74330226R0045 Attachment 1 PWS.pdf

Performance Work Statement 74330226R0045

Global Payroll Service

Part One: Scope of Services

1. General Information

1.1 Background

The American Battle Monuments Commission (ABMC) is an independent agency of the executive branch of the US government, established by legislation in 1923. It maintains military cemeteries and memorials in countries around the world commemorating the US war-dead.

ABMC is staffed by around 575 full-time civilian employees, around 90 of whom are US citizens. The agency employs approximately 420 permanent and 50 temporary/seasonal civilian foreign nationals in the 10 countries where ABMC installations are located – six in Europe (France, Belgium, Italy, Netherlands, United Kingdom and Luxembourg), plus Tunisia, the Philippines, Panama and Mexico.

See Appendix I for the list of covered countries and foreign national employee populations, which range from 300 in France, down to two in Mexico.

The agency is headquartered in Washington, D.C. and has an Overseas office in Paris, France, where HR and finance directorates oversee the administration of foreign nationals, all of whom are directly employed and managed by the agency.

ABMC has a requirement for payroll services for foreign national employees in 7 countries (France, Belgium, Italy, Netherlands, United Kingdom, Luxembourg, and Tunisia). The Philippines, Panama, and Mexico may be added at a later date. Human Resources Information System (HRIS) requirements are covered under a separate solicitation (see 74330226R0044, available at ABMC.gov).

1.2 Special Conditions

Please note that:

• While ABMC is part of the foreign mission of the government of the United States it is not considered an “embassy” and is not exempt from local labor practices.

• ABMC makes payroll and benefits payments directly from the United States Department of the Treasury and generally cannot use the services of a commercial bank to make payments.

See Appendix II for more details. In the exceptional cases where benefits of payments are required to be paid or debited from a bank in the country of service, ABMC will require additional payroll services to act as the intermediary. Currently this is required in France (income tax) and Italy (social security and pension.

• Accounting services are outsourced through a shared service agreement with the US Department of the Interior. This is an Oracle-based accounting system, and the new payroll service provider will be required to provide a balanced GL output file for accounting. (See Appendix III for more details.)

2. Objective The main objective is to deliver an accurate, timely monthly payroll to ABMC foreign national employees that is compliant with both local labor laws and ABMC internal regulations. The second objective is to reduce manual processes and dependency on country‑specific workarounds. The third objective is to provide customer service to ABMC and provide consistent social and legal watch.

3. Scope of services The scope of services for this project covers a typical set of payroll managed services across all 7 countries listed in Appendix I, with the possible future addition of 3 more countries (the Philippines, Panama, Mexico).

These services include:

• Gross to Net Processing

• Pay slips

• U.S. Treasury disbursements

• Inbound & Outbound interfaces

• Legal & Statutory reporting

• Lodgment service to local authorities

• Employee queries

• Year-end preparation

• Year-end report distribution

• Accounting interface

4. Project Timeline ABMC will agree on a timeline with the chosen payroll supplier, in conjunction with the chosen human resources information system supplier that is being selected separately but concurrently.

However, its goal is to select a provider and to go-live by January 2027.

5. Artificial Intelligence Interested Contractors shall provide proposals that are clearly written, technically sound, detailed, and tailored to each element of ABMC’s performance work statement. Contractors shall not simply rephrase or summarize the specific requirements of this solicitation without offering a clear solution.

ABMC acknowledges the evolving role of artificial intelligence (AI) tools in content development.

However, all submitted proposals shall reflect the Contractor’s own understanding, capabilities, and proposed approach. Proposals that are generic, lack relevance, and/or contain AI-generated text drafted without thoughtful human analysis and input will be considered non-responsive.

Contractors shall ensure that proposal submissions are written, reviewed and refined by subject matter experts familiar with ABMC’s specific requirements, and that proposals demonstrate a meaningful grasp of ABMC's mission, constraints, and operating environment.

Part Two: Requirements This section specifies ABMC’s detailed requirements. Please answer all required questions in your proposal using the matrix provided in Attachment 2. Supplementary questions may be addressed during follow-up meetings and are provided here solely for reference.

1. Payroll Service

Required Questions A. Confirm that you provide a comprehensive suite of payroll managed services for the countries listed in this RFP, covering the full payroll cycle including calculation, payment, reporting, and employee service. Indicate where there are gaps in country/service capability.

B. List which human resources information systems your payroll system can interface with, both for receiving timecards and employee data as well as transmitting pay slips.

C. Confirm your ability to generate an International Treasury Services (ITS) file to meet ABMC's requirements as detailed in Appendix III.

D. Confirm your ability to generate a GL output file to meet ABMC's requirements as detailed in Appendix III.

E. With reference to the country list in this RFP, indicate in which countries you provide lodgments services to local government authorities.

F. With reference to the country list in this RFP, indicate in which countries you can disburse payments to local government authorities or insurance companies on ABMC’s behalf.

G. Confirm that you will prepare all the legal and statutory reports for the primary countries listed in this RFP.

H. Confirm that you can provide pay slips for all countries listed in this RFP in 1) electronic, 2) paper, or 3) both formats. For electronic pay slips, describe the online repository including the duration for which the documents are accessible.

I. With reference to the country list in this RFP, indicate in which countries (if any) you engage in a third-party to provide the service on your behalf.

J. Describe the business reporting capability of your proposed service including consolidated reports, standard reports, custom reports, and self-generated reports. Explain the degree of data consolidation you are able to offer. What formats does the system support for reporting exports?

K. Describe how payroll cut off times are determined.

L. Describe your out-of-cycle pay run process - be specific on roles and responsibilities, and cut-off times.

M. If appropriate, provide details of how you manage multiple country payrolls from shared service locations, including the knowledge and qualifications of SSC staff. Also indicate the range of languages your service team can provide support.

N. Describe how your proposed service will support new hires and terminations.

O. Describe your year-end process, including roles and responsibilities and timelines.

P. Describe your process for managing and escalating employee and corporate customer service queries.

Q. Do you provide English language support for and in each country?

R. Provide details of any additional optional services that have not been covered already in your response. (Please include only services that you think may suit ABMC’s business requirements.)

Supplemental Questions A. If you use partners, will all interactions be managed centrally through you or will ABMC deal directly with the partner?

B. If you use partners, provide brief details of your selection process, governance model, and integration policy.

C. If payroll is done by payroll experts in-house, please indicate the profile of such experts and please indicate the list of payroll tasks and documents related to payroll process.

D. Explain to what degree your system can be configured to suit ABMC's specific business requirements (as opposed to being customized).

E. Indicate any known constraints by country to your payroll service including date constraints, gross-ups, and retro calculations.

F. Describe for each of the countries in this RFP how you propose to provide disbursements. Be specific on 3rd party involvement, escalation process, cut-off times, governance, communication channels.

2. Controls and compliance

Required Questions A. Provide details of your legal and statutory change process, with specific details on how you would communicate changes to the client.

B. Can you provide a report itemizing all changes to pay items per employee in an audit log?

C. Describe the encryption standards and methodologies you use to protect your customer data, including during transport, storage and processing.

D. Provide an overview of your data storage, back-up and protection procedures, and record management procedures.

E. Outline your information security policy including compliance with ISO 17799, or any other relevant information security standards.

F. Confirm that you will meet the data protection & privacy laws of each country outlined in this RFP.

G. Outline your Business Continuity Plan for the countries listed in this RFP.

H. Provide a copy of your SSAE16 audit report if you have such an audit.

3. Implementation

Required Questions A. Provide details of your project management approach, including standard project management methodologies used by your team.

B. Outline an indicative implementation timeframe/time range per country, using the countries/employee populations listed in this RFP.

C. Describe your ability to transfer/import personnel and year-to-date payroll data from other payroll services.

Supplemental Questions A. If requested in the selection process, would you be ready to outline the experience of project managers and project team members that you anticipate working on this project, based on the country list in this RFP?

B. Describe your proposed blueprinting/UAT testing/parallel running processes for this project.

C. Describe the transition process between the project team and sustaining (as the project team disengages).

D. Describe the level of training that will be given pre-implementation, during, and post-implementation for Administrators, Managers and Users and on which frequency. Please also confirm in which language.

4. Pricing

Required Questions A. Provide price per monthly pay slip, ongoing costs per cycle (bi-weekly or monthly), and year-end costs for each country in this RFP.

B. Provide the Implementation (including integration) cost per country for your proposed service, to include transferring data from ABMC’s current provider.

C. Provide the price to implement the ITS and GL files as specified in Appendix III and IV.

D. Provide the cost structure used for change requests, for example adding new pay codes, or configuring non-standard reports.

E. Provide the cost structure used for charges for additional services during payroll processing, such as late additions or changes to variable data.

F. Indicate if there is a charge for out-of-cycle pay runs or distribution of year-end forms.

G. Outline all training included as part of the implementation costs and any additional training costs that could be incurred.

H. Outline any other costs that may not have been included in the above questions.

I. Outline any annual increases that may not be included in your ongoing fees, e.g. consumer price index increases.

5. Qualification and Reputation

Required Questions A. Provide appropriate information on your company's funding and financial health.

B. Indicate where your company is headquartered.

C. Provide information on the size of your multinational client base, relevant demographics

(e.g. industry type) and scope of services being provided.

D. Indicate how long you have been providing multi-country payroll services.

E. For each of the countries listed in this RFP, list the countries where you have live clients, and indicate whether employee populations are of a similar size to those outlined in this RFP.

F. Confirm that you are willing to provide the names of at least three clients who are willing to provide a reference for your service.

G. Provide some feedback from current customers regarding customer service satisfaction percentage.

H. How many employees do you have total and per department: sales, operations, services, help desk, integration, IT, legal, etc.

I. Please indicate your company’s annual staff turnover.

6. Governance

Required Questions A. Describe your overall governance model, including communications, escalation, change management, and conflict resolution.

B. Provide details of the proposed account management structure that you will put in place for our relationship. Be specific about the roles and responsibilities.

C. Give details of your performance management, measurements, & review process for both implementation and sustaining. Provide samples of the indicators and measures used.

D. How are manual forms handled in your proposed solution, e.g. court orders, etc.?

7. Technology Note: All Technology questions are required.

A. Data and Interoperability

1. Please describe data structure, supported standards and formats, and export/import formats?

2. Does the system support industry-standard data feeds for personnel and payroll data?

Please list supported feed types and protocols.

3. Which third-party Human Resources Information System (HRIS) vendors do you currently have a "standard" interface with, and which new vendors do you plan to include in your standard product line?

4. Does the system provide auditable data lineage, allowing traceability from source transactions through outbound reporting? Please explain how lineage is tracked and audited.

5. Does the system provide APIs or secure batch interfaces to integrate with:

• HRI systems

• Identity management platforms

• Time and attendance systems

• Reporting tools

• Please describe supported integration methods and security controls.

B. Security Controls

1. Does the system implement role-based and attribute-aware access control? Please describe how roles and attributes are defined and enforced.

2. Does the system require multi-factor authentication (MFA) for both privileged and non-privileged remote access?

3. Does the system enforce least privilege and separation of duties across HR, payroll, and administrative functions? Please provide examples.

4. Is data encrypted in transit and at rest? Please specify encryption standards used.

5. Does the system provide centralized logging, audit trails, and alerting for security-relevant events?

6. Does the system support vulnerability scanning and patch management? Please describe cadence and responsibility.

7. Are secure configuration baselines documented and maintained?

8. Does the system enforce session timeouts and reauthentication controls?

9. Does the system support privileged access monitoring? Please describe monitoring and alerting mechanisms.

10. Does the system provide backup, recovery, and continuity capabilities? Please specify

RTO/RPO options.

11. Are development, test, and production environments segregated?

12. Are all interfaces and APIs secured and authenticated? Please describe authentication methods.

13. Does the system comply with NIST SP 800-63-4 for identity proofing, authentication, and federation?

https://pages.nist.gov/800-63-4/sp800-63.html

C. Zero Trust and Network Access

1. Does the system support a Zero Trust operating model, where access decisions are based on identity, device, session, and context rather than network location? Please describe the model and roadmap.

2. Does the system support modern federation, conditional access, encrypted traffic, and strong segmentation between application tiers and administrative paths?

D. Privacy Controls

1. Does the system incorporate privacy-by-design principles?

2. Does the system support:

• Data minimization

• Purpose limitation

• Field-level visibility restrictions for sensitive data -

Please describe how these are implemented.

3. Does the system support consent and notice handling, where applicable?

4. How does the system facilitate access to information in the context of GDPR or Privacy Act requests?

5. Are disclosures and data sharing events logged?

E. Accessibility

1. Does the system conform to Section 508 (Home | Section508.gov) accessibility requirements, including:

• Keyboard accessibility

• Assistive technology support

• Proper labeling and focus order

• Color-contrast compliance

• Accessible documents and forms

2. Is accessibility testing conducted throughout the software development lifecycle and after major changes?

F. Records Management

1. What is the retention policy applied to payroll records?

2. Does the system support the items below?

• Designation of official record copies

• Metadata preservation

• Retention and disposition controls

• Legal hold capability https://www.section508.gov/

3. Can records be exported in usable, non-proprietary formats?

4. Does the system provide auditability of record changes and destruction events?

5. Does the system support portability to enable transition to a new platform?

6. Are linked artifacts (approvals, attachments, notices) retained with the official record?

7. Does the system support records retention durations required by U.S. federal regulations and longer local-country requirements where applicable?

G. Cloud and Hosting

1. If cloud-hosted, is the system Fedramp (FedRAMP | FedRAMP.gov) certified?

2. Describe how the system meets NIST SP 800-53 rev5 security baseline controls?

3. Is a documented shared-responsibility model provided?

4. Does the system provide tenant isolation?

5. Are disaster recovery objectives contractually defined?

6. Does the system provide data extraction rights upon transition or termination?

H. Workflow and Internal Control

1. Does the system support configurable workflows based on:

• Delegation of authority

• HR servicing office structure

• Supervisory chain

• Legal review requirements

2. Does the system enforce or flag incompatible role combinations and support compensating controls?

I. Application Specifications

1. Do you support custom fields and interfaces? The Agency needs to be able to enter a specific rate of exchange at the time of payroll disbursement. How can the system be customized to accommodate this functionality? Please refer to Appendix II and III.

2. Is the Application User Interface following a Responsive Design?

3. Is the Application supporting Edge, Safari and Chrome browsers?

J. Audit and Traceability

1. Does every payroll transaction include a complete audit trail, showing:

• Who initiated, viewed, modified, approved, rejected, transmitted, or deleted the action

• Timestamps

• Before/after values for key fields

2. Are audit logs tamper-resistant and exportable?

https://www.fedramp.gov/

K. Performance and Service

1. Does the system support 99.9% or better production availability, excluding approved maintenance?

2. Are RTO and RPO targets defined?

3. Are response-time targets defined?

4. Does the system support defined batch processing windows for nightly interfaces?

5. Is the architecture scalable to accommodate growth?

6. Does the system provide monitoring for interface failures and transaction reconciliation?

7. Are release management and regression testing processes documented?

L. Migration and Transition-In

1. Does the solution support:

• Data mapping and cleansing

• Validation and conversion rehearsal

• Document migration

• Parallel testing

• Interface cut-over

2. Does the system preserve legal and audit integrity of historical personnel actions, attachments, and approvals?

M. Transition-Out Requirements

1. How will the contractor support an orderly and secure transition of services, data, documentation, and operational knowledge upon contract expiration or termination?

2. Does the contractor maintain a Transition-Out Plan that can be activated at the client’s direction?

3. Can all client data be exported in complete, usable, and documented formats?

4. Do data exports support the following requirements?

• Use non-proprietary formats

• Include data dictionaries

• Preserve data relationships and referential integrity

• Support bulk export of all records

5. Will tools or scripts required to import data into a successor system be provided?

6. Will complete and up-to-date documentation be provided prior to transition completion?

7. Will structured knowledge transfer be provided to client personnel or a successor contractor?

8. Will full operational support continue until transition is confirmed successful?

9. Will full security and privacy compliance be maintained throughout transition-out?

10. Will a Certificate of Data Destruction be provided after decommissioning?

Appendix I: Country/Employees List

Mandatory Country Employees France 304 Belgium 48 Italy 45 Netherlands 27 England 23 Luxembourg 14 Tunisia 14 Total 475

Option Country Employees Mexico 2 Panama 13 Philippines 63 Total 78

Appendix II: Payment Process As stated in Section 1.2 ABMC makes all payroll and benefits payments directly from the United States Department of the Treasury and cannot use the services of a commercial bank to make payments. Because of this, ABMC may require the payroll vendor to provide bank services in limited circumstances where payments must be withdrawn from a bank account rather than paid directly to an external entity.

In addition, because the Department of the Treasury must convert all payments from USD to local currency prior to disbursement ABMC requires payroll providers to support the following process:

1. At the time pay slips are being previewed, but prior to payment:

a. A payroll authorization file must be generated for each country that reflects payments and accruals in both USD and the local currency, using a standard budget currency exchange rate provided by ABMC.

b. A Gross-to-Net file should be generated for each country that reflects the total expenses in both USD and local currency, using a standard budget currency exchange rate provided by ABMC.

2. After the Gross-to-Nets have been approved, but no sooner than three US business days prior to payment, ABMC will provide a US Treasury disbursing rate for USD to local currency exchange rate for each country. At this time:

a. A payroll authorization file must be generated for each country that reflects payments and accruals in both USD and the local currency, using the US Treasury currency exchange rate provided by ABMC.

b. A Gross-to-Net file must be generated for each country that reflects the total expenses in both USD and local currency, using the US Treasury currency exchange rate provided by ABMC.

c. An “International Treasury Services” (ITS) file must be generated for each country that contains the details of each payment to be processed for that month. These ASCII files must contain data formatted according to the specification document attached below. ABMC will process these files for payment by the Department of the Treasury.

NOTE: The US Treasury announced in January 2026 that, effective 1 November 2026, payments will require an ISO 20022 country code and town name for the beneficiary address and bank address.

We have not yet received updated formatting guidance from Treasury. The below document will be revised once this information is received. See also Attachment 3.

ITS Standard File Format - Advanced R

Appendix III: General Ledger File Process As stated in Section 1.2 ABMC’s accounting services are outsourced through a shared service agreement with the US Department of the Interior Business Center (IBC) in Denver, Colorado. This is an Oracle-based accounting system, and the payroll service provider will be required to provide balanced GL output files for accounting for each country. These ASCII text files must contain data formatted according to the specification document attached below. See also Attachment 4.

GL Specifications.pdf