18R0012_FAS_RFP_Final.pdf

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24 & 30

1. REQUISITION NUMBER

5. SOLICITATION NUMBER

60RRBH18R0012

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER 6. SOLICITATION ISSUE

DATE

03/09/2018

7. FOR SOLICITATION INFORMATION

CALL:

a. NAME Richard Ball (richard.ball@rrb.gov)

b. TELEPHONE NUMBER (No collect calls) 312-751-4510

8. OFFER DUE DATE / LOCAL

TIME

04/03/2018 02:00:00

CODE ACQMGMT

U.S. Railroad Retirement Board Acquisition Management 844 N. Rush St.

Chicago, IL 60611

9. ISSUED BY X UNRESTRICTED OR SET ASIDE: % FOR

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS: 541690

SIZE STANDARD: $15,000,000

10. THE ACQUISITION IS

SEE

SCHEDULE

11. DELIVERY FOR FOB DESTINATION

UNLESS BLOCK IS MARKED 0 Days: 0.00 %

0 Days: 0.00 % 0 Days: 0.00 % 0 Days: 0.00 %

12. DISCOUNT TERMS

13a. THIS CONTRACT IS

RATED ORDER UNDER DPAS

13b. RATING

RFQ IFB X RFP

14. METHOD OF SOLICITATION

013CODE15. DELIVER TO

OFFICE OF INSPECTOR GENERAL

US RAILROAD RETIREMENT BOARD

844 N RUSH ST., 4TH FLOOR

CHICAGO, IL 60611

CODE 03916. ADMINISTERED BY

U.S.RAILROAD RETIREMENT BOARD

ACQUISITION MANAGEMENT

844 N. RUSH ST., 9TH FL.

CHICAGO, IL 60611

FACILITY

CODE

CODE

Telephone No.

17a. CONTRACTOR/

OFFEROR

CODE18a. PAYMENT WILL BE MADE BY

OFFICE OF INSPECTOR GENERAL

US RAILROAD RETIREMENT BOARD

844 N RUSH ST., 4TH FLOOR

CHICAGO, IL 60611

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER SEE ADDENDUM

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS

CHECKED

19. ITEM NO. 20. SCHEDULE OF SUPPLIES/SERVICES

(Use Reverse and/or Attach Additional Sheets as Necessary)

21. QUANTITY 22. UNIT 23. UNIT PRICE 24. AMOUNT

See Lines

25. ACCOUNTING AND APPROPRIATION DATA

See Line Item Detail

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

X 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4, FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE X ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4, 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

X 28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN 1 COPIES TO

ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER ALL ITEMS SET FORTH

OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL SHEETS SUBJECT TO THE

TERMS AND CONDITIONS SPECIFIED.

29. AWARD OF CONTRACT: REF. _____________________________ OFFER

DATED _________________ . YOUR OFFER ON SOLICITATION (BLOCK 5)

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH HEREIN,

IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF THE CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 02/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

Document Number: 60RRBH18R0012 PROCESSED Page 1 of 43

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: _________________________________

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

PARTIAL FINAL

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

COMPLETE PARTIAL FINAL

36. PAYMENT 37. CHECK NUMBER

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT 42a. RECEIVED BY (Print)

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 02/2012) BACK

Document Number: 60RRBH18R0012 PROCESSED Page 2 of 43

Table of Contents

Section Description Page Number

I Introduction Background and Objectives

II Schedule of Supplies and Services Contractor Information for Order Administration

III Statement of Work SOW Statement of Work

IV General Terms and Conditions 52.212-3 Offeror Representations and Certifications--Commercial Items (Nov 2017) RRB.A.05 A. General RRB Provision-5.Post award meeting RRB.A.01 A. General RRB Provision-1.Technical Direction RRB.A.07 A. General RRB Provision-7.The Role of Government Personnel and Responsibility for Contract Administration 52.209-5 Certification Regarding Responsibility Matters (Oct 2015) 52.204-9 Personal Identity Verification of Contractor Personnel (Jan 2011) 52.224-1 Privacy Act Notification (Apr 1984) 52.239-1 Privacy and Security Safeguards (AUG 1996) 52.224-2 Privacy Act (Apr 1984) RRB.B.03 B. Security Provisions-3.Additional Security Requirements RRB.B.01 Security Provisions-1 Security Information 52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders--Commercial Items (Nov 2017) 52.252-1 Solicitation Provisions Incorporated by Reference (Feb 1998) 52.216-1 Type of Contract (Apr 1984) 52.232-18 Availability Of Funds (Apr 1984) 52.232-19 Availability Of Funds For The Next Fiscal Year (Apr 1984) 52.217-8 Option to Extend Services (Nov 1999) Audit of Records 52.217-9 Option to Extend the Term of the Contract (Mar 2000) RRB.A.03 A. General RRB Provision-3.Billing RRB.A.06 A. General RRB Provision-6.Notice of Intent to Withhold Payment RRB.A.8 Remittance Address RRB.A.13 Payment and Schedule for Invoices 52.204-13 System for Award Management Maintenance (Oct 2016) 52.233-2 Service of Protest (Sep 2006)

V Proposal Submission Instructions RRB Supplement to FAR 52.212-1 Instructions to Offerors

VI Evaluation and Award RRB Supplement to FAR 52.212-2 Evaluation of Offers

VII List of Attachments

Document Number: 60RRBH18R0012 PROCESSED Page 3 of 43

Section I - Introduction

Background and Objectives

A. Agency Information:

1. The U.S. Railroad Retirement Board (RRB) is an independent agency in the executive branch of the Federal Government. RRB’s primary function is to administer comprehensive retirement, survivor, unemployment and sickness insurance benefit programs for rail-road workers and their families under the Railroad Retirement Act and the Railroad Unemployment Insurance Act. These programs provide income protection during old age in the event of disability, death, temporary unemployment, and sickness. RRB also adminis-ters aspects of the Medicare program and has administrative responsibilities under the Social Security Act and Internal Revenue Code.

2. The Railroad Retirement Board Office of Inspector General (RRB OIG) conducts independent audits, management reviews, and in-vestigations of the programs and operations of the RRB. The RRB OIG provides recommendations for improvement to agency man-agement to promote efficiency and economy, and identifies fraud and abuse in agency programs and operations. The RRB OIG is col-located with RRB’s headquarters in Chicago, IL.

B. Objectives: RRB OIG seeks to procure services to assist with its annual audit of the RRB’s information systems in accordance with the Federal Information Security Modernization Act of 2014 (FISMA), as specified in Sections II and III.

C. Questions pertaining to this solicitation must be submitted in writing and received by this office in sufficient time to allow the timely transmission of written answers by solicitation amendment. To ensure this, the RRB will only answer questions received in this office no later than 2:00 PM, Central Time (CT), 03/16/2018. Questions shall be submitted to proposals@rrb.gov, and the email sub-ject line must reference the RFP number of this solicitation. RRB OIG will not release any sensitive or confidential information prior to contract award.

D. Offers are due no later than 2:00 PM (CT), 04/03/2018, and shall be submitted to proposals@rrb.gov, and the email subject line must reference the RFP number of this solicitation.

E. The RRB estimates the award date of a contract resulting from this solicitation to be 04/18/2018, and expects contract performance to begin immediately upon award.

Section II - Schedule of Supplies and Services

Number Supplies or Services Quantity Unit Unit Price Total ( Inc. disc., tax, and fees)

0001 Administrative Support- Other 1.000000 $

Period of Performance: 04/18/2018 - 12/31/2018

Description: FISMA Audit Services. Offerors shall above enter a firm fixed price to provide Base Year FISMA Audit Services.

See SOW Section III.

Document Number: 60RRBH18R0012 PROCESSED Page 4 of 43

Number Supplies or Services Quantity Unit Unit Price Total ( Inc. disc., tax, and fees)

0002 Administrative Support- Other 1.000000 $

Period of Performance: 03/01/2019 - 12/31/2019

Description: FISMA Audit Services. Offerors shall above enter a firm fixed price to provide Option Year One FISMA Audit Services.

See SOW Section III.

0003 Administrative Support- Other 1.000000 $

Period of Performance: 03/01/2020 - 12/31/2020

Description: FISMA Audit Services. Offerors shall above enter a firm fixed price to provide Option Year Two FISMA Audit Services.

See SOW Section III.

0004 Administrative Support- Other 1.000000 $

Period of Performance: 03/01/2021 - 12/31/2021

Description: FISMA Audit Services. Offerors shall above enter a firm fixed price to provide Option Year Three FISMA Audit Services.

See SOW Section III.

0005 Administrative Support- Other 1.000000 $

Period of Performance: 03/01/2022 - 12/31/2022

Description: FISMA Audit Services. Offerors shall above enter a firm fixed price to provide Option Year Four FISMA Audit Services.

See SOW Section III.

Contractor Information for Order Administration

A. This solicitation provides for both base period services and optional period services, and upon contract award the contractor shall devote efforts to accomplish all base period services as set forth in section III, Statement of Work. The contractor shall not begin per-formance of optional services until the RRB OIG Contracting Officer advises the contractor in writing of the RRB OIG's decision to exercise its option for such services.

B. Offeror must provide Firm-fixed pricing , “fully loaded”, in Section II, in the block entitled Unit Price & Total, Above, for CLINs 0001 thru 0005 to provide the required services, as specified in this solicitation, (see section III, Statement of Work, below).

The RRB describes “fully loaded” as the price inclusive of direct wage, fringe benefits, all overheads, general and administrative (G&A) cost, profit and fees, and all travel and per diem costs, (per current federal per diem rates), for the Contractor’s employees to perform the required services as stated in Section III. Offeror must also complete sections E and F, below.

C. Additional Pricing Information:

1. Contractor shall provide additional pricing information, as an attachment to it' Business Proposal, to include the following price break down for each proposed CLIN's firm-fixed price:

a. Proposed labor skill levels or category,

b. Offered unit pricing per labor skill levels or category,

c. Proposed number of hours for each labor skill levels or category by phase (if appropriate), and

d. Proposed number of staff per labor skill levels or category.

2. The RRB OIG prefers four general payments, per CLIN, following completion of the below SOW tasks. However, Contractors are invited to submit alternate interim payment schedules as an attachment to their proposal.

a. RRB OIG Receipt & Acceptance of Test Plan.

b. At a mutually agreed upon Interim Fieldwork Date, midpoint between Acceptance of Test Plan and after Exit Conference.

c. After Exit Conference.

d. Upon Completion and RRB OIG Acceptance of Annual Contract Period.

D. Unbalanced offers: Offerors are cautioned that any offer may be rejected as nonresponsive if it is materially unbalanced as to prices for the initial and optional services. An offer is considered unbalanced when it is based on prices that are significantly less than cost

Document Number: 60RRBH18R0012 PROCESSED Page 5 of 43 for some work and prices that are significantly overstated for other work.

E. Price quotation is valid thru ______ / ______ 2018. (60 days from the date of offer, unless otherwise stated).

F. CONTRACTOR INFORMATION FOR ORDER ADMINISTRATION.

1. Order Address: ________________________________

2. Business Size: ________________________________

3. Federal Tax Id. No: ________________________________ Submit on an IRS Form W9 with offer.

4. DUNs No: ________________________________

5. Remit Address: ________________________________

6. Authorized Representatives:

Business: Technical:

Name: __________________ ___________________

Phone: __________________ ___________________

Fax: __________________ ___________________

E-Mail: __________________ ___________________

8. System for Award Management (SAM) Completed: Yes [] No [].

* Offeror must be properly registered, including business size annotation, in SAM to be eligible for award of a Federal contract or or-der. (See www.sam.gov) and (FAR 52.204-13, SAM registration and Maintenance).

PERIOD OF PERFORMANCE

ITEM START END

0001 04/18/2018 12/31/2018

0002 03/01/2019 12/31/2019

0003 03/01/2020 12/31/2020

0004 03/01/2021 12/31/2021

0005 03/01/2022 12/31/2022

Section III - Statement of Work

SOW Statement of Work

This Statement of Work (SOW) provides the tasks the Contractor shall perform. When mutually executed for implementation, this SOW becomes contractually binding on the Contractor and the RRB OIG under the terms and conditions of the contract from the con-

Document Number: 60RRBH18R0012 PROCESSED Page 6 of 43 tract award date until the RRB OIG receives the final deliverable.

A. Introduction and Background:

1. FISMA, 44 U.S.C. Chapter 35, requires agencies to develop, document, and implement an agency-wide information security pro-gram that provides security for the information and information systems that support the operations and assets of the agency. All agen-cies must implement FISMA requirements and report annually to the Office of Management and Budget (OMB), Department of Homeland Security (DHS), and Congress on the adequacy and effectiveness of their security programs.

2. FISMA also requires that each agency’s Inspector General (IG), or an independent external auditor as determined by the IG, per-form an independent evaluation of the agency’s information security program and practices to determine their effectiveness.

B. Scope and Objectives:

1. The contractor shall provide all services, personnel, facilities, equipment, and materials necessary to perform the work described by this statement of work. The RRB OIG envisions that the majority of services will be performed offsite.

2. The contractor must conduct a performance audit to provide the RRB OIG with an annual independent evaluation of the RRB’s se-curity program as required by FISMA, for the applicable audit period (fiscal year) in accordance with Generally Accepted Govern-ment Auditing Standards (GAGAS). According to FISMA, the independent evaluation must include;

• testing of the effectiveness of information security policies, procedures, and practices of a representative subset of the agency’s information systems, and

• an assessment of the effectiveness of the information security policies, procedures, and practices of the agency.

3. The audit should include an assessment of the agency’s progress in meeting requirements established by FISMA, follow-up of agency efforts to correct previously identified weaknesses, and consideration of the findings of current year audits, evaluations, and reviews. The audit must also include any additional testing required to permit RRB OIG to respond to specific performance indicators established each year by OMB and DHS. The contractor must document and provide the Contracting Officer’s Representative (COR) the metric evaluations for the FISMA CyberScope report. The RRB OIG must issue the FISMA CyberScope report. The contractor must provide the expertise, technical knowledge, staff support, and other related resources necessary to achieve the objectives of the audit.

4. The Contractor must document and provide the COR with the results of the Contractor’s testing in an annual performance audit re-port that must be issued by RRB OIG.

C. Task Requirements:

1. Testing the Effectiveness of Information Security Policies, Procedures, and Practices of a Representative Subset of RRB’s Informa-tion Systems

a. For each annual period of performance during the contract term, the contractor must

• obtain RRB’s most current system inventory and determine which systems to include in the representative subset of systems for testing;

• design and perform testing to determine the effectiveness of RRB’s individual security programs (policies, procedures, and prac-tices) and overall agency security program; and

• conclude on the effectiveness of RRB’s information security programs individually and as a whole.

b. RRB’s information system environment consists of four systems, each of which has been categorized as a moderate impact system in accordance with standards and guidance promulgated by the National Institute of Standards and Technology (NIST). The informa-tion systems correspond to RRB’s operational activities as follows:

• Agency Enterprise General Information Support, under the direction of the Bureau of Information Services.

• Benefit Payment Operations, under the direction of the Office of Programs.

• Financial Management, under the direction of the Bureau of Fiscal Operations.

• Financial Interchange, under the direction of the Bureau of the Actuary and Research.

c. In addition, the Contractor must perform testing of a representative sample of key network devices, workstations, and mainframe operations that control access to or support processing of RRB’s sensitive data, resources, or information system environment. The Contractor should perform the testing to determine compliance with federal standards and guidelines such as NIST standards, Defense Information Systems Agency Security Technical Implementation Guides, RRB-approved configuration baselines, and industry best practices.

2. Assessing the Effectiveness of RRB’s Information Security Policies, Procedures, and Practices

Document Number: 60RRBH18R0012 PROCESSED Page 7 of 43

a. Each year, to assess the effectiveness of RRB’s information security policies, procedures, and practices, the Contractor must use the FISMA reporting guidance and NIST cybersecurity framework. In fiscal year 2017, the IG FISMA reporting metrics included five cy-bersecurity framework functions and seven information security metric domains.

b. FISMA IG reporting metrics are expected to change annually. The Contractor must answer all questions listed in the annual IG FISMA Reporting Metrics based on audit work performed and security testing and conclude on whether RRB’s information security program is effective and consistent with FISMA requirements and related information security policies, procedures, standards, and guidelines. For the DHS metrics where a maturity model is used, the Contractor must provide comments to explain the rationale for their effectiveness rating and provide comments explaining the rationale for why a metric is rated lower than a Level 4 maturity.

c. For assessing the effectiveness, the Contractor, at a minimum, shall use the following applicable Federal laws, regulations, stand-ards, and guidance:

• FISMA law;

• OMB guidance, including the OMB/DHS annual FISMA IG reporting metrics;

• Standards and guidelines from NIST, including NIST SP 800-53, FIPS 199, and 200; and

• Federal guidance and standards, including the Government Accountability Office Federal Information Systems Control Audit Manual (FISCAM).

d. All work to achieve the audit objectives must be finished and delivered to RRB OIG by September 30, 2018 and December 15, 2018. See the Deliverables and SOW Task Delivery Schedule in this SOW for further information.

D. Audit Requirements:

The Contractor is responsible for developing the audit plan/strategy and other planning documents, performing all audit procedures and testing, preparing audit documentation, documenting audit findings and recommended corrective actions, and preparing an audit report in accordance with GAGAS, FISMA, and other requirements. The Contractor must perform FISMA testing.

The Contractor must identify issues related to testing and develop all elements of a finding for the identified issues. Elements of a finding include statements of the condition, criteria, cause, effect, and recommendations to address cause.

The Contractor must accommodate RRB OIG’s need to meet its oversight requirements under the Inspector General Act of 1978 by taking the appropriate steps to ensure that any work performed by non-Federal auditors complies with the standards established by the Controller General. The Contractor must provide documentation to RRB OIG according to the Deliverables and SOW Task Delivery Schedule defined in this SOW. The specific audit requirements during the three audit phases of Planning, Testing/Fieldwork, and Re-porting are included below.

1. Planning Phase

a. The Contractor must plan the audit to reduce audit risk to an acceptable level. The Contractor must obtain sufficient, appropriate evidence to support all findings and conclusions. The Contractor must plan and perform audit procedures to: (1) obtain an understand-ing of RRB’s FISMA program, and (2) assess significant audit risks. The procedures and the results must be documented and subject to RRB OIG’s review.

b. The Contractor must prepare and submit for RRB OIG’s review and approval an audit plan and strategy that documents the audit steps to be performed to achieve the audit objectives.

c. Prior to performing any testing that requires sampling, the Contractor must provide RRB OIG with the sampling plans for review and approval. Further, the Contractor must provide RRB OIG with documentation supporting its analysis and rationale for selecting the representative subset of RRB systems, key network devices, workstations, and mainframe operations to be selected for testing. The Contractor must not perform any testing before RRB OIG’s review and approval.

d. The Contractor must determine, and submit to the COR for approval within 30 calendar days of award, an audit plan describing what audit procedures and tests are needed to complete FISMA audit requirements, as specified in the annual IG FISMA reporting metrics.

2. Testing/Fieldwork Phase

a. The Contractor should coordinate and schedule key meetings and testing with RRB, ensure timely update of audit documentation to allow proper oversight, and provide final agendas and meeting materials to the COR at least one business day prior to key meetings.

The COR and/or other RRB OIG staff may attend any meetings the Contractor schedules with agency officials. The Contractor should notify the COR of any meetings with RRB officials that did not include the COR.

The Contractor must schedule, conduct, and document in its audit documentation;

Document Number: 60RRBH18R0012 PROCESSED Page 8 of 43

• entrance and exit conference meetings;

• biweekly status meetings with COR regarding the Contractor’s status of completion of audit steps, potential findings, and other relevant information; and

• meetings to communicate significant audit findings, as they are identified, to the COR and RRB’s FISMA representatives and/or senior executives.

b. Biweekly status meetings and meetings to communicate significant audit findings may be held via teleconference. However, all meetings must be documented and include the author, purpose, participants, date, place, time, discussion content, and any conclusions drawn from the discussion.

c. An entrance conference shall be held with RRB officials. The entrance conference provides an opportunity for the Contractor to dis-cuss the audit approach and introduce key staff to RRB OIG and RRB officials. The RRB OIG will schedule this conference.

d. An exit conference must be held at the completion of fieldwork, as indicated in the Deliverables and SOW Task Delivery Schedule.

The COR and responsible RRB officials must attend, as well as RRB OIG officials, as necessary. At this conference the Contractor communicates the findings and recommendations developed during the audit, and participates in discussions with RRB to determine expected concurrence or non-concurrence of recommended actions from RRB officials.

e. During the course of the work, the Contractor should be prepared to discuss with the COR and responsible RRB management mat-ters that come to the Contractor’s attention that could have an impact on the conclusions made during the audit.

f. The Contractor must immediately communicate to the COR all audit issues or concerns, including but not limited to, possible devi-ations from planning documents or the audit timeline.

g. The Contractor’s audit documentation must include the planning documents, as well as all relevant criteria, meeting notes, test res-ults, audit evidence, and other supporting documentation as required by GAGAS.

h. The Contractor must maintain electronic audit documentation using standard Adobe pdf and Microsoft Office products (Word, Ex-cel, PowerPoint), for all audit documentation and supporting documentation. The contractor may instead use TeamMate for audit doc-umentation. Regardless, the Contractor must make all audit documentation available to the COR on a biweekly basis, upon request, or as mutually agreed.

3. Reporting Phase

a. The Contractor must provide the RRB OIG with a draft and final metric evaluation and a draft and final performance audit report based on the results of its audit work. The Contractor must ensure its audit documentation support the content of its evaluation/report.

The entire content of the evaluation/report and any appendices must be cross-referenced to the appropriate supporting audit document-ation. The cross-referencing must include the exact location of supporting documentation within the Contractor’s work paper data-base; referring only to a work paper number will not be sufficient. Prior to final metric evaluation and final performance audit report submissions, the Contractor must perform an independent review to assess whether the testing and documentation support the evalu-ation/report content. The Contractor must provide the COR with proof of this review.

b. The Contractor must provide the COR with the final metric evaluation and notice of findings in accordance with the Deliverables and SOW Task Delivery Schedule in this SOW. The final metric evaluation must include the RRB OIG reporting metrics developed by OMB and DHS, and the Contractor’s responses to these metrics. The responses to the metrics must be based upon the audit work performed by the Contractor. The COR must prepare the FISMA CyberScope report using the Contractor’s final metric evaluation submission.

c. The Contractor must also conduct an exit conference with the COR and RRB FISMA representatives and senior executives in ac-cordance with the Deliverables and SOW Task Delivery Schedule in this SOW.

d. The Contractor will provide the COR a draft performance audit report in accordance with the Deliverables andSOW Task Delivery Schedule in this SOW. The performance audit report must include all appropriate findings identified during the audit, as well as appro-priate recommendations to address them. Each finding must include condition, criteria, cause, effect, and recommendation. The draft reports must also go through the RRB OIG’s internal report review process. The Contractor must address RRB OIG comments from these reviews timely to meet the Delivery Schedule in this SOW. Changes made to the draft performance audit report must also be subject to additional Contractor independent review to ensure the information is adequately supported in the Contractor’s audit docu-mentation.

e. Following the RRB OIG’s review and approval of the draft performance audit report, the Contractor must provide the COR a final performance audit report in accordance with the Deliverables and SOW Task Delivery Schedule in this SOW. The final performance audit report must include a transmittal on the Contractor’s letterhead to the Contracting Officer. RRB OIG must obtain RRB senior ex-ecutive comments and issue the final performance audit report.

Document Number: 60RRBH18R0012 PROCESSED Page 9 of 43

f. The Contractor must not mark any deliverable documents, pages, attachments, or addenda with their company name or proprietary markings, with the exception of a transmittal cover page. The RRB OIG has the right to publish the reports or excerpts on the RRB OIG’s public website, Oversight.gov website, or to prepare a publically available abstract using the Contractor’s final performance audit report. The RRB OIG must determine whether the reports are sensitive in nature and should be issued as Limited Distribution pursuant to 5 U.S.C. § 552.

4. Inspection and Acceptance

a. The COR is responsible for inspection and acceptance of all services, incoming documents, audit documentation, and any other type of information created or used by the Contractor.

b. The COR should provide certification of acceptance of satisfactory services. This certification is contingent upon the Contractor’s performance in accordance with the terms and conditions of the contract.

E. Deliverables and SOW Task Delivery Schedule

All deliverables should be submitted to the COR. In addition to the SOW Task timeline below, the Contractor and COR should co-ordinate biweekly status meetings. All dates are subject to change based on mutual agreement between the Contractor and the COR;

however, two firm deadlines exist. First, the FISMA evaluation results and CyberScope report are expected to be due for DHS and OMB submission each year by October 30. Second, RRB senior executives need at least 10 business days to review and comment on the performance audit report. Any changes to the delivery dates must allow for these two deadlines.

SOW Task Delivery Schedule* Date/Frequency

Draft Project Plan with Approach Within 5 Business Days of Award

Draft Quality Assurance Plan Within 5 Business Days of Award

Final Project Plan with Approach Within 10 Business Days of Award

Final Quality Assurance Plan Within 10 Business Days of Award

Biweekly Status Meetings Every Two Weeks, on Alternate Fridays

Monthly Progress Reports Monthly, On or Before the Fifth of Each Month

Entrance Conference** Approximately 10 Business Days After Award

Audit Procedures and Test Plan Within 30 Calendar Days of Award

Draft Metric Evaluations with Verified Cross-Referencing to Sup-porting Documentation

On or Before September 30, 2018

Notice of Findings with Verified Cross-Referencing to Supporting Documentation

On or Before September 30, 2018

Exit Conference On or Before October 7, 2018

Final Metric Evaluations with Verified Cross-Referencing to Supporting Docu-mentation

On or Before October 15, 2018

Document Number: 60RRBH18R0012 PROCESSED Page 10 of 43

First Draft Performance Audit Report with Verified Cross- Referencing to Supporting Documentation

On or Before October 21, 2018

Second Draft Performance Audit Report with Verified Cross- Referencing to Supporting Documentation***

On or Before November 20, 2018

Final Performance Audit Report with Verified Cross-Referencing to Supporting Documentation

On or Before December 15, 2018

* See section on Task Management for deliverables specific to staffing requirements.

** An entrance conference between the contractor, RRB officials, and RRB OIG will be scheduled by the RRB OIG.

*** A second draft performance audit report with verified cross-referencing to supporting documentation is required if RRB OIG COR requests content change to the first draft performance audit report.

F. Task Management:

The Contractor should provide sufficient management to ensure that tasks are performed efficiently, accurately, on time, and in com-pliance with the requirements of the contract. Specifically, the Contractor should designate a single manager to oversee these tasks and supervise staff assigned.

1. Independence

a. The Contractor must meet the independence standards as defined in GAGAS. The Contractor must identify all staff assigned to the contract throughout the contract period. The Contractor must provide proof that any possible conflict of interest, including past, cur-rent, and potential future conflicts of interest must be divulged. The past performance of staff assigned must be reviewed to ensure no conflict of interest is overlooked.

b. Throughout the contract period, the Contractor must immediately inform the Contracting Officer and COR in writing if the Con-tractor, or any subcontractors if used, is considering, proposing, or has already proposed on any contracts involving the RRB. Failure to maintain independence is a breach of contract. The Contractor should also provide a description of the SOW and period covered, as well as a determination that the award of such contracts would not impair the Contractor’s independence with respect to RRB. The RRB OIG Contracting Officer will determine whether an impaired objectivity organizational conflict of interest exits and if a restric-tion upon future contracting is required.

2. Staffing

a. The Contractor must submit a list of individuals scheduled to work on the audit to the COR within five calendar days after the date of the award. Updated listings of individuals scheduled to work throughout the contract period must also be submitted to the COR.

Submission by email is acceptable.

b. The Contractor must submit to the COR the resume of every individual performing in a critical position of the audit within five working days of their start date on the engagement. The resumes should include professional certifications and advanced degrees, if any, total years of FISMA experience, description of Federal government audit/review experience (including information systems), total years employed by the Contractor, and current security clearance level.

c. Each individual assigned to this audit must submit a signed Statement Concerning External and/or Personal Impairments, Attach-ment 1 (Independence Statement), which states that they are free from personal, external, and organizational impairments to independ-ence, within five working days of their start date. The Contractor must either use the Independence Statement form provided by the COR or obtain approval from the COR to use an alternative form developed by the Contractor. The Contractor agrees to include these requirements in any subcontracts that it may enter into regarding or supporting work under this SOW.

d. The Contractor must submit to the COR the Continuing Professional Education records of every individual assigned to this audit within five working days of their start date on the audit engagement. These records should clearly identify the name of the course and the number of hours that qualify for credit.

e. The Contractor must ensure that each individual assigned to this audit completes all of RRB’s required training courses within three days of their start date for the audit engagement. If their information system/technology access remains active from a prior year, the individual must also complete all of the RRB’s required training courses within three days of the start date of the subsequent audit en-gagement. The required training courses and the criteria for the course are as follows:

• Security Awareness Training.

Document Number: 60RRBH18R0012 PROCESSED Page 11 of 43

• Safeguarding Controlled Unclassified Information Training.

• Records Management Training.

f. The courses are provided by RRB online, generally take less than one day in total to complete, and are free of charge. The COR will monitor compliance via the RRB training system of records. The above list of required RRB training may be adjusted with additional training, as necessary.

g. Each individual assigned to this audit must submit a signed Information Privacy Certification by RRB Contractor, Attachment 2 (Privacy Certification), which states that they have read and understand the contractor safeguarding responsibilities required by the RRB, within five working days of their start date on the audit engagement. The Contractor must follow the RRB’s contractor privacy protocol defined in the Privacy Certification and Administrative Circulars IRM-5 and IRM-15. The Contractor must report to the COR any breach of confidence by any person as soon as a suspected breach is known, and in accordance with the Privacy Certification.

h. Each individual assigned to this effort should submit a Contractor Access Form to the COR within five working days of their start date on the audit engagement. The COR will provide the Contractor Access Form and verify that the information security, privacy, and records management training, and any other training considered mandatory, was completed prior to obtaining RRB physical or lo-gical access. The purpose of this form is to identify the type of physical and logical access to RRB facilities and systems anticipated to be needed by each individual.

i. Each individual assigned to this audit must submit a signed Nondisclosure Agreement, Attachment 3, to the COR within five work-ing days of their start date on the audit engagement. The Contractor must either use the Nondisclosure Agreement form provided by the COR or obtain approval from the COR to use an alternative form developed by the Contractor. The purpose of the form is to pro-tect the data, information, and property of the United States Government. The Contractor’s staff may come in contact with Personally Identifiable Information (PII), and must not disclose such information in the performance of their duties, or any other information deemed confidential to any party outside of the RRB, RRB OIG, or other contractor staff performing the services. All information about RRB’s information system environment and the information security program is confidential. All information is property of the Government of the United States. The Contractor agrees to hold strictly confidential any information relating to information systems and information security to which it may have access to, or awareness of, during the audit.

3. Biweekly Status Meetings and Monthly Progress Reports

a. The Contractor should conduct a biweekly status meeting with the COR on alternate Fridays beginning two weeks after the award.

These status meetings must address the progress toward the audit objectives (completion of audit steps, potential findings, and any is-sues encountered that may delay the Contractor’s progress), and any other relevant information. The Contractor must document the status meetings in the audit documentation.

b. The Contractor should ensure that a monthly progress report is submitted in writing to the COR outlining the expenditures, billings, progress, status, and any problems/ issues encountered in the performance of this SOW. The Contractor shall submit the monthly pro-gress report by the fifth working day of each month.

The monthly progress report must also address at a minimum:

• progress to date, compared with the audit plan and time schedule;

• any issues that could impact the progress or outcome of the Contractor’s work; and

• matters that have come to the Contractor’s attention that could impact the results of the conclusions of the audit objectives.

4. Project Approach, Methodology, and Management Plan

The Contractor must develop a project approach, methodology, and management plan (project management plan) that describes their approach to this SOW. The project management plan should also be used to manage, track and evaluate the Contractor’s performance and should include the control policies and procedures for project administration, execution and tracking. A draft of the project man-agement plan must be submitted with the technical and cost proposals for this SOW and used for technical proposal evaluation. The draft project management plan will also be subject to review. An updated, final project management plan must be provided to the COR following award, and in accordance with the Deliverables and SOW Task Delivery Schedule in this SOW. The updated project management plan will be reviewed and approved by the COR.

5. Quality Control Plan

a. The Contractor must develop and implement a quality assurance plan. A draft must be submitted with the technical proposals for this SOW and used for technical proposal evaluation. The draft quality assurance plan will also be subject to review. An updated, final quality assurance plan must be provided to the COR following award, and in accordance with the Deliverables and SOW Task Deliv-ery Schedule in this SOW. The updated quality assurance plan will be reviewed and approved by the COR.

b. The quality assurance plan should document the process that will verify and validate quality assurance in compliance with the con-

Document Number: 60RRBH18R0012 PROCESSED Page 12 of 43 tract requirements and GAGAS. The quality assurance plan should provide for the monitoring of the quality of the services, work products, and deliverables required under the contract including the processes, procedures, and metrics for assuring quality. The qual-ity assurance plan should also include, at a minimum, a description of the following key activities:

• Establishment of capable processes;

• Monitoring and control of processes and any variation of output;

• Establishment of mechanisms for feedback of field performance;

• Implementation of an effective root cause analysis and corrective action system; and

• Continuous process improvement.

c. During performance of the contract, the Contractor must maintain a quality assurance inspection system that contains documenta-tion of the quality assurance activities performed in accordance with the approved quality assurance plan. The Contractor must main-tain records documenting all corrective actions and process improvements undertaken during contract performance. The records should validate the Contractor’s compliance with the processes contained in the quality assurance plan. All issues identified through quality assurance activities should be described in the Contractor’s Monthly Progress Report. The Contractor must make all quality as-surance records available to the Government.

G. Other Considerations

1. Work Location and Equipment - RRB OIG prefers that the Contractor’s work is performed offsite, although if performed onsite, RRB OIG will provide limited working space in the OIG office in Chicago, IL. RRB OIG will consider various secure options for documentation transfer, including a Contractor-provided portal or VPN access to the Contractor’s network files. The Contractor may also propose other cost-effective options that the Contractor may provide. The Contractor should furnish incidental office supplies ne-cessary to conduct the audit. All document transfers must be secure. Any Government furnished equipment and information is gov-erned by FAR clause 52.245-1, Government Property, and must be returned to the COR within five business days after completion of the project.

2. It is a goal of a contract resulting from this solicitation to minimize travel. Any travel costs associated with performance under the contract shall be included as part of the offeror's firm fixed-price offer to provide the requirements as specified in the SOW. Contract travel must be in compliance with the Federal Travel Regulations.

3. The Contractor, given its technical expertise, should expect that RRB’s information technology environment may change during the contract period and should account for reasonable changes in the environment in its proposal. If such changes require significant addi-tional work beyond that described in this SOW, the Contractor must contact the Contracting Officer prior to commencing any work under such changes. The Government is not responsible for additional costs associated with changes to RRB’s information technology environment unless specifically authorized by the Contracting Officer.

4. The Contractor should expect that laws, regulations, contracts, criteria, and policies affecting FISMA will change during the con-tract period. The Contractor must meet all applicable audit requirements, including any that might arise during the term of this contract from revisions in audit requirements for the Federal Government. If such revisions require significant additional work beyond that de-scribed in this SOW, the Contractor must contact the Contracting Officer prior to commencing any work under such changes. The Government must not be responsible for additional costs associated with revisions/changes to regulations and/or policy unless spe-cifically authorized by the Contracting Officer.

H. Data Rights

No data provided to, or developed by, the Contractor should be used for any other purpose other than to fulfill the SOW. All items, in-cluding any and all supplemental information developed during performance of the SOW become the sole property of the Federal Government. The Contractor must return all items furnished by the Federal Government in the performance of this SOW at the end of the contract or upon the Federal Government’s request. The contractor shall not mark any deliverable documents pages, attachments, or addenda with their company name or proprietary markings, with the exception of a cover page.

Section IV - General Terms and Conditions

52.212-3 Offeror Representations and Certifications--Commercial Items (Nov 2017)

The Offeror shall complete only paragraph (b) of this provision if the Offeror has completed the annual representations and certifica-tion electronically via the System for Award Management (SAM) website located at https://www.sam.gov/portal. If the Offeror has not completed the annual representations and certifications electronically, the Offeror shall complete only paragraphs (c) through (u) of this provision.

Document Number: 60RRBH18R0012 PROCESSED Page 13 of 43

(a) Definitions. As used in this provision--

"Economically disadvantaged women-owned small business (EDWOSB) concern" means a small business concern that is at least 51 percent directly and unconditionally owned by, and the management and daily business operations of which are controlled by, one or more women who are citizens of the United States and who are economically disadvantaged in accordance with 13 CFR part 127. It automatically qualifies as a women-owned small business eligible under the WOSB Program.

"Highest-level owner" means the entity that owns or controls an immediate owner of the offeror, or that owns or controls one or more entities that control an immediate owner of the offeror. No entity owns or exercises control of the highest level owner.

"Immediate owner" means an entity, other than the offeror, that has direct control of the offeror. Indicators of control include, but are not limited to, one or more of the following: ownership or interlocking management, identity of interests among family members, shared facilities and equipment, and the common use of employees.

"Inverted domestic corporation", means a foreign incorporated entity that meets the definition of an inverted domestic corporation un-der 6 U.S.C. 395(b), applied in accordance with the rules and definitions of 6 U.S.C. 395(c).

"Manufactured end product" means any end product in product and service codes (PSCs) 1000-9999, except--

(1) PSC 5510, Lumber and Related Basic Wood Materials;

(2) Product or Service Group (PSG) 87, Agricultural Supplies;

(3) PSG 88, Live Animals;

(4) PSG 89, Subsistence;

(5) PSC 9410, Crude Grades of Plant Materials;

(6) PSC 9430, Miscellaneous Crude Animal Products, Inedible;

(7) PSC 9440, Miscellaneous Crude Agricultural and Forestry Products;

(8) PSC 9610, Ores;

(9) PSC 9620, Minerals, Natural and Synthetic; and

(10) PSC 9630, Additive Metal Materials.

"Place of manufacture" means the place where an end product is assembled out of components, or otherwise made or processed from raw materials into the finished product that is to be provided to the Government. If a product is disassembled and reassembled, the place of reassembly is not the place of manufacture.

"Predecessor" means an entity that is replaced by a successor and includes any predecessors of the predecessor.

"Restricted business operations" means business operations in Sudan that include power production activities, mineral extraction activities, oil-related activities, or the production of military equipment, as those terms are defined in the Sudan Accountability and Divestment Act of 2007 (Pub. L. 110-174). Restricted business operations do not include business operations that the person (as that term is defined in Section 2 of the Sudan Accountability and Divestment Act of 2007) conducting the business can demonstrate--

(1) Are conducted under contract directly and exclusively with the regional government of southern Sudan;

(2) Are conducted pursuant to specific authorization from the Office of Foreign Assets Control in the Department of the Treasury, or are expressly exempted under Federal law from the requirement to be conducted under such authorization;

(3) Consist of providing goods or services to marginalized populations of Sudan;

(4) Consist of providing goods or services to an internationally recognized peacekeeping force or humanitarian organization;

(5) Consist of providing goods or services that are used only to promote health or education; or

(6) Have been voluntarily suspended.

"Sensitive technology"--

Document Number: 60RRBH18R0012 PROCESSED Page 14 of 43

(1) Means hardware, software, telecommunications equipment, or any other technology that is to be used specifically--

(i) To restrict the free flow of unbiased information in Iran; or

(ii) To disrupt, monitor, or otherwise restrict speech of the people of Iran; and

(2) Does not include information or…