information Processing Standard (FIPS) 199 system security categorization for the CRA Tool will be FIPS 199: Moderate. Since the [insert cloud solution name] is a public cloud solution, the Federal Risk and Authorization Management Program (FedRAMP) FIPS 199:

Moderate control baseline, which is based on the Federal Information Security Modernization Act of 2014 (FISMA) security and privacy requirements for a FIPS 199:

Moderate impact system, applies to the contractor and the contractor systems supporting these public cloud services.

Authorization Boundary. The contractor shall provide a diagram specific for the OCC, that clearly demarcates the information system authorization boundary and depicts all of its connections and components, including the means for monitoring and controlling communications at the external boundary and at key internal boundaries within the system.

The contractor shall address all components and managed interfaces of the information system authorized for operation (e.g., routers, firewalls). The diagram must include a predominant border drawn around all system components and services included in the authorization boundary.

If there are OCC-specific components (e.g., components developed or customized for the OCC, OCC-hosted components, etc.) and/or other components supporting this solution that are not in the scope of the contractor's existing security documentation, then identify those components in the diagram as well, as part of a separate OCC-specific boundary since those are unique to OCC and shall be part of the OCC-specific security authorization. The diagram must be easy to read and understand. Formal names of components as they are known at the service provider organization in functional specifications, configuration guides, other documents and live configurations shall be named on the diagram and described. The contractor shall provide a key for symbols used.

Customer Responsibilities. The contractor shall provide a detailed list of all customer responsibilities assigned to the OCC, as defined by the vendor and documented in the Customer Responsibilities Matrix (CRM).

For each customer responsibility, the contractor shall identify whether the contractor will be addressing the responsibility under the contract in order to fully meet the requirements specified in this SOW, or whether the responsibility will be assigned to the OCC. Typically, OCC customer responsibilities are minimal and pertain to informing the contractor of new users approved for access, revocations, account reviews, if there are OCC admins – their responsibilities, etc. The contractor shall provide the CRM as directed in the Deliverables section 9.0.

External Service Provider Compliance & Monitoring Background. The FISMA and OMB policies require that federal agencies using external service providers to process, store, or transmit federal information or operate information systems on behalf of the federal government, assure that such systems meet the information security protections commensurate with the information and system sensitivity. Federal agencies are responsible and accountable for the information security risk incurred by the use of information system services provided by external providers.

Such risk is addressed by incorporating the Risk Management Framework (RMF) and security requirements for external information systems and services as part of the terms and conditions of the contracts with external providers. Federal agencies can also require external providers to provide appropriate evidence to demonstrate that they have complied with protecting federal information. Prior to the implementation of the contractor's system or services, the OCC ensures compliance with the RMF by issuing an Authorization to Operate (ATO) or Authorization to Use (ATU), based on its review and analysis of the external provider's security documentation (described in detail in the next section) and assessment of customer (OCC's) security responsibilities.

NIST Special Publication 800-37, as amended, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy.

Non-Federal External Service Provider Security Documentation. Non-federal organizations with primarily non-federal customers have limitations with respect to complying with all federal requirements. As a result, the OCC obtains assurance through other industry standard security reviews, including Statement on Standards for Attestation Engagements (SSAE) No. 18.

a. Statement on Standards for Attestation Engagements (SSAE) No. 18 Requirements. The contractor shall provide the OCC with an SSAE 18 System and Organization Controls (SOC) 2 Type 2 Report on an annual basis for services provided.

b. The preferred coverage period for the report is July 1 through June 30 with a bridge letter covering the three months to September 30.

c. For any gaps in the fiscal year coverage period…