A14_SOW_DRAFT_1.pdf

IBC - Statement of Work--Printing and Postal Handling Services

Interior Business Center

Statement of Work

Printing and Postal Handling Services

1 CONTENTS

1 Contents

2 Background

3 Objectives

4 Requirement – Printing Services

a. File Transfer

b. Information about current print layout and format

c. Description of paper stock and envelopes

d. Leave and Earnings Statements (LES)

e. W-2s

f. Annual Testing

g. Equipment – Redundancy

h. 1095-C forms

i. 1099 forms

j. Portals

k. Reprints

5 Requirement - Postal Processing Services

a. Address Verification

b. Postal Processing

6 Requirement – Management of Paper Stock

7 Requirement – Courier Services

8 Requirement - W-2 Disaster Recovery (DR) Capability and Testing

a. General Information

b. DR Components

c. Location

d. Data Transfer

e. Testing

f. Proposed: Actual Disaster Schedule Requirements

9 Requirement - Security And Privacy

a. Non-disclosure

b. Contractor Personnel Security and Suitability Requirements

c. Background clearances – Additional Information

d. Personal Identity Verification of Contractor Personnel

e. Background clearances - Billing clarification

f. Legal liability for loss of Personally Identifiable Information (PII)

g. Assessment & Authorization (A&A)

h. Destruction of IBC data

i. Interconnection Security Agreement (ISA)

j. IBC inspection of facilities

k. Data hosting and Access

l. Transportation to USPS

10 Requirement – Phase-In Transition Period

11 Requirement - Quality Control

a. Problem Resolution Point(s) of Contact

12 Requirement – Printing Services/Self Mailer Options

13 Requirement - TSMB Large Volume Printer

14 Facilities and Supplies

15 Government Points Of Contact

16 Place Of Performance

17 Period of Performance

18 Contract Flexibility

19 Subcontracting

20 Scope

21 Acronyms

2 BACKGROUND

The Interior Business Center (IBC) is a component of the Office of the Secretary of the Department of the Interior (DOI). IBC is a Federal Shared Service Center providing several Human Resources (HR) and other services to many Federal Government agencies and other organizations. The IBC’s Albuquerque data center provides hosting, computer resources management, and operational support to IBC’s automated personnel and payroll, financial, and administrative systems. IBC provides services associated with the Federal Personnel and Payroll System (FPPS). FPPS is an integrated, IBM mainframe-hosted personnel and payroll system that interfaces with a number of other Government computer systems. FPPS supports more than 300,000 government personnel in numerous Federal agencies and commissions.

IBC has transitioned printing, postal finishing, and mailing services for Leave and Earning Statements (LES), Form W-2, Wage Statements, 1099-INT and 1099-MISC forms, and Internal Revenue Service (IRS) form 1095-C to an external vendor for processing. The requirements described in this document relate to these printer and postal finishing services, and recovery of those services in an emergency or disaster.

The Internal Revenue Service employer reporting rule: Information Reporting by Applicable Large Employers on Health Insurance Coverage Offered Under Employer-Sponsored Plans. The Rule contains final regulations providing guidance to employers subject to the information reporting requirements under section 6056 of the Internal Revenue Code (Code), enacted by the Affordable Care Act (generally employers with at least 50 full-time employees, including full-time equivalent employees). Section 6056 requires those employers, which includes customers serviced by IBC, to furnish related statements to employees that employees may use to determine whether, for each month of the calendar year, they may claim on their individual tax returns a premium tax credit.

A large employer must furnish statements to employees, to report information about its offers of health coverage to its full-time employees for the calendar year. Final requirements for Form 1095-C include that the form must be printed and mailed to employees by end of January each year.

IBC’s peak print workload derives from output associated with LESs for a biweekly pay cycle and an annual IRS requirement to mail printed Form W-2s to employees. IBC also prints and mails 1099-INT, 1099-MISC, and 1095-C forms in relatively limited quantities each year

3 OBJECTIVES

The primary objectives of this Statement of Work (SOW) are to obtain:

1) Printing services described in this SOW and as mutually agreed to for additional requirements

2) Postal processing for any material requiring mailing, prior to delivery to the Postal Service to obtain maximum printing and postage savings

3) Management of paper stock

4) Courier services – pickup and delivery of pre-sorted self-mailers to a USPS (United States Postal Service) facility gaining the maximum postal discount

5) Disaster recovery capability and testing

6) Assurance of the security of IBC data in electronic form, both in transit and at rest, and in printed form

4 REQUIREMENT – PRINTING SERVICES

The contractor will provide printing services as described. Note: All records must be successfully printed and mailed; there can be no service failures.

a. FILE TRANSFER

IBC will transmit, or make available for retrieval, by secure method described in an Interconnection Security Agreement, and approved by IBC, the files needed to print LESs and W-2s. Offerors should propose a specific method(s) known to work securely in current or recent operations (see Section 4 f., g., i.).

b. INFORMATION ABOUT CURRENT PRINT LAYOUT AND FORMAT

1) LESs are currently sent from an IBM mainframe file in LES layout to a PC with Smartmailer for address validation and print form and then sent directly to a printer.

a. If software such as Smartmailer isn’t used, the form must be provided by some other means.

b. Testing will be required to ensure the formatting is correct.

2) W-2s are currently sent from an IBM mainframe in W-2 layout to the Smartmailer PC for address validation, sent back to the mainframe, and then sent to a Xerox printer where an Elixir form is added.

DJDE/Flash Form.

3) Other formats may be considered. Pre-approval from the Contracting Officer/Contracting Officer Representative ( CO/COR) is necessary.

c. DESCRIPTION OF PAPER STOCK AND ENVELOPES

Alternative 1: Self-mailer:

• IBC prefers W-2s and LESs be printed on 8 ½ x 14” 28 # laser white with Versaseal; with 3/8” vertical perforations on each side.

• Other stock may be considered. Pre-approval from the CO/COR is necessary.

• Note: Changing paper size or characteristics may result in significant changes to IBC application code which may not be acceptable to IBC.

Alternative 2: Fold & Stuff:

• W-2s and LESs can be printed on 8 ½” x 11” or 8 ½” x 14” paper. IBC prefers 8 ½” x 14” to reduce the number of multiple page records.

• Other stock may be considered. Pre-approval from the CO/COR is necessary.

• Note: Changing paper size or characteristics may result in significant changes to IBC application code which may not be acceptable to IBC.

• Envelopes:

o Envelopes must be pre-approved by IBC.

o The current envelope is a security type windowed address and windowed return address.

o Windowed return address is not required (return may be preprinted on the envelope).

o Envelopes have standard preprinted information on the face; which will be provided by IBC.

o IBC will provide a sample of the current envelope on request.

d. LEAVE AND EARNINGS STATEMENTS (LES)

1) The estimated number of LES forms to be printed and mailed biweekly (every other week) is 25,000.

2) There is no limit to the number of records in an LES file.

3) LES file size is usually .1 GB to 3 GB.

4) The quantity will vary as employees opt for electronic delivery (decrease) and IBC brings on new customers (possible increase).

5) An LES will be one page for any format (fold & stuff or self-mailer).

6) A person with multiple LESs or a multiple page LES will receive more than one mailer (one record per mailer).

7) LESs do not have duplex printing.

8) This requirement is based upon the established normal file production window of Wednesday and

Thursday every other week throughout the year.

a. This normal file production window is not absolute and may vary in accordance with

Government holidays and periods of emergency.

b. IBC will provide a January through December calendar of the scheduled file production windows for LESs each year prior to the beginning of the year.

e. W-2S

1) The number of W-2 forms printed and mailed for 2023 was approximately 154,000.

2) This number will vary from year to year as employees opt for electronic delivery (decrease) and IBC brings on new customers (possible increase).

3) IBC can inform the Contractor in November each year what the estimated W-2 count will be (the

Contractor is expected to request this information rather than rely on the Government to provide it).

4) There are typically five (5) W-2 print files ranging in size from .1 GB to 2 GB each. This is one file for each payroll group database. The number and size of the files may vary.

a. These files will typically be completed and sent to the Contractor over the course of one week in early January of each year.

b. Adjustments may be needed in the event of file production or other problems. The Contractor will be given as much notice as possible in such events.

5) Files can be combined for address checking.

6) If an individual W-2 form spans more than one page, each additional page will be a separate mailing.

7) W-2s must be printed and mailed within five (5) business days of file receipt and no later than

January 31 each year.

a. Note: this requirement is met if the form is properly addressed and mailed on or before the

January 31 due date. If the due date falls on a Saturday, Sunday, or legal holiday, mail by the next business day. A business day is any day that is not a Saturday, Sunday, or legal holiday.

8) W-2s have an information page/insert (one sheet, duplex).

a. W-2s would have the information page printed on the back of a secure self-mailer.

b. W-2s can have the information page printed on a separate sheet (duplex) for inserting if fold

& stuff is used.

c. W-2s can have the information page printed on the back of the W-2 (duplex) if fold & stuff is used, if space allows.

f. ANNUAL TESTING

1) IBC and the Contractor will test W-2, 1095-C, and 1099 printing each year to ensure the current year print is properly formatted. Other forms, if added to the contract, may require similar testing.

2) Testing is typically performed in November or December each year; after each year’s formats are received from IRS.

3) Testing will be scheduled at least three weeks in advance whenever possible.

4) Tests will be scheduled in coordination with the Contractor.

5) Changes to LES format could occur at any time during the year. IBC will provide as much notice as possible and will work with the Contractor to ensure any formatting changes are accommodated timely.

g. EQUIPMENT – REDUNDANCY

The Contractor’s technical proposal must document a redundant capacity for printing, and fold & stuff or pressure sealing/folding equipment to ensure timely performance.

h. 1095-C FORMS

1) This form is a new IRS requirement in compliance with the Affordable Care Act.

2) The number of 2023 1095-C forms estimated to require printing and mailing is approximately

267,000.

3) This number will vary from year to year as employees opt for electronic delivery (decrease) and IBC brings on new customers (possible increase).

4) IBC can inform the Contractor in November each year what the estimated 1095-C count will be (the

Contractor is expected to request this information rather than rely on the Government to provide it).

5) IBC anticipates five (5) 1095-C print files ranging in size from .1 GB to 2 GB (expected to be similar size to W-2s but not known at this time). This is one file for each payroll group database.

6) These files will typically be produced and sent to the Contractor over the course of one week in early January of each year.

7) Adjustments may be needed in the event of file production or other problems. The Contractor will be given as much notice as possible in such events.

8) Files can be combined for address checking.

9) An individual 1095-C form will not span more than one page.

10) 1095-Cs must be printed and mailed within ten (10) business days of file receipt and no later than

January 31 each year.

a. Note: this requirement is met if the form is properly addressed and mailed on or before the

January 31 due date. If the due date falls on a Saturday, Sunday, or legal holiday, mail by the next business day. A business day is any day that is not a Saturday, Sunday, or legal holiday.

11) 1095-Cs will have an information page/insert.

a. 1095-Cs would have the information page printed on the back of a secure self-mailer.

b. 1095-Cs can have the information page printed on a separate sheet (duplex) for inserting if fold & stuff is used.

c. 1095-Cs can have the information page printed on the back (duplex) if fold & stuff is used if space allows.

i. 1099 FORMS

1) The number of 1099 forms printed and mailed for 2023 was approximately 1,324.

a. There are two 1099 forms: 1099-INT (about 100) and 1099-MISC.

2) This number may vary from year to year.

3) IBC can inform the Contractor in November each year what the estimated 1099 count will be (the

Contractor is expected to request this information rather than rely on the Government to provide it).

4) There are typically four print files

a. One file for 1099-INT print and mail, and one file for 1099-MISC print and mail

b. One file of each for print and mail in bulk to IBC, Payroll Operations Division.

i. This requirement may be accomplished by use of the Contractor’s electronic portal, as mutually agreed to.

c. These files will be sent to the Contractor over the course of one week in early January of each year.

d. Adjustments may be needed in the event of file production or other problems. The Contractor will be given as much notice as possible in such events.

5) Files can be combined for address checking.

6) 1099s will have printing on the back of a self-mailer page.

7) If an individual 1099 form spans more than one page, each additional page will be a separate mailing.

8) 1099s must be printed and mailed within ten (10) business days of file receipt and no later than

January 31 each year.

a. Note: this requirement is met if the form is properly addressed and mailed on or before the

January 31 due date. If the due date falls on a Saturday, Sunday, or legal holiday, mail by the next business day. A business day is any day that is not a Saturday, Sunday, or legal holiday.

9) 1099s do not have an information page/insert.

10) 1099s can be fold & stuff if a self-mailer is not cost effective for this quantity. However, IBC prefers all print and mail documents to be self-mailer once that format can be implemented.

11) IBC understands the Contractor, depending on timing, may not be able to combine 1099s with other mailings for maximum postage discounts.

j. PORTALS

The Contractor will provide as requested and agreed to:

1) An EDocuments secure portal (User Portal) used to make forms and test documents available (e.g., for IBC review and approval of print format). The Contractor would provide exact image duplicates of print and mail documents and make those available for online retrieval through approved secure access. This is an online portal with IP restriction rules, in addition to IBC-controlled userIDs and passwords and authentication logging, as agreed to and in accordance with IBC logging requirements.

2) A Download Portal providing indexed documents based on available search fields to retrieve, review, print and/or save items as needed. The portal functionality will allow for archiving based on IBC requirements, for retention periods as mutually agreed to. As requested, the Download Portal will include a complete download file of any IBC print files, in PDF or other mutually agreed to file format.

k. REPRINTS

1) Individual records where the W-2 or LES is not successfully printed and prepared for mailing, for any reason, will be reported to IBC (See Section 12 for POCs).

2) IBC will send a new file containing only those records, for reprinting.

3) The Contractor will report all such records to IBC within two hours of the end of a print run. This time frame is negotiable.

4) The Contractor is responsible for reprinting, processing, and delivery of any damaged materials.

5) Reprinted records and associated processing costs are not billable to the Government.

5 REQUIREMENT - POSTAL PROCESSING SERVICES

a. ADDRESS VERIFICATION

The Contractor will provide:

(1) Address verification using SmartMailer, PostalSoft, or another software/alternative approved by USPS.

(2) IBC with an output file of bad addresses within three (3) days of receiving the print files from IBC.

• The bad address file(s) will include a reason each address did not meet USPS edits.

• A similar process must be in place for any form of postal pre-sort operation proposed so that IBC can reduce the number of bad addresses in the source application.

(3) A specific exception to the statement “Important: The Contractor will not make any changes to data provided by IBC” is hereby incorporated to allow changes made by the CASS address validation requirements described in Section 5.b.

(4) The Contractor will print and mail, as requested, notification letters to employees where the address in the IBC data files is reported as inaccurate through CASS validation or where the employee has a move notice on file as determined by an NCOA check.

• IBC will work with the Contractor on the content of the notification letters. IBC will have final approval of the content.

(5) The Contractor will return any record with a foreign address to IBC for handling. Format will be as mutually agreed to.

IMPORTANT: THE CONTRACTOR WILL NOT MAKE ANY CHANGES TO DATA PROVIDED BY IBC.

b. POSTAL PROCESSING

The following requirements are based on current IBC practices. Offerors may propose alternatives in their Technical Proposals. Alternatives must provide assurance IBC is obtaining maximum postal discounts possible and that mailings have been received by USPS.

The Contractor will:

1) Provide zip code sorting and postal hygiene processing enabling IBC to obtain postage savings consistent with the USPS “AUTO”, or better, postage discounts

2) Be Coding Accuracy Support System (CASS) certified a minimum of every six months

3) Be capable of generating a Presort Accuracy Validation and Evaluation (PAVE) system or equivalent report

4) Apply presort CASS certification with the sortation report, delivery point bar-coding for automation, and use the PAVE reporting system or other reporting system accepted by USPS.

5) Pass all USPS audits with a 95% accuracy rate.

6) Provide a copy of the following USPS forms to the COR and/or designee(s) within one business day

(Monday through Friday, 7:30am to 4:00pm) after the LES/W-2s have been processed and delivered to the General Mail Facility (GMF).

a. PS Form 3600-FCM1

b. PS Form 3600-FCM3

c. PS Form 3553

• Email is an acceptable method of delivery.

• The Contractor must retain copies until the contract terminates.

6 REQUIREMENT – MANAGEMENT OF PAPER STOCK

1) Provide management of paper stock. Envelopes are a part of Paper Stock, if used.

2) Be responsible for the ordering, payment, interim storage, and quality assurance for paper stock.

3) Provide samples of paper stock and envelopes and obtain IBC approval before an initial order is placed.

Information about paper stock quantities can be found in Section 3.

7 REQUIREMENT – COURIER SERVICES

1) Transport all mailings to the Bulk Mail Entry Unit (BMEU) at a USPS GMF in a covered and secured vehicle, protected from weather, and from theft or destruction. Vehicle must be securely locked or always attended when transporting IBC materials.

a. Mailings will be transported to USPS within thirty-six (36) business hours following receipt of a file(s). IBC will be notified of any exceptions within one day (Section 12 – Print and Data POC).

b. Exceptions do not include reprinting but the delivery requirement holds.

2) Be responsible for ordering, receiving, and stocking of all mail supplies needed for transportation of mailings to USPS (tray racks, cardboard trays etc.)

3) Be responsible for remaining at GMF through the completion of the USPS test and acceptance period, and to receive and maintain the acceptance receipt.

4) Deliver the required mailing documentation to the POC for Paper Stock and Delivery (Section 12) the following day by email.

5) Provide transport and delivery from the Output Services print location to IBC’s Lakewood, CO, location at One Denver Federal Center, Building 48, Lakewood, CO 80225.

a. Such delivery is on an as-needed, as-requested basis.

b. Delivery services will be in accordance with the Contractor’s normal commercial delivery service offerings. IBC is not requesting the Contractor establish a delivery service to satisfy IBC requirements.

c. Delivery service may be satisfied by same day or overnight USPS or similar delivery service, as mutually agreed to.

d. Delivery service may be satisfied by use of the Contractor’s Internet portal service, as mutually agreed to.

Detailed procedures and processes will be developed during a testing period. These procedures may vary somewhat from that described above but will not otherwise change the scope or nature of the service.

8 REQUIREMENT - DISASTER RECOVERY (DR) CAPABILITY AND TESTING

IMPORTANT: The DR capability is for W-2, 1095-C, and 1099 processing, which occurs in January each year.

Other documents or forms may be added by mutual agreement.

a. GENERAL INFORMATION

1) Offerors must describe their DR capability in their Technical Proposal.

2) Offerors must identify DR pricing separately in their Price Proposal.

a. IBC understands DR pricing may need to be adjusted as a full DR Plan is agreed to during the period of performance of this contract.

3) Within thirty (30) days of contract award, the Contractor will provide IBC with written Disaster Declaration Procedures detailing the IBC actions necessary to ensure printing and mailing services in a disaster.

4) IBC and the Contractor will work proactively to ensure a full disaster recovery (DR) capability is in place.

5) IBC will provide files at the time of a disaster declaration as agreed to with the Contractor.

6) The Contractor will work with IBC to ensure all necessary approvals, forms, payments, etc. are completed to allow for mailing from the Contractor’s DR facility Post Office.

7) The Contractor will provide any associated Terms & Conditions in its technical proposal.

b. DR COMPONENTS

There are two components to the DR capability:

1) Disaster at IBC’s FPPS hosting location. This involves IBC’s capability to securely transfer files from IBC’s alternate FPPS hosting location.

2) Disaster at the Contractor’s printing and postal preparation location. This involves the Contractor’s capability to securely receive files, safeguard and destroy data, and perform printing, postal preparation and mailing from an alternate service facility.

c. LOCATION

1) The Contractor must identify, prepare, and maintain, either directly or through a subcontract, a continuity facility(s) capable of handling IBC’s printing and mailing in January of each year.

2) The DR location must be sited where potential disruption to the Contractor’s ability to complete printing and mailing operations is minimized and must be based on a formal risk assessment.

a. The continuity facility must be a sufficient distance from the primary operating location, threatened area, and/or other potential sources of disruption, based on the risk assessment and as judged by the Contractor.

3) The Contractor must review the alternate facility annually to ensure the facility continues to meet DR capability and location requirements.

4) IBC’s current location is One Denver Federal Center, Building 48, Lakewood, CO 80225.

d. DATA TRANSFER

IBC currently generates DR print image data and sends the data through SFTP (Secure File Transfer Protocol) from IBC’s DR Data Center in Metacode format. The Contractor’s proposal should describe the type of format desired given consideration that data will be coming from an IBM mainframe. This process may change in the future if IBC is able to send files from another source.

e. TESTING

1) Testing at IBC’s alternate hosting site typically occurs in September/October each year (#7. b.1 above).

a. IBC will send a test file from its alternate location to the Contractor’s primary location.

b. This testing will be scheduled at least eight weeks in advance and is typically for 4 to 6 hours of test time per test.

2) Testing of the Contractor’s DR capability is typically performed in November or December each year;

after each year’s format is received from IRS (#7. b.2 above).

a. IBC will send at least one test file from IBC’s primary location to the Contractor’s alternate location.

b. This testing will be scheduled at least eight weeks in advance and is typically for 4 to 6 hours of test time per test.

3) Tests will be scheduled in coordination with the Contractor.

f. PROPOSED: ACTUAL DISASTER SCHEDULE REQUIREMENTS

• In a disaster, IBC will deliver Data Files no later than midnight on January 26th.

• The Contractor is responsible for obtaining paper stock, envelopes, and any other materials required.

The materials must be available by 4pm on January 26th or the last weekday that falls prior to the weekend of the 26th.

• If absolutely necessary, IBC can request a 30-day delay from IRS. This would move the mailing deadline to February 28. The Contractor’s DR planning should not be based on an approved delay.

9 REQUIREMENT - SECURITY AND PRIVACY

a. NON-DISCLOSURE

All Contractor personnel who may have access to IBC data will sign a non-disclosure agreement. The IBC considers information obtained and used as part of these services to generally be Controlled Unclassified Information. The Contractor will take all reasonable precautions not to divulge sensitive information about IBC or its clients or to use this information for the Contractor’s gain and will not divulge any such information to any other organization (outside the IBC) without written permission from the IBC.

All Contractor personnel will be subject to IBC security policies and procedures for access to facilities and parking. All Contractor personnel requiring access to the Internet from the IBC facilities will comply with IBC security policies and procedures.

b. CONTRACTOR PERSONNEL SECURITY AND SUITABILITY REQUIREMENTS

The work performed under this contract will only be accomplished by individuals (in the employment of the Contractor or any Subcontractors) whose conduct is consistent with a Federal employee with like security levels, the requirements of this contract, and is acceptable to the Contracting Officer (CO).

The risk/sensitivity level designation of the activities performed under this contract is Moderate Risk.

Work under the contract will require contractor personnel to have a Federal government-issued personal identification card (PIV Card) before being allowed unsupervised access to a DOI facility and/or information system. Cards are issued after successfully completing the required background clearance as described below. The Contracting Officer’s Representative (COR) will be the sponsoring official for obtaining PIV Cards and will make the arrangements for personal identity verification and card issuance, if needed.

Background investigations will be performed by the Office of Personnel Management (OPM) unless otherwise specified by OPM. The Government will bear the cost of the background investigations.

Before starting work under this contract, a National Agency Check (NAC) will be conducted to verify the identity and other aspects of the background of the individual applying for clearance. Upon successful completion of the NAC process, an identification card can be issued and access granted, as required.

Simultaneously, a NAC with Inquiries (NACI) will be initiated to determine the individual’s suitability for the position. This process will complete the full background investigation and may take six months or longer. If the NACI adjudication is favorable, nothing more needs to be done. If the adjudication is unfavorable, the credentials will be revoked and the individual will not be allowed to continue work under the contract. In the event of a disagreement between the Contractor and the Government concerning the suitability of an individual to perform work under this contract, DOI shall have the right of final determination.

At least two weeks before the start of contract performance, the Contractor will identify all contractor and subcontractor personnel who will require physical and/or logical access for performance of work under this contract. The Contractor must make their personnel available at the place and time specified by the COR to initiate screening and background investigations. The following forms, or their equivalent, may be used to initiate the credentialing process (required for NAC as well as the ensuing NACI):

• OPM Standard Form 85 or 85P

• OF 306

• Fingerprint card (local procedures may require the fingerprinting to be done at a police station; in this case, any charges are to be borne by the contractor.)

• Release to Obtain Credit Information

• Personal Identity Verification (PIV) card application (web-based)

Contractor employees are required to give, and to authorize others to give, full, frank, and truthful answers to relevant and material questions needed to reach a suitability determination. Refusal or failure to furnish or authorize provision of information may constitute grounds for denial or revocation of credentials.

Government personnel may contact the contractor personnel being screened or investigated in person, by telephone or in writing, and the Contractor agrees to make them available for such contact.

Alternatively, if an individual has already been credentialed by another agency through OPM, and that credential has not yet expired, further investigation may not be necessary. Provide the COR with documentation that supports the individual’s status.

During performance of the contract, the Contractor will keep the COR apprised of changes in personnel to ensure that performance is not delayed by compliance with credentialing processes. Cards that have been lost, damaged, or stolen must be reported to the COR and Issuing Office within 24 hours. Replacement will be at the contractor’s expense. If reissuance of expired credentials is needed, it will be coordinated through the COR.

At the end of contract performance, or when a contractor employee is no longer working under this contract, the Contractor will ensure that all identification cards are returned to the COR.

This requirement must be incorporated into any subcontracts that require subcontractor personnel to have routine and regular unsupervised access to a Federally controlled facility for more than 180 calendar days or unsupervised access to a Federally controlled Level 3 or 4 information system.

c. BACKGROUND CLEARANCES – ADDITIONAL INFORMATION

Contractor staff with the ability to view IBC data will be required to complete a Moderate Background Investigation which is also referred to herein as a NACI. Staff will be able to work with IBC data once the NAC initial check is completed; usually in two weeks or less. As noted above, the full background check (NACI) can then take months longer.

d. PERSONAL IDENTITY VERIFICATION OF CONTRACTOR PERSONNEL

(a) The Contractor will comply with agency PIV procedures identified in the contract that implements HSPD- 12, Office of Management and Budget (OMB) guidance M-05-24, and Federal Information Processing Standards Publication (FIPS PUB) Number 201.

(b) The Contractor shall insert this clause (FAR 52.204-9 PIV of Contractor Personnel) in all subcontracts when the subcontractor is required to have physical access to a federally controlled facility or access to a Federal information system.

e. BACKGROUND CLEARANCES - BILLING CLARIFICATION

Time spent by any individual, Contractor employee or otherwise, to complete the forms and any other paperwork required by the Government to process background clearances, or for the purpose of obtaining required fingerprints, is not billable to the Government. Time spent by any individual to participate in interviews conducted by OPM, or its designees, for the purpose of completing background investigations is not billable to the Government. The Government considers these costs to be overhead and estimates that between 3 and 10 hours may be required on the part of an individual to complete background clearance processing.

f. LEGAL LIABILITY FOR LOSS OF PERSONALLY IDENTIFIABLE INFORMATION (PII)

FPPS is a System of Records as defined under the Privacy Act (Privacy Act of 1974, 5 U.S.C. § 552a (2000)). 48 CFR 1452.224.1 outlines the prescription for FAR 52.224-1: Privacy Act Notification. The Contractor’s liability for loss of PII is described in FAR 52.224-02 Privacy Act which will be incorporated into this contract.

This section of the SOW emphasizes that the Contractor will agree to—

(1) Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies--

(i) The systems of records; and

(ii) The design, development, or operation work that the contractor is to perform;

(2) Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records that is subject to the Act; and

(3) Include this clause, including this subparagraph (3), in all subcontracts awarded under this contract which requires the design, development, or operation of such a system of records.

(a) In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of records on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency.

(a)(1) "Operation of a system of records," as used in this clause, means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemination of records.

(a)(2) "Record," as used in this clause, means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and that contains the person's name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voiceprint or a photograph.

(a)(3) "System of records on individuals," as used in this clause, means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

g. ASSESSMENT & AUTHORIZATION (A&A)

The Contractor will either have a valid Authority to Operate (ATO) issued from another Federal Agency or will be required to participate in an Assessment & Authorization performed by a DOI-approved assessor and must be formally approved by the DOI FPPS Authorizing Official (AO) prior to allowing FPPS data to be processed by the Contractor. It is estimated this process will take approximately 3 to 6 months depending on the time it takes to obtain a new DOI-ATO if required.

DOI requires that the Contractor follow the ongoing authorization process and associated continuous monitoring requirements as prescribed by the Office of Management and Budget (OMB) and the National Institute of Standards and Technology (NIST). The Contractor will participate in assessments as to the effectiveness of required controls on an ongoing basis to inform the AO’s decisions regarding the continued use and operation of a system where FPPS data is located.

• The Government will bear the cost of the Assessment & Authorization, if required (i.e., if an ATO has not already been issued by another Federal Agency).

• Price Proposals should include estimated hours, labor category and rate for any Contractor personnel required for the A&A process. Billing will be Labor Hour.

The Contractor must follow all relevant NIST FIPS Publications and Special Publications (SP) to include, but not limited to, FIPS Publications 199 and 200, SP 800-39, 800-37, 800-137, 800-60, 800-53, 800-53A, 800-34, 800-30, and 800-18. The Contractor must also comply with all DOI IT security and privacy policies and standards including, but not limited to, Departmental Manual (375DM19); DOI Security Control Standards (SCS), including the eighteen security control family standards; and the DOI Privacy Impact Assessment (PIA) requirements and associated templates.

The Contractor will be required to ensure compliance with the security control requirements of the current version of NIST SP 800-53 rev 5, which are applicable to the security categorization of the data or system.

FIPS 199 and the NIST SP 800-60 rev 2 will be used to determine information types and security categorizations. FPPS data has been determined to have a Moderate classification. The Contractor must have a robust security architecture to protect the Confidentiality, Integrity, and Availability of the FPPS data contained within their system. This architecture shall include, but are not limited to, items such as, packet-filtering firewalls, intrusion detection/prevention systems (IDS/IPS), security technical implementation guides for the secure installation of operating systems and applications, anti-virus/anti-malware, patch management, configuration and change management, and other tools, techniques, policies, procedures, and processes to secure the environment.

All Contractor systems which have connectivity to the location of FPPS data (network perimeter in) must be scanned monthly with a vulnerability analysis tool that is comparable with the software in use by DOI at the time. All “safe” or “non-destructive” checks must be turned on. An electronic copy of each report and session data will be provided to the COR or designee. At least annually, all high and moderate risk impact systems and systems accessible from the Internet must be independently penetration tested. Electronic and hard copy reports of penetration test results will be provided to the COR or designee. The Government reserves the right to conduct unannounced and prearranged independent vulnerability scans using government personnel or another contractor. The Contractor will take appropriate and timely action to correct or mitigate weaknesses discovered during such testing, generally at no additional cost to the Government.

h. DESTRUCTION OF IBC DATA

1. The Contractor will destroy all IBC data within 5 calendar days of receipt unless otherwise approved by the CO or COR.

2. The Contractor will sanitize any information system media containing IBC data in accordance with applicable organizational and/or federal standards and policies by using an approved disk wipe utility.

• The utility must be approved by DOI IT Security personnel prior to receiving IBC data.

• Refer to NIST Special Publication 800-53 Rev 5 for additional guidance.

3. The Contractor will maintain a log of all IBC data files showing, at a minimum, date received, date printed, date to USPS, date destroyed.

• The log will show evidence of regular management review.

• The log will be retained through the end of the final year of the contract including any option years.

• The Contractor will send the COR a copy of the log by the 5th day of each month.

i. INTERCONNECTION SECURITY AGREEMENT (ISA)

Contractor will sign an ISA and will comply with all ISA requirements.

j. IBC INSPECTION OF FACILITIES

IBC may inspect the Contractor’s facilities, equipment, records of personnel with access to IBC data, and hosting environment with reasonable notice. The timing of inspections is at IBC discretion but will be coordinated with the Contractor and is not expected to disrupt Contractor’s normal operations. The sole purpose of an IBC inspection is to ensure security over IBC data and compliance with the ISA and contract requirements.

k. DATA HOSTING AND ACCESS

1. Control access to IBC data on an as-needed basis.

2. Physically and logically isolate IBC data in the Contractor’s hosting environment.

3. Encrypt IBC data in transmission and at rest in accordance with FIPS 140-2.

l. TRANSPORTATION TO USPS

W-2s and LESs can be transferred to USPS control at the Contractor’s facility. Alternatively, the Contractor will provide for end-to-end security between the print location and USPS.

Proposed security controls must be described in the Technical Proposal.

10 REQUIREMENT – PHASE-IN/TRANSITION PERIOD

The Contractor will provide the COR with a Phase-In/Transition Plan within 5 business days of the contract start date. The contractor will have 90 days to complete key tasks and events such as establish communication with the outgoing vendor, identify roles and responsibilities, identify, and clarify a schedule of key events, transfer documentation, and conduct testing based on the requirements (this list is not all-inclusive). A successful phase-in/transition is defined as “the contractor can comply with the requirements of this statement of work and consistently accomplish them with minimum error rates.” Ninety days for phase-in/transition may need to be adjusted based on the results of the plan.

The Contractor should expect a Government representative(s) will be present to review the phase-in/transition activities. Some of the identified activities for example testing may need to be repeated until IBC is satisfied that consistency in quality of processing is achieved.

Detailed procedures and processes will be developed during the phase-in/transition period. These procedures may vary somewhat from that described herein but will not otherwise change the scope or nature of the service.

IMPORTANT: Failure to demonstrate satisfactory performance within the phase-in/transition period may result in the Government terminating the Contract.

11 REQUIREMENT - QUALITY CONTROL

Since critical time frames must be met and processing jobs contain highly sensitive information and Privacy Act data, it is imperative that a very high order of quality control, both in automated equipment used and in manual processes, is applied to ensure a minimum error rate and that PII is adequately protected.

The Contractor’s Quality Control program must be described in the Contractor’s technical proposal.

As requested by IBC, the Contractor and IBC personnel will meet to review standards of performance. The Contractor will also be required to provide documentation of the results of its Quality Control Program monitoring, problem identification, and corrective actions, as requested by the COR.

a. PROBLEM RESOLUTION POINT(S) OF CONTACT

The Contractor will designate, and identify to IBC prior to contract start, management personnel responsible for resolving service-related issues. The designated personnel will review performance issues identified by the Contractor and/or by IBC and will meet with IBC representatives, as requested, to develop a mutually agreed upon solution to any problems within three business days.

12 REQUIREMENT – PRINTING SERVICES/SELF MAILER OPTIONS

• Black Ink Laser Printing

• Computer Processing & Presorting

• Folding (1-8 pages into a #10 envelope)

• Inserting (1-8 pages into a #10 envelope)

• Postal Barcode per address

• NCOALink move update address scrubbing

• Provide exact image of archived documents in a searchable index format per 8.5 x 11 image

• 2-years/image

• 3-years/image

• 7-years/image

• Make available test files for review and approval purposes, (All files removed after review period has expired) No Charge

• OSI 8.5xll 20# Stock

• OSI 8.5x14 24# Stock

• OSI 8. 5x14 28# Versaseal

• self-mailer stock with two 3/8" vertical perforations

• OSI Single Window Envelope No Tint

• Creative Design Support

• Custom Programming Support

• Assessment & Authorization

• Security Vulnerability Scans - Per

• DOI Security Requirements

• Portal Hosting Fee

• Creation and availability of a download file of documents for integration into DOI viewing system

Off-Site Disaster Recovery (Provided by Mail-Gard Warminster, PA)

• Cost

• Mail-Gard Annual Subscription Fee

• Annual Full Application Testing

• Includes testing twice yearly of 2,000 records

• -Black Ink Laser Printing - 8.5 x 11 OR an 8.5 x 14 simplex black ink image

• IBC’s data files are extremely large; a review of live data files is required to confirm quoted pricing for all contracted documents.

• LES file size is usually 200-300GB. There are typically five {5) W-2 print files ranging in size from

100GB to 800GB.

• IBC's requirements for security policies and procedures, DOI vulnerability analysis tool and destruction of IBC data.

• #10 IBC mailing envelope, window placement 7/8" from left side, ½: from bottom, window size

4 1/2" x 1 1/8". Printing on envelope in black ink,

• Return address in upper left hand corner front side.

• Versaseal self-mailer stock: 70# offset paper stock: Z-fold pressure seal printing; n/a (no pre-print)

8.5" x 14" form size.

• Insert (#10, 6" X 9 11 or similar) includes 1 printed page

13 REQUIREMENT - TSMB LARGE VOLUME PRINTER

• On site machine required for copying, printing, and scanning

• Capability to print mainframe jobs directly and without format modification is mandatory

• Lytrod (or equivalent) workflow and document format management software

• Full-Service Maintenance, Monday through Friday 8: 00a.m-5: 00p.m.MST, excluding

Holidays Includes all consumables and customer replaceable units (CRUs), except paper and staples

14 FACILITIES AND SUPPLIES

• The Government will prepay all postage charges using a USPS preprinted permit. IBC cannot prepay postage to a Contractor’s account and/or permit. Contractor shall be reimbursed for any additional fees incurred from US Postal Service AUTO Processing Reject Fees or other US Postal Service processing costs.

• IBC personnel will be available to provide technical input, answer questions and provide feedback.

• IBC will work with the Contractor to provide any documentation necessary to allow mailing from the

Contractor’s postal facility.

The Contractor will provide secure facilities, personnel, equipment, and supplies necessary to meet the Government’s requirements.

15 GOVERNMENT POINTS OF CONTACT

Contracting Officer:

Acquisition Services Directorate Contracting Officer: Contracting Officer’s Representative:

Personnel and Payroll Systems Division Program Support Office Contact:

For print and data issues:

Personnel and Payroll Systems Division Payroll Systems Branch

For print, reprinting, and file transfer and related issues:

Personnel and Payroll Systems Division Technology and Systems Management Branch Contact:

Personnel and Payroll Systems Division Technology and Systems Management Branch Contact:

For Disaster Recovery issues:

Personnel and Payroll Systems Division Program Support Office Contact:

For billing questions:

Personnel and Payroll Systems Division Program Support Office Contact:

16 PLACE OF PERFORMANCE

All work will be performed at the Contractor’s location and at least one alternate site available for disaster recovery as described in this SOW.

17 PERIOD OF PERFORMANCE

Unless otherwise agreed to, all services described will be provided for a base period from date of award (approximately April 3, 2025) through April 2, 2026, with four one-year option periods available.

18 CONTRACT FLEXIBILITY

The Contractor acknowledges the printing and mailing volumes provided in this SOW are estimates based on history and will vary. The Contractor will allow flexibility in effort by working with IBC to mutually modify the basis of the services described at any point during the term of the contract for the following items:

(1) print volumes and/or frequencies

(2) connectivity options

(3) postal processing methods and capabilities

(4) fold & stuff versus self-mailer

19 SUBCONTRACTING

Any subcontractor proposed for this requirement must meet all performance, security, and other requirements as described. Any large business receiving a contract must agree in the contract that small business, veteran-owned small business (VOSB), service-disabled veteran-owned small business (SDVOSB), HUBZone small business, small, disadvantaged business (SDB), and women-owned small business (WOSB) concerns will have the maximum practicable opportunity to participate in contract performance consistent with its efficient performance.

20 SCOPE

This contract may be used by any Department of the Interior entity to obtain services for printing, mailing, and related services, as mutually agreed to with the Contractor.

21 Acronyms

Acronym Description

BMEU Bulk Mail Entry Unit CASS Coding Accuracy Support System CFR Code of Federal Regulations CO Contracting Officer COR Contracting Officer’s Representative DOI Department of the Interior DR Disaster Recovery FAR Federal Acquisition Regulation FIPS PUB Federal Information Processing Standards Publication FPPS Federal Personnel and Payroll System GMF General Mail Facility HR Human Resources HSPD-12 Homeland Security Presidential Directive 12 IBC Interior Business Center ISA Interconnection Security Agreement IT Information Technology LES Leave and Earnings Statement NAC National Agency Check NACI National Agency…