RFQ 2031JW23Q00029_OCC and OTS 401k Plans.pdf

OCC-OTS 401(k) Plans RFQ #2031JW23Q00029 P a g e 1 | 54

Table of Contents

SECTION A – SCHEDULE OF SUPPLIES/SERVICES

SECTION B – CONTINUATION FROM SF-1449

1.0 GENERAL

2.0 CONTRACT LINE ITEM NUMBERS (CLINs)

3.0 BACKGROUND

4.0 DESCRIPTION OF SERVICES AND SUPPLIES

5.0 TRANSITION IN/OUT SUPPORT

6.0 SECTION 508 REQUIREMENTS

7.0 GOVERNMENT FURNISHED INFORMATION, PROPERTY, AND SERVICES ... 18

8.0 DELIVERABLES AND PERFORMANCE STANDARDS

9.0 PLACE OF PERFORMANCE

10.0 PERIOD OF PERFORMANCE

SECTION C – CLAUSES AND OTHER TERMS AND CONDITIONS

1.0 APPLICABLE CLAUSES

DEPARTMENT OF THE TREASURY ACQUISITION REGULATION (DTAR) CLAUSES

OFFICE OF THE COMPTROLLER OF THE CURRENCY (OCC) CLAUSES

2.0 OTHER TERMS AND CONDITIONS

3.0 TYPE OF CONTRACT

4.0 INDEMNIFICATION DISCLAIMER

5.0 INVOICING

SECTION D – CONTRACT DOCUMENTS, EXHIBITS AND/OR ATTACHMENTS

SECTION E – SOLICITATION PROVISIONS, INSTRUCTIONS, AND EVALUATIONS

1.0 APPLICABLE PROVISIONS

Addendum to FAR 52.212-1

2.0 INSTRUCTIONS TO QUOTERS OF COMMERCIAL PRODUCTS AND SERVICES

3.0 EVALUATIONS AND BASIS OF AWARD

OCC-OTS 401(k) Plans RFQ #2031JW23Q00029 P a g e 2 | 54

See the Standard Form (SF) 1449.

SECTION B – CONTINUATION FROM SF-1449

1.0 GENERAL

The Department of Treasury’s Office of the Comptroller of the Currency (OCC), Office of Acquisition

Management on behalf of the OCC’s Office of Human Capital is seeking recordkeeping and trustee services to administer the agency’s two 401(k) plans for OCC and OTS. The solicitation is issued in accordance with FAR 12 for Acquisition of Commercial Products and Commercial Services under FAR

13.5 for establishing a single-award contract. The Government will NOT be restricting this procurement to any specific business class. The Contractor shall, however, be registered in the System for Award

Management (SAM) with the assertion of the North American Industry Classification System (NAICS) code 523150—Investment Banking and Securities Intermediation. The resulting contract shall be for a period not to exceed 10 years (120 months).

2.0 CONTRACT LINE ITEM NUMBERS (CLINs)

The Contractor shall furnish all materials, labor, equipment, and facilities except as specified herein to be furnished by the Government and shall do all that which is necessary or incidental to the satisfactory and timely performance of the requirements.

Services under the current contract for the OCC and OTS 401(k) Plans expire December 31, 2023. Any conversion to a new service provider shall be completed by January 1, 2024.

The Contractor shall furnish all the following items required under a resulting contract at a firm-fixed-price (FFP) and firm-fixed-unit-price (FFUP) basis:

2.1 6-Month Transition and 24 Month Base Period (Month 1 through Month 30)

CLIN Type Task Description Qty Unit/

Amount Unit Price Extended Price

0001 FFUP

OCC 401(K) Plan recordkeeping, administration, investment, and trustee services (ref. RFQ 4.0)

1 NTE

0002 FFUP

OTS 401(K) Plan recordkeeping, administration, investment, and trustee services (ref. RFQ 4.0)

1 NTE

T&M Travel – Reimbursable based on actuals

(ref RFQ 5.1)

1 NTE

0004 FFP Transition In (ref. RFQ 5.0) 6 MO

TOTAL COST FOR BASE PERIOD

SECTION A – SCHEDULE OF SUPPLIES/SERVICES

OCC-OTS 401(k) Plans RFQ #2031JW23Q00029 P a g e 3 | 54

2.2 Option Period One (Month 31 through Month 54)

CLIN Type Task Description Qty Unit/

Amount Unit Price Extended Price

FFUP OCC 401(K) Plan recordkeeping, administration, investment, and trustee services (ref. RFQ 4.0)

1 NTE

FFUP OTS 401(K) Plan recordkeeping, administration, investment, and trustee services (ref. RFQ 4.0)

1 NTE

T&M

Travel – Reimbursable based on actuals

(ref. RFQ 5.1)

1 NTE

TOTAL COST FOR OP1 PERIOD

2.3 Option Period Two (Month 55 through Month 78)

Unit/

Amount Unit Price Extended Price

FFUP OCC 401(K) Plan recordkeeping, administration, investment, and trustee services (ref. RFQ 4.0)

1 NTE

FFUP OTS 401(K) Plan recordkeeping, administration, investment, and trustee services (ref. RFQ 4.0)

1 NTE

TOTAL COST FOR OP2 PERIOD

2.4 Option Period Three (Month 79 through Month 102)

Unit/

Amount Unit Price Extended Price

FFUP OCC 401(K) Plan recordkeeping, administration, investment, and trustee services (ref. RFQ 4.0)

1 NTE

FFUP OTS 401(K) Plan recordkeeping, administration, investment, and trustee services (ref. RFQ 4.0)

1 NTE

TOTAL COST FOR OP3 PERIOD

2.5 Option Period Four (Month 103 through Month 126)

Unit/

Amount Unit Price Extended Price

FFUP OCC 401(K) Plan recordkeeping, administration, investment, and trustee services (ref. RFQ 4.0)

1 NTE

FFUP OTS 401(K) Plan recordkeeping, administration, investment, and trustee services (ref. RFQ 4.0)

OCC-OTS 401(k) Plans RFQ #2031JW23Q00029 P a g e 4 | 54

Unit/

Amount Unit Price Extended Price

1 NTE

4004 FFP Transition Out (ref. RFQ 5.0) 3 MO NSP

TOTAL COST FOR OP4 PERIOD

TOTAL COST FOR ALL PERIOD (BASE + OPTIONS)

Note1: The OCC and OTS 401(k) Plan recordkeeping, administration, investment and trustee services (ref. RFQ 4.0) are to be paid via OCC and OTS 401(k) plan forfeitures to the maximum extent possible. Obligated amounts for CLINs *001 and *002 will be determined by the

Government.

Note2: NSP refers to Not Separately Priced.

Note3: Travel ‘NTE’ refers to maximum or not-to-exceed (NTE) amount payable. Any travel required by OCC, shall be a reimbursable expense subject to the limitations of the U.S. General

Services Administration Federal Travel Regulation (FTR), in accordance with clause 1052.231-

8001, Reimbursement of Travel Costs. If Travel CLINs are NSP, then FTR travel reimbursement does not apply (see Attachment D, Price-Cost Schedule Template, CLIN

0003 on Tab Step 3 – Price Table).

3.0 BACKGROUND

The Office of the Comptroller of the Currency (OCC) is a bureau of the United States Department of

Treasury. The OCC supervises national banks and federal thrifts. Additional information on the OCC may be found here: About | OCC (treas.gov).

OCC is the Plan Sponsor for two 401(k) Plans: 1) the OCC 401(k) Plan, and 2) the Office of Thrift

Supervision (OTS) 401(k) Plan. The OCC established a 401(k) plan for its employees in January 2000.

The Office of Thrift Supervision (OTS) established a 401(k) plan for its employees in October

1989. Both 401(k) Plans are individually-designed plans containing their own plan adoption agreements.

Pursuant to the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank), employees of the OTS were transferred to the OCC, Federal Deposit Insurance Corporation (FDIC) or the Consumer

Financial Protection Bureau (CFPB). As a result of Dodd-Frank, the OCC and the OTS agencies merged, and the OCC assumed responsibility for the OTS 401(k) Plan. Employees who transferred to the OCC, FDIC or CFPB continue participation in the OTS 401(k) Plan. Dodd-Frank also created the Office of

Financial Research (OFR), an independent agency within the Department of Treasury. OFR employees are eligible to participate in the OTS 401(k) Plan of which OFR became a participating employer in

March of 2013.

Thrift Savings Plan (TSP) Participation

Most employees are eligible to participate in the TSP in addition to the employer sponsored 401(k) plans. For purposes of compliance testing, the total employee and employer contributions to the 401(k) and TSP plans combined are subject to the IRS 415 and 403(b) annual limits. Additional information on the TSP may be found here: Home | The Thrift Savings Plan (TSP).

https://www.occ.gov/about/who-we-are/history/1914-1935/1914-1935-the-federal-thrift-charter-is-created.html https://www.occ.treas.gov/about/index-about.html https://www.tsp.gov/

OCC-OTS 401(k) Plans RFQ #2031JW23Q00029 P a g e 5 | 54

OCC and OTS 401(k) Plan Data

See Exhibit A for a summary of OCC and OTS Plan relevant data. See the other Exhibits for additional plan and policy documentation for the OCC and OTS Plans.

The OCC and OTS 401(k) Plan participants may defer up to one hundred percent of adjusted base salary and receive agency matching and non-elective contributions in accordance with the 401(k) plan documents.

OCC and OTS 401(k) Investment Fund Menu

See Exhibit C for the current Investment Policy Statements for both Plans.

The current 401(k) Plans provide employees a diverse mix of investments via mutual funds or collective investment trusts on an open architecture investment platform. The fund menu includes the following asset classes: Fixed Income, Stable Value, International Equity, Domestic Equity (Small, Mid and Large

Cap), Real Estate, Target Date, and Emerging Markets. The fund menus are currently identical for both

Plans.

Both Plans also include a self-directed brokerage account options that allow participants to invest in equities listed on the New York Stock Exchange (NYSE) and National Association of Securities Dealers

Automated Quotations (NASDAQ) market securities.

The 401(k) Oversight Committee determines the fund menus and coordinates overall administration of the Plans.

4.0 DESCRIPTION OF SERVICES AND SUPPLIES

4.1 Scope

The Contractor shall provide recordkeeping, administration, investment, and trustee services for the

401(k) plans in accordance with regulatory requirements, the Plan Documents, OCC policy documents and task descriptions below.

4.2 Tasks

The services under the resulting contract shall include:

▪ Recordkeeping and Administration:

o Plan administration o Regulatory compliance o Plan sponsor reporting o Participant access o Education and communication o System capability o Program and project management o Commitment to quality

▪ Investment and Trustee Services:

o Investment and trustee services provided on an open-architecture investment platform

OCC-OTS 401(k) Plans RFQ #2031JW23Q00029 P a g e 6 | 54

1. Plan Administration –The Contractor shall:

a. Provide plan administration and recordkeeping services based on a sound understanding of how the federal government’s Thrift Savings Plan program interacts with the Agency’s OCC and OTS 401(k) Plans and programs

b. Possess the capability to service two separate plans on a single platform, which shall provide for a:

i. consolidated service teams

ii. consolidated operations team

iii. consistent transparent participant experience

iv. consistent plan sponsor experience

v. consistent plan sponsor reporting mechanism

vi. single plan sponsor website with Cross Functional Administrator access

g. Provide the following Payroll services:

i. Support transmission of data between the Contractor, Government, and payroll provider via Secure FTP (SFTP), email, and on-line web portal

ii. Transmit and process a variety of biweekly payroll files with the payroll provider and Government

iii. Process client participant census files received from the payroll provider and Government based upon agreed upon schedule

iv. Invest contributions same business day upon receiving all client payroll data and associated funds, and notify payroll provider and client of any issue that may impact investing contributions (assumes all client payroll data received “clean” by 3:00 PM ET)

v. Comply with and submit upon resulting Contract the payroll provider

Interconnection Service Agreement (template located in Exhibit E) and any additional connection service agreements required by the Government

vi. Provide “SFTP reverse feed of payroll data” to Government upon request to update payroll system as changes occur.

vii. Allow for transmission of contribution funds (typically biweekly) via check, ACH, wire, or debit from the payroll file to the Contractor

h. Provide the following Account Services:

i. Perform full 401(k) recordkeeping custodial functions to include enrollment, maintenance, and termination of participant accounts

ii. Independently administer, approve, process, and maintain documentation for all participant initiated actions, to include but not limited to:

Transfers/Exchanges, In-service withdrawals, Hardship withdrawals, Loans, Distributions and Rollovers (within or outside of plan)

iv. Provide the following support regarding loans and distributions below:

1. A direct deposit option

2. Capability for separated participants to repay loan balances via check or electronic payment

3. Independently administer Required Minimum Distribution (RMD) process

v. Independently administer and approve Qualified Domestic Relations Order

(QDRO) process

vi. Provide quarterly benefits statements (online or via mail options)

vii. Provide administrative tutorial manual/training on Plan Sponsor website

i. Proved the following forfeiture plan administration services

i. Administer the plan forfeiture accounts, which typically accumulate over time, for both plans (forfeitures occur when the unvested portion of a

OCC-OTS 401(k) Plans RFQ #2031JW23Q00029 P a g e 7 | 54 separated participant’s account balance is forfeited and returns to the plan).

ii. Provide a means to utilize forfeitures via Automated Clearing House

(ACH) or check to pay 401(k) related expenses as determined appropriate by and per the Government’s instruction

2. Regulatory Compliance – The Contractor shall:

a. Provide the following plan compliance testing services:

i. Possess the capability to provide the following testing services (note the plans are not subject to the Employee Retirement Income Act (ERISA), however the plans use ERISA as a guiding principle)

1. Discrimination Testing Actual Deferral Percentage (ADP) / Actual

Contribution Percentage (ACP)

2. Top-Heavy Test

3. 415 combined annual additions testing for the TSP and agency

401(k) plans

4. 402(g) combined elective deferral limit testing for the TSP and agency 401(k) plans

5. Identification of Highly Compensated Employees (HCEs)

6. 410(b) coverage testing

7. 401(a) 17

ii. Address all violations to ensure plans remain qualified and acceptable by the IRS

b. Respond to ad hoc 401(k) data requests in support of annual 401(k) external audit

c. Collaborate with the Government to develop and administer a standard process to aid in locating missing participants (refer to Department of Labor best practices guidance).

d. Satisfy all regulatory reporting and disclosure requirements

e. Provide communications on regulatory and legislative changes impacting plan administration and compliance

f. Provide the following Plan Documents services:

i. Execute Prototype/Volume Submitter plan document elective (non-regulatory) plan amendments, elective (non-regulatory) plan restatements, off-cycle determination letter filings, certain Summary Plan Description customization, plan termination services and other plan document related services

ii. Interpretations of plan document provisions and recommended corrective actions to address non-compliance

3. Plan Sponsor Reporting– The Contractor shall:

a. Provide reports on various intervals to assist in day-to-day plan administration to include but not limited to data on deferrals, loans, distributions, forfeitures, call center performance, plan statics and benchmarking, general plan data and custom reports

b. Provide a Plan Sponsor online platform that allows for the creation of customizable reports, on-demand reporting and real-time plan analytics

c. Provide plan performance data and benchmarks to include but not limited to:

participation rates, asset allocation, loan data, advice utilization, and other key plan performance metrics.

4. Participant Access– The Contractor shall:

https://www.dol.gov/agencies/ebsa/employers-and-advisers/plan-administration-and-compliance/retirement/missing-participants-guidance

OCC-OTS 401(k) Plans RFQ #2031JW23Q00029 P a g e 8 | 54

a. Provide participant services through various channels to include but not limited to:

Interactive Voice Response (IVR), phone customer service representative, participant online platform, and participant mobile application

b. Provide unlimited frequency of account actions to include, but not limited to, beneficiary designation, contribution rate changes, investment election changes, and other general account actions

c. Allow participants to initiate transfers/exchanges, in-service withdrawals, hardship withdrawals, loans, distributions and rollovers (within or outside of plan)

d. Integrate all access channels for a streamlined access experience

e. Provide live customer service representative support 8:00 AM – 7:00 PM Eastern

Time (ET) during normal business days (excluding weekends and federal holidays)

f. Provide a participant online platform and IVR services 24x7

5. Education and Communication – The Contractor shall:

a. Provide a variety of financial and retirement educational services to plan participants through various channels to include virtual, in-person, written, and online

b. Provide professional investment advice and financial planning services by offering

Plan participants a personalized one-on-one advice session with a Financial

Consultant who is experienced in financial planning areas including, estate planning, wealth management, retirement planning, and charitable gift planning

c. Provide industry leading financial education and advice tools to plan participants to include:

i. Retirement progress (i.e., projections of the participant retirement readiness)

ii. Retirement Plan advice (e.g., Morningstar Management, LLC)

iii. Managed account service option for Plan participants (point-in-time advice and fully managed account feature)

d. Provide financial and retirement education content to plan participants on a variety of topics, such as retirement planning, financial wellness, budgeting and saving strategies, basic estate planning, debt management, investment strategies, role of fiduciary and an overview of the 401(k) Plan features; for example: the differences between pre-tax, Roth and after-tax contributions.

e. Provide a collaborative education and communication annual strategic plan, to include but not limited to milestone dates and stated objectives for the year (i.e.:

webinar/seminar topics and frequency, individual consultation availability, new educational tools and enhancements, key participant metrics, etc.) a, to the

Government.

f. Provide data and statistics on the usage rates and effectiveness of the education and communication tools, initiatives, and strategy to the Government

6. System Capabilities– The Contractor shall:

a. Possess all hardware platforms and software systems necessary for investing, trust accounting, recordkeeping and administering defined contribution plans.

b. Provide a daily valuation recordkeeping system

c. Provide the Government with the ability to manage privileged accounts, to include but not limited to, creating privileged accounts, obtaining an audit log of privileged account activities, establishing account access levels, certifying accounts, and removing accounts

d. Provide technology and cybersecurity updates

7. Program and Project Management – The Contractor shall:

OCC-OTS 401(k) Plans RFQ #2031JW23Q00029 P a g e 9 | 54

a. Conduct program and project management activities to support the successful operation of contract performance and plans delivery.

b. Notify the Government of any technical, financial, personnel, or general managerial problems encountered throughout the contract period of performance

c. Conduct the following meetings:

i. Conduct biweekly status meetings with the Government to discuss day-to-day operations of the plans and brief on topics to include but not limited to:

1. Plan compliance testing

2. Ongoing plan participant education and communication activities

3. Pending plan amendments or changes

4. plan related operational items or issues

ii. Participate in a variety of recurring 401(k) committee meetings, to include but not limited to:

1. 401(k) investment subcommittee meetings (quarterly)

2. 401(k) oversight full committee meetings (annually)

3. Brief on topics to include but not limited to:

a) Economic and legislative updates

b) Participant/Plan data statistics

c) Cybersecurity and technology updates

d) Education and communications updates

e) Fund manager presentation (as requested)

f) Fiduciary Training (annually)

9. Investments and Trustee– The Contractor shall:

a. Offer investment services with a full range of investment options covering all asset and share classes to include collective investment trusts, mutual funds (available on open architecture platform) from which the Government may choose for its fund menu.

b. Return all revenue generated from revenue sharing funds to participant accounts

c. Offer a 401(k) self-directed brokerage account option to plan participants with the ability to exclude options, over-the-counter securities, and publicly traded Limited

Partnerships, at a minimum.

d. Monitor investments for ongoing performance, quantitative factors, and for any qualitative issues impacting an investment

e. Provide plan investment options to the Government based on an array of qualitative and quantitative factors

f. Provide investment briefings to the Government: fund performance, benchmarking data, “watchlist” flags, fund manager presentations, ad hoc investment inquiries

g. Provide comprehensive legislative, economic and financial markets analysis and updates to the Government

5.0 TRANSITION IN/OUT SUPPORT

The Contractor shall provide a dedicated transition team to convert the plans, not less than 6 months of contract expiration for transition out, to complete all steps necessary to transition all plan data to achieve successful performance by the end of the incumbent contract. These activities shall include but may not be limited to:

a. Development of written Plan transition and conversion timeline, strategy, and method

OCC-OTS 401(k) Plans RFQ #2031JW23Q00029 P a g e 10 | 54

b. Conversion planning conference calls and meetings

c. Weekly conversion status update calls and audit reporting with the client

d. Submission of all security deliverables and support services per Section 5.3

e. Communication with prior Recordkeeper/Trustee

f. Establishment of participant and plan-level database

g. Establishment of participant account records

h. Transfer of assets and existing participant data

i. Post-conversion conference with client

j. Provide “Relationship Manager” key personnel as part of conversion team for continuity post conversion.

k. Provide all transition support services necessary to facilitate successful transition-out to a

Contractor (as applicable)

5.1 Travel

Contractor participation in most meetings shall be virtual. However, the “Relationship Manager” and

“Investment Services Consultant”, at a minimum, shall be required to meet with the Government in-person at a location specified by the Government approximately one time per year. The location of this meeting may take place at a Government, non-Government or the Contractor’s facility.

When meeting at the Contractor’s facility, the Contractor shall provide a meeting space for Committee and Subcommittee 401K related meetings at no additional cost.

5.2 Relationship Team

The Contractor shall provide a relationship team to the Government consisting of the following positions at a minimum:

TITLE DESCRIPTION

Relationship Manager Responsible for overall day-to-day operations in 401(k) client services management

Investment Services Consultant Responsible for providing consultative guidance on 401(k) investment fund menu, analysis of fund performance and monitoring, fund benchmark comparisons, and overall economic and financial markets analysis

Education & Communication

Consultant

Responsible for establishing the 401(k) communication strategic plan, coordinating education and communication initiatives and previewing participant online enhanced web tools.

Compliance/Regulatory Expert Responsible for facilitating and providing expert guidance on

401(k) plan corrections, testing, regulatory and other compliance related matters

5.3 Security Requirements

A. Compliance with Applicable Laws, Regulations, and Standards

Federal Laws. The contractor and all its respective subcontractors shall always follow and remain compliant with the Federal Acquisition Regulation (FAR), Privacy Act of 1974 (5 U.S.C. 552a - the Act), Federal Information Security Modernization Act of 2014 (Public Law 107-347) (FISMA).

OCC-OTS 401(k) Plans RFQ #2031JW23Q00029 P a g e 11 | 54

In addition, the contractor is responsible for ensuring individuals supporting the OCC are trained in accordance with FAR clause 24.301, “Privacy Training.” The use of any information that is subject to the

Privacy Act will be utilized in full accordance with all rules of conduct as applicable to Privacy Act

Information.

Secure User-to-Cloud Communications Standards. All user-to-cloud service communications (e.g., via internet) must be encrypted with the latest industry standard browser protocol.

NIST SP 800-171. The contractor and its respective subcontractors shall ensure all components of contractor systems and organizations that process, store, and/or transmit OCC Controlled but Unclassified

Information (CUI) or that provide protection for such components comply with the security requirements in NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and

Organizations.

B. General Requirements

Location. Information collected, used, stored, maintained, or otherwise processed by the contractor in the performance of the resulting contract shall be accessed, transferred, stored, or processed only within the

United States. In addition, the maintenance and support operations of the contractor's technology and information must take place, and originate from, within the United States.

The contractor shall not host any portion of the information, information system, infrastructure, or environment in facilities outside the contiguous United States, Alaska, Hawaii, and other U.S.

Territories.

Authorization to Use, Store, or Share Sensitive Information. The contractor shall be responsible for properly protecting all information used, gathered, or developed because of work under the resulting contract. The contractor shall also protect all government data, equipment, etc. by treating the information as sensitive. All information gathered or created under the resulting contract shall be considered as CUI. It is anticipated that this information will be gathered, created, and stored within the primary work location.

If contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets.

Confidentiality. The contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with the resulting contract, which are not public information.

Deliverables. The deliverables in the resulting contract will be considered CUI and shall not be shared with any other organization, except for servicing for OCC requirements, without prior written approval from the COR.

C. Security and Privacy Authorization

Authorization Boundary. The contractor shall provide a security architecture diagram(s) specific for the

OCC, that clearly demarcates the information system authorization boundary and depicts all its connections and components, including the means for monitoring and controlling communications at the external boundary and at key internal boundaries within the system. The contractor shall address all components and managed interfaces of the information system authorized for operation (e.g., routers, firewalls). The diagram must include a predominant border drawn around all system components and services included in the authorization boundary.

OCC-OTS 401(k) Plans RFQ #2031JW23Q00029 P a g e 12 | 54

If there are OCC-specific components (e.g., components developed or customized for the OCC, OCC-hosted components, etc.) and/or other components supporting this solution that are not in the scope of the contractor's existing security documentation, then identify those components in the diagram as well, as part of a separate OCC-specific boundary since those are unique to OCC and shall be part of the OCC-specific security authorization. The diagram must be easy to read and understand. Formal names of components as they are known at the service provider organization in functional specifications, configuration guides, other documents and live configurations shall be named on the diagram and described. The contractor shall provide a key for symbols used.

External Service Provider Compliance & Monitoring Background. The FISMA and Office of

Management and Budget (OMB) policies require that federal agencies using external service providers to process, store, or transmit federal information or operate information systems on behalf of the federal government, assure that such systems meet the information security protections commensurate with the information and system sensitivity. Federal agencies are responsible and accountable for the information security risk incurred using information system services provided by external providers.

Such risk is addressed by incorporating the Risk Management Framework (RMF)and security requirements for external information systems and services as part of the terms and conditions of the contracts with external providers. Federal agencies can also require external providers to provide appropriate evidence to demonstrate that they have complied with protecting federal information. Prior to the implementation of the contractor's system or services, the OCC ensures compliance with the RMF by issuing an Authorization to Operate (ATO) or Authorization to Use (ATU), based on its review and analysis of the external provider's security documentation (described in detail in the next section) and assessment of customer (OCC's) security responsibilities.

NIST Special Publication 800-37, as amended, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy.

Non-Federal External Service Provider Security Documentation. Non-federal organizations with primarily non-federal customers have limitations with respect to complying with all federal requirements.

As a result, the OCC obtains assurance through other industry standard security reviews, including

Statement on Standards for Attestation Engagements (SSAE) No. 18:

1. SSAE No. 18 Requirements. The contractor shall provide the OCC with an SSAE 18

System and Organization Controls (SOC) 2 Type 2 Report on an annual basis for services provided. The Government anticipates FIPS 199 Moderate FedRAMP authorization impact level as the standard for cloud computing security for CUI or SSAE No. 18 SOC2 report.

2. The preferred coverage period for the SOC2 report is July 1 through June 30

3. For any gaps in the coverage period, the OCC will work with the contractor to complete the internal controls assessment by relying on the work performed by the contractor's competent and objective internal audit function per Statement on Auditing Standards No.

128, Using the Work of Internal Auditors.

4. The submission of the results of the SSAE 18 SOC 2 Type 2 Report shall be as instructed per the "Security and Privacy Vendor Deliverables" section.

5. If any portion of standard security objectives (e.g., contingency planning controls, etc.)

were not in the scope of the independent auditors testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2

OCC-OTS 401(k) Plans RFQ #2031JW23Q00029 P a g e 13 | 54 report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

OCC Security Authorization to Use. The determination of whether to issue an OCC security authorization will be made by the OCC based on the identified risks to the OCC's data and operations. These risks include: (1) deficiencies noted in the contractor's most recent SOC 2 Type 2 Report, (2) the gaps identified in the IT security and privacy control assessments performed specific to OCC customer responsibility implementations as designated in the CRM.

D. Configuration Management

Security Configuration Settings. The contractor shall establish and enforce security configuration settings for information technology products employed in the 401k recordkeeper system..

Security Updates and Patches. The contractor shall ensure that the 401k recordkeeper system is properly maintained and monitored, to include immediate response to critical security patches, routine maintenance windows to allow for system updates, and compliance with the defined configuration management and change control processes. All patches and system updates shall be properly tested in a development environment before being implemented in the production environment.

Least Functionality. The contractor shall restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services for information technology products employed in the 401k recordkeeper system.

E. Continuous Monitoring

Compliance Reviews and Audits. The contractor shall permit and support compliance reviews and audits under applicable laws to allow the OCC to meet legal and compliance obligations and shall implement processes that allow visibility into the privacy and security controls employed and their effectiveness. The contractor shall provide the OCC or authorized designated officials with information requested by auditors in a timely manner, consistent with the respective auditor's deadline, in support of security compliance reviews and various annual audits, e.g., FISMA, Financial Statement Audit, A-123, etc.

In addition, the contractor shall provide the OCC or authorized designated officials logical and physical access to the contractor's facilities, installations, technical capabilities, operations, records, and databases pertinent to the resulting contract upon request for these purposes.

To the extent allowed by law, the OCC agrees that 1) any physical audit will be conducted on a mutually agreed upon date and time on no less than seven days prior notice; 2) prior to being granted access to the

Contractor’s records or facilities, each auditor shall execute the Contractor’s required non-disclosure agreement and all information obtained during the course of the audit about the Contractor and its business operations shall be deemed the Contractor's confidential information; 3) each auditor will comply with the Contractor's then current standard access and security policies while present at the

Contractor facilities; 4) the audit rights are strictly limited to pertinent records involving transactions related to the resulting contract, and do not extend to all the Contractor processes and internal procedures;

5) no auditor shall directly access or operate any of the Contractor systems, rather all such access and operation shall be conducted through the Contractor personnel; and 6) no audit will unreasonably interfere with the Contractor's operations.

Annual SOC 2 Type 2 Reviews. As mentioned in Section 5.3 C. "Security and Privacy Authorization," under SSAE 18 requirements, the contractor shall provide the annual SSAE 18 SOC 2 Type 2 report to

OCC-OTS 401(k) Plans RFQ #2031JW23Q00029 P a g e 14 | 54 the OCC for review in support of continuous monitoring activities. If any portion of standard security objectives (e.g., contingency planning controls, etc.) were not in the scope of the independent auditor's testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2 report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

F. Data Protection

Such measures include controls listed in NIST SP 800-171, Protecting Controlled Unclassified

Information in Nonfederal Systems and Organizations, as amended, in the following areas: Access

Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical

Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity.

Data Separation. Unless otherwise directed by the OCC and/or controls are implemented to ensure adequate separation, any storage of data shall be contained within the resources allocated by the contractor to support the OCC and may not be on systems that are shared with other commercial or government clients. If data are housed in a multi-tenant environment, the Contractor shall demonstrate through documentation, diagrams and design how unauthorized access and unintended transfers of information are safeguarded via shared system resources.

General Use of Controlled Unclassified Information (CUI). The contractor shall not use any CUI or CUI subcategories, including, Personally Identifiable Information (PII) or low-sensitivity PII (e.g., E-mail

Groups and Lists), for any purpose other than those activities necessary to the performance of the resulting contract.

Use of PII Specific to the resulting contract's Scope of Work. The scope of work for the resulting contract has specific business driven and functional requirements that involve PII. The contractor, contractor employees, and subcontractors must physically secure PII when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss. PII is no longer needed or required to be retained under applicable government records retention policies, it must be destroyed through means that will make the sensitive PII irretrievable. The contractor shall only use PII obtained under the resulting contract for purposes of the contract and shall not collect or use such information for any other purpose without the prior written approval of the contracting officer. At expiration or termination of the resulting contract, the contractor shall turn over all sensitive PII obtained under the contract that is in its possession to the government.

In accordance with OMB M-17-12 Preparing for and Responding to a Breach of Personally Identifiable

Information, the contractor and subcontractor(s) shall:

1. Properly encrypt PII in accordance with OMB Circular A-130 and standards per the

"Data Encryption" subsection above.

2. Complete regular training on how to identify and report a breach.

3. Maintain capabilities to determine what Federal information was or could have been accessed and by whom, construct a timeline of user activity, determine methods and techniques used to access Federal information, and identify the initial attack vector.

4. Allow for an inspection, investigation, forensic analysis, and any other action necessary to assist with responding to a breach.

OCC-OTS 401(k) Plans RFQ #2031JW23Q00029 P a g e 15 | 54

5. Adhere to notification and reporting requirements specified in Section G. "Incident

Response" to effectively report and manage a suspected or confirmed breach as soon as possible (within 1 hour) and without unreasonable delay, consistent with the OCC's

Incident Response Plan and US-CERT notification guidelines. Please note that a report of a breach shall not, by itself, be interpreted as evidence that the contractor or its subcontractor failed to provide adequate safeguards for PII.

Use of Contractor Equipment. Use of contractor-owned laptops or other equipment (e.g., media storage devices, servers, etc.) to process, transmit, or store OCC information or to access the OCC network or other OCC information resources without OCC's formal approval is prohibited. This restriction does not apply to the use of non-OCC laptops or PCs to use OCC-approved virtual desktop infrastructure to remotely access the OCC network.

Contractor Equipment Approval. To obtain OCC's approval to process, store, or transmit OCC CUI on contractor equipment, the contractor shall provide written assurance (i.e.: as evidenced in SOC or 171 report) of compliance with NIST SP 800-171 (as amended), Protecting Controlled Unclassified

Information in Nonfederal Systems and Organizations, requirements for all contractor system and organization components that will process, store, or transmit OCC CUI.

G. Incident Response

Notification. The contractor must report all information security incidents that potentially or cause the compromise of OCC information, even if the contractor believes the security incident may be limited, small, or insignificant with respect to OCC data or systems. The OCC will determine when the contractor's reported security incident requires additional focus and attention.

Within one hour from the time the contractor validates that an information security incident has occurred, the contractor must report the security incident information to the OCC Cyber Defense Center (CDC):

TBD@occ.treas.gov, (202) XXX-XXXX, regardless of day or time.

The contractor must provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC with the following text in the subject line of the email: “Supplementary

Information/Report related to previously reported incident # [insert number]”

Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive

Information, use FIPS 140-2 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

When notifying the OCC CDC, copy the Contracting Officer if possible or, if reporting by phone or

Contracting Officer's email is not immediately available, contact the Contracting Officer immediately after reporting the incident to the OCC CDC.

Information, System and Tool Availability. The contractor shall make available any information, systems, and tools necessary for the OCC to respond to incidents in a manner consistent with NIST SP 800-61, as amended. In the case of a reported security incident, the contractor shall provide the OCC with access to the contractor's system and/or facilities within 72 hours of the OCC's request.

H. Information Ownership

Government Access. The government will retain unrestricted rights to government data. The OCC retains ownership of any user created/loaded data and deliverables (e.g., documents, applications, custom code, OCC-OTS 401(k) Plans RFQ #2031JW23Q00029 P a g e 16 | 54 diagrams, workflows, data sets, etc.) hosted on contractor's equipment, systems, infrastructure, etc., as well as maintains the right to request full copies of these at any time.

Removal of OCC Data. The contractor acknowledges the OCC's exclusive right of ownership of the information and is required to transfer, return, and/or delete all agency data collected, processed, stored or maintained by the contractor on behalf of OCC upon termination of services (and in accordance with

ERISA requirements for records retention, destruction and disposal), and shall provide written certification and supporting documentation attesting to the transfer, return and/or deletion of agency information or data generated, collected, processed, maintained, or stored by the contractor and any subcontractors, per instructions the "Security and Privacy Vendor Deliverables" section.

Documents and Deliverables. The preliminary and final OCC-specific deliverables and all associated working papers are the property of the U.S. Government. The contractor shall not release any information without the written consent of the Contracting Officer, except for servicing of OCC requirements. All work papers, preliminary and final deliverables must be submitted to the COR at the conclusion of the contract in an acceptable and usable format, which may include the original format.

eDiscovery. The contractor must ensure data preservation requirements (i.e., halt destruction and maintain data the contractor may not otherwise have to maintain) related to litigation holds or other statutory requirements, such as ERISA, are met. The contractor shall also ensure that metadata associated with litigation holds are preserved. Metadata is electronically-stored information that describes the history, tracking, or management of an electronic document. It is created automatically when a user creates, modifies, accesses, or takes other actions with respect to an electronic document.

The contractor shall provide access within a mutually agreed upon timeframe to all government data and government-related data impacting government data for review or scan, or conduct of a forensic evaluation, and physical access to any contractor facility with government data.

I. System Access

Government Right to Terminate Access. The OCC, at its discretion, may suspend or terminate the access to any systems and/or facilities when an information security incident or other electronic access violation, use or misuse issue gives cause for such action. The suspension or termination may last until such time as

OCC determines that the situation has been corrected or no longer exists.

The system shall implement multi-factor authentication for remote users.

K. Supply Chain Risk Management

Background. In accordance with Federal requirements, the OCC requires supply chain entities to implement necessary security safeguards to: (i) reduce the likelihood of unauthorized modifications at each stage in the supply chain; and (ii) protect information systems and information system components, prior to taking delivery of such systems/components. This control also applies to information system services.

Supply Chain Safeguards. The contractor will:

1. Implement security and privacy controls for systems, facilities, and external connections to systems as necessary to ensure compliance with the laws, regulations, standards, and requirements specified in Sections C. Security and Privacy Authorization, F. Data

Protection, and I. System Access.

OCC-OTS 401(k) Plans RFQ #2031JW23Q00029 P a g e 17 | 54

2. Implement personnel screening processes to ensure suitability in accordance with relevant standards and requirements.

3. Use of tamper-evident packaging during shipping/warehousing.

4. Avoid the purchase of custom configurations to reduce the risk of acquiring information systems, components, or products that have been corrupted via supply chain actions targeted at specific organizations.

5. Vet the processes and security practices of subordinate suppliers, critical information system components, and services.

6. Employ a diverse set of suppliers to limit the potential harm from any given supplier in the supply chain.

7. Implement contract language regarding the prohibition of tainted or counterfeit components.

8. Restrict purchases from specific suppliers or countries per requirements issued by the

U.S. Department of Homeland Security (DHS) and/or Federal Acquisition Security

Council, as these requirements pertain to the management of supply chain risk for Federal

Agencies.

9. Use trusted/controlled distribution, delivery, and warehousing options to reduce supply chain risk.

L. Security and Privacy Vendor Deliverables

6.0 SECTION 508 REQUIREMENTS

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-

220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities. As such, the following requirements will apply to a solicitation:

1. Products, platforms, and services delivered as part of this work statement that are ICT, or contain ICT, must conform to the Revised 508 Standards, which are located at 36 C.F.R.

§ 1194.1 & Apps. A,C&D, and available at https://www.access-board.gov/guidelines-and- standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and- guidelines

2. E102 / 702.10 – Web Content Accessibility Guidelines (WCAG) 2.0 guidelines success criteria level A & AA are incorporated as a requirement. The referenced WCAG criteria is available at http://www.w3.org/TR/WCAG20/

3. A completed Accessibility Conformance Report (ACR) found at https://www.itic.org/dotAsset/353efda0-598d-4593-aa53-f4f1f0f61d82.doc, using

Voluntary Product Accessibility Template (VPAT) Revised Section 508 Edition, Version

2.4, is required to assist the Government in determining that the ICT products or services support Section 508 accessibility standards.

4. E202 – No General Exceptions Authorized by OCC.

The following items are identified as containing ICT:

• Software Applications & Operating Systems

• Web-based Intranet and Internet Information and Applications

• Information, Documentation, and Support https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines http://www.w3.org/TR/WCAG20/ https://www.itic.org/dotAsset/353efda0-598d-4593-aa53-f4f1f0f61d82.doc

OCC-OTS 401(k) Plans RFQ #2031JW23Q00029 P a g e 18 | 54

Applicable Functional Performance Criteria:

All functional performance criteria apply when using an alternative design or technology that achieves substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in

Chapters 4-6 of the Revised 508 Standards, or when Chapters 4-6 do not address one or more functions of ICT.

1. Requirements for software and Web products, as applicable:

• E207 – WCAG Level A & AA Success Criteria

• E302 – Functional…