Attachment_1_-_1099Pro_Service_Statement_of_Work_10172022.pdf

U.S. Department of the Interior

1099Pro Service Statement of Work (SOW)

October 17, 2022

1 Background and Objective

The Financial and Business Management System (FBMS) is the Enterprise Resource Planning (ERP) solution for the Department of the Interior (DOI). FBMS is the cornerstone of a fully integrated business management system, supporting DOI as a world-class organization acknowledged for management excellence and effective mission delivery. It is critical to the DOI’s financial management modernization strategy and to meeting future business needs. FBMS is designed to incorporate the majority of DOI’s financial and business management functions into one system.

The BIO is responsible for the management, continued development, and operation and maintenance of FBMS and the support of the business community utilizing the system across DOI. The BIO is an office under the Deputy Assistant Secretary for Budget, Finance, Grants and Acquisition (DAS-BFGA) within the Office of Policy, Management and Budget (PMB). PMB is an office located within DOI’s Office of the Secretary (OS).

In addition, the BIO is responsible for 1099 reporting for all bureaus for vendor payments using FBMS.

This mandatory IRS reporting must be completed annually and requires the use of software (1099Pro) and services (reporting, printing, and mailing) performed by the 1099Pro service bureau. This acquisition is for the service component associated with the printing, mailing, and reporting of the 1099s using the 1099Pro service bureau. Our ability to meet the IRS reporting deadlines is a high priority and those deadlines change from year to year and vary based on reporting category.

2 Requirements

As stated in Section 1, Background and Objective, the purpose of this acquisition is to acquire 1099Pro service to support the printing, mailing, and reporting of the 1099s using the 1099Pro service bureau.

Following are the details:

Annually, every January, the BIO will generate 1099 files created from FBMS or reported separately by our supported Bureaus. This file is then processed through 1099 reporting software. The BIO requires that these files be used to print taxpayer 1099s in the latest template form provided by the IRS for the current reporting year. Subsequent E-Filing to the IRS for this 1099 activity will be performed by the vendor. The anticipated volume can range from 16,000 – 20,000 1099s in any given tax reporting year.

Confirmation/reporting will be required to ensure the correct number of forms are printed. This confirmation report shall indicate if there are any forms that cannot be printed due to missing or corrupt information. Once printed, the forms will be mailed to recipient taxpayers and the initial mailing shall be post marked by January 31 (or alternative dates as defined by IRS requirements) of any given tax reporting year. IRS allows for corrected files to be submitted and these deadlines can range from March through mid-year depending on the category of 1099. DOI will utilize the opportunity to provide corrected files for subsequent printing/mailing as needed, but aims to be complete before July 31st. The corrected files will contain both new and amended 1099s created since the January 31st initial filing

SAP Process Control Software Licenses, Maintenance and Service date. The anticipated volume can range from 50 – 2000 additional 1099s that require printing, mailing, and reporting. There is a possibility that the BIO may require printing and mailing of corrected 1099s or 1099s that were not initially sent in on the original IRS E-File date during a timeline that is outside the normal IRS tax reporting timelines noted above.

Regarding the above noted requirements, the BIO requires the following:

• The service provider must be able to accept the formatted 1099 data file as formatted by 1099Pro software.

• The service provider must have the ability to view individual 1099 forms online with the capability to reprint forms.

• 1099s must be printed on IRS approved or recommended paper. Mailers must be firmly sealed and ensure no transparency by which sensitive data can be inadvertently exposed.

• Vendor must provide technical support to confirm file/data transfer success prior to each tax reporting season to ensure no firewalls or other network issues exist that will compromise reporting timelines. Vendor technical support must be available to assist with troubleshooting issues with failed file upload/transfers.

• File transfers must ensure security of vendor data and must be compliant with SSAE 16 SOC I Type II and PCI standards. Data transfers must be encrypted direct file transfers with confirmation processes/acknowledgments to include control totals to ensure complete data transfers; and

• The service provider must minimize the visibility of the data being printed to protect PII data contained on the file. Data, both printed and electronic, must be always secured.

• The service provider must perform IRS report submissions (IRS E-Filing) within IRS deadlines to represent our 1099 reporting managed through 1099Pro software.

The BIO’s current contract, D0418P0011, expires on December 14, 2022. Therefore, this requirement must be awarded by December 15, 2022.

3 Deliverables

In addition to the service provider maintaining certification, the following deliverables are required:

• Printed and sealed 1099 forms ready for mailing.

• Mailing of paper forms in January, March and on an as needed basis for corrections and adjustments.

• File of control totals verifying that all data sent from DOI via the 1099 reporting software was received.

• Confirmation, to include control totals, verifying that all forms submitted by DOI were printed and mailed.

• IRS E-file reporting for all mailed 1099 forms; and confirmation when this reporting has been completed

4 General Information

The contractor immediately notifies the CO in writing in the event the contractor encounters difficulty in performance by giving pertinent details, including the date by which it expects to complete performance or make delivery. However, the notification will be informal only in character and will not be construed as a waiver by the Government of any contractual delivery schedule or date, or any rights or remedies provided by law or under this effort.

4.1 Section 508

Section 508 of the Rehabilitation Act of 1973 (found at 29 USC 794d) requires access use of information by individuals with disabilities. A deliverable such as electronic reports (ex., PDF files) to be placed on the web (either on the agency’s web server or the company’s), video footage, or other electronic data such as CD-ROMs to be distributed, are subject to Section 508 guidelines. Simplified, this means that PDF files need to be formatted so that they are “readable” by assistive technology devices such as screen readers. Video footage must be closed captioned. CD-ROMs that contain HTML, PDF or word processor files must assessable.

Deliverables for this task order, such as FBMS Release Notes, Computer-Based Training Classes, and Materials, and FBMS training materials must adhere to Section 508 guidelines.

4.2 Authority to Obligate the Government

The CO is the only individual who can legally commit or obligate the Government to the expenditure of public funds. No costs chargeable to this effort can be incurred before receipt of a fully executed task order and/or specific authorization from the CO.

4.3 Data Use, Disclosure of Information and Handling of Sensitive Information

Performance of this effort may require the contractor to access and use data and information proprietary to a government agency or Government contractor that is of such a nature that its dissemination or use, other than in performance of this effort, would be averse to the interests of the Government and/or others.

The contractor will maintain, transmit, retain in strictest confidence, and prevent the unauthorized duplication, use, and disclosure of personnel information. The contractor will provide personnel information only to employees, contractors, and subcontractors having a need to know such information in the performance of their duties for this project.

Information made available to the contractor by the Government for the performance or administration of this effort will be used only for those purposes and will not be used in any other way without the written agreement of the CO.

The contractor agrees to assume responsibility for protecting the confidentiality of Government records that are not public information. Each offeror or employee of the contractor to whom information may be made available or disclosed will be notified in writing by the contractor that such information may be disclosed only for a purpose and to the extent authorized herein.

Contractor personnel will not divulge, or release data or information developed or obtained in performance of this effort, until made public by the Government, except to authorize Government personnel or upon written approval of the CO. The contractor will not use, disclose, or reproduce proprietary data that bears a restrictive legend, other than as required in the performance of this effort.

Nothing herein will preclude the use of any data independently acquired by the contractor without such limitations or prohibit an agreement at no cost to the Government between the contractor and the data owner that provides for greater rights to the contractor.

All non-proprietary data received, processed, evaluated, loaded, and/or created because of this delivery order will remain the sole property of the Government unless specific exception is granted by the CO.

4.4 Period of Performance

The period of performance is a base and four option years. Following is an estimate:

Base Period: December 15, 2022 – December 14, 2023;

Option Year 1: December 15, 2023 – December 14, 2024;

Option Year 2: December 15, 2024 – December 14, 2025;

Option Year 3: December 15, 2025 – December 14, 2026; and Option Year 4: December 15, 2026 – December 14, 2027.

4.5 Other Direct Costs (ODCs)

The Government will pay no costs beyond that of the agreed license and software maintenance fees.

4.6 Travel

There is no travel associated with this requirement.

4.7 Points of Contact

All contract questions and concerns will be directed to the Contracting Officer (CO). Technical questions will be directed to the Contracting Officer’s Representative (COR).

4.8 Reference Documents

All documents and publications of the Department of the Interior such as standards, regulations, directives, operating instructions, or executive orders relating to the software development cycle will be adhered to by the contractor and will include, as a minimum, the following documents:

a. NISTIR-6462: CSPP – Guidance for COTS Security Protection Profile, 1999;

b. P.L. 93-579, The Privacy Act of 1974;

c. P.L. 100-235, Computer Security Act of 1987;

d. P.L. 104-106, Information Technology Act (Clinger/Cohen Act) of 1996;

e. P.L. 107-347, E-Government Act of 21002, Title III Information Security – Federal Information

Security Management Act” (FISMA), December 17, 2002;

f. Federal Information System Controls Audit Manual (FISCAM), January 1999;

g. Office of Management and Budget (OMB) Circular A-130, Appendix III Security of Federal

Automated Information Resources;

h. Comply with OMB memorandum M-06-15, Safeguarding Personally Identifiable Information, May 22, 2006;

i. NIST Special Publication (SP) 800-12, An Introduction to Computer Security: The NIST Handbook, October 1995;

j. NIST SP 800-18, Rev. 1, Guide for Developing Security Plans for Information Technology Systems, February 2006;

k. NIST SP 800-26, Self-Assessment Guide for Information Technology Systems, March 9, 2001;

l. NIST SP 800-30, Risk Management Guide for Information Technology Systems, July 2002;

m. NIST SP 800-37, Guide for the Security Certification and Accreditation of Federal Information

Systems, May 2004;

n. NIST SP 800-53, Rev. 2, Recommended Security Controls for Federal Information Systems, December 2007;

o. NIST SP 800-64, Rev. 2, Security Considerations in the Information System Development

Lifecycle, October 2008;

p. FIPS 199, Standards for Security Categorization of Federal Information and Information Systems, February 2004;

q. DOI Certification and Accreditation (C&A) Guide, July 2003;

r. DOI Risk Assessment Guide;

s. DOI System Testing and Evaluation (ST&E) Guide, September 2, 2003;

t. DOI Contingency Planning Guide, August 2002;

u. DOI IT Asset Valuation Guide, March 4, 2002;

v. DOI Major Application (MA) Security Planning Guide;

w. DOI Privacy Impact Assessment and Guide; and

x. DOI Risk Assessment Guide, April 30, 2002.