Attachment 1 - Performance Work Statement.pdf

2031JW24Q00016 Attachment 1

Examination and Supervisory Survey of National Banks and Thrifts Performance Work Statement

1.0 Background

The Office of the Comptroller of the Currency (OCC) charters, regulates, and supervises all United States national banks, federal savings associations, and federal branches and agencies of foreign banks (hereafter referred to collectively as banks). The OCC is an independent bureau of the U.S. Department of the Treasury and is led by the Comptroller of the Currency.

Headquartered in Washington, DC, the OCC has offices nationwide.

The OCC’s mission is to ensure banks operate in a safe and sound manner, provide fair access to financial services, treat customers fairly, and comply with applicable laws and regulations.

Bank supervision is the core activity of the agency. The OCC’s nationwide staff of examiners conducts onsite examinations and provides ongoing supervision of banks. The agency issues rules, legal interpretations, and corporate decisions concerning banking, bank investments, bank community development activities, and other aspects of bank operations.

The OCC surveys the banks it supervises using the Examination and Supervisory Survey (Examination Survey). The OCC's Office of Enterprise Governance and the Ombudsman (EGOMBD) oversees the administration and reporting of the Examination Survey. As of December 31, 2022, there were a total of 1,084 OCC supervised banks. The survey is designed to gather direct and timely feedback from bank points of contact (POC) on their experience with the content and conduct of OCC examinations and supervision.

The survey includes questions grouped into five sections: Work, People, Products, Usefulness, and Intent to Remain Under OCC Supervision. All survey questions are voluntary, i.e., the respondent may skip any or all questions and submit the survey.

Twenty-nine (29) questions, some with sub-parts, are measured on a satisfaction scale of 1 (completely agree) to 5 (completely disagree).

One (1) question with sub-parts is measured on a usefulness scale of 1 (very useful) to 4 (not at all useful).

There are three (3) filter questions, with sub-parts, eliciting yes or no responses.

Seven (7) questions request multiple choice and narrative responses.

Since September 2013, the OCC has achieved an average response rate of 67%. The OCC has an expectation that the Contractor will maintain or exceed this response rate.

1.1 Scope

The EGOMBD Office seeks to procure services from an independent Contractor to conduct surveys of OCC supervised banks and develop analysis reports. The OCC Contracting Officer’s Representative (COR) will provide the examination survey upon award. If the OCC elects to revise the survey in future contract periods, the COR may request for the vendor to assist with this task.

The EGOMBD Office contemplates surveying a population of approximately 70 OCC supervised banks monthly over the term of the contract. The EGOMBD Office will provide the Contractor with an electronic file monthly, containing information necessary to survey the banks.

The survey will be used to gather specific feedback from banks about the OCC and the value of the federal charter. Survey data may also help to identify relevant internal performance benchmarks and metrics.

2.0 Tasks

The Contractor shall perform the tasks identified below to start-up the survey process, administer the survey to participants, and analyze and report survey results.

2.1 Start-Up Period and Transition-Out Plan

This award includes a two-month (60 calendar days) start-up period. The COR will provide the Contractor requisite documents and information as noted in Section 5.0 that the Contractor will use to develop a Start-Up Plan. The Contractor will submit the Start-Up Plan within fourteen

(14) calendar days of receiving said information from the COR. The COR will send comments to the Contractor, on the Start-Up Plan within thirty (30) calendar days of receipt. The Contractor shall address the comments within seven (7) calendar days of receipt of the COR’s comments. The Start-Up Plan shall be declared final in writing once all comments are addressed and the COR accepts the Plan. The Start-Up Period will begin upon COR’s acceptance of the Start-Up Plan. The Contractor shall complete implementation of the Start-Up Plan, developed by the Contractor and approved by the COR, during the Start-Up Period.

The Contractor’s Start-Up Plan shall include a project plan and milestones for meeting the requirements outlined in the contract. In addition, the Start-Up Plan will outline a proposal with milestones for the following:

Developing and implementing an acceptable platform for survey administration that meets the requirements noted in the contract. This includes product demonstration and user acceptance testing.

Developing templates used for communications sent via postal mail and email to the bank POCs.

Delivering the Survey Response file in a Microsoft Excel format.

Developing templates to convey survey response data (i.e., Monthly Report, Semi-

Annual Report, and Annual Report as detailed in Section 3.0: Deliverables).

Developing an effective Quality Control Plan.

Identifying a go-live date for beginning survey administration.

Developing a project plan for administering the survey and for submitting deliverables due for the first contract year.

The Start-Up Plan will acknowledge that developing narrative analysis of the trend of survey responses will require analyzing survey responses previously collected up to three (3) years before contract begin date. The COR will provide reporting criteria and content requirements for the Semi-Annual and Annual Reports post OCC Security and Privacy Authorization.

The Contractor will also submit within thirty (30) calendar days of contract award, a project timeline and schedule of deliverable submissions for the base year. For subsequent years, the Contractor shall provide a project timeline within three (3) business days after the exercise of the next option year.

Initial Approval: The COR will review the schedule and provide written comments or approval to the Contractor within thirty (30) calendar days of receipt. If the schedule requires revision, the Contractor will incorporate the COR’s comments and send a revised schedule within seven (7) calendar days of receipt of the COR’s comments. The schedule is final upon the COR’s written acceptance of the revised schedule and the Contractor must operate under the COR accepted schedule.

Approval for Subsequent Changes: If the schedule requires revision during the contract period, the COR or the Contractor may submit the request in writing along with an explanation for the requested change. The COR must provide a written approval of any change to the initially approved schedule.

The Contractor will begin administration of the survey, as outlined in Section 2.2, as well as all contract requirements, upon receipt of the OCC’s security authorization, as described in Section 8C below. Once the Contractor has received the security and privacy authorization, information from the preceding Examination Survey contractor will also be provided to the Contractor.

The Contractor shall be responsible for a Transition-Out Plan. Upon completion of the contract or the OCC’s decision not to exercise all option years, the Contractor shall be responsible for assisting in the transition of this requirement to another Contractor. The transition out process will be dictated in part by the incoming Contractor’s transition plan as well as transition guidance provided by the COR. The Contractor shall provide the Transition-Out Plan within thirty (30) calendar days of request from the Contracting Officer (CO).

2.2 Survey Administration Requirements

Survey Administration and Data Collection

The Contractor shall administer and collect survey information from the banks with no more than five (5) communications, excluding the thank you email, sent via postal mail and email to bank POCs. The following is a visual timeline of the Contractor’s activities, described in more detail below, that are involved with the survey administration:

Activities:

Monthly, the COR will provide the Contractor a list of banks to survey. Two surveys may be in different phases of administration during any given month. Occasionally during the survey period, approximately one to two times, the COR may add or delay to a different survey cycle.

Within five (5) calendar days of receiving the COR’s list of POCs and prior to sending an email with the survey link, the Contractor shall send a letter via postal mail to the bank’s POC. The letter shall be printed on OCC letterhead at the Contractor’s place of business.

The letter will notify the POC of an upcoming survey link they will receive via e-mail.

The OCC will provide a template upon contract award. (This counts as one (1) communication.)

If the bank POC provided by the COR requests to send the survey to another individual, the Contractor shall inform the COR before sending the survey link. The COR may confirm the change in POC or provide another POC to survey at the institution. The Contractor shall submit a monthly report identifying all changes to the POCs for a given survey when submitting the Monthly Report.

The Contractor shall send an email with the survey link to the bank POCs no later than 14 calendar days after receiving the list of POCs from the COR. (This counts as one (1) communication.) The Contractor may send, via email or postal mail, a copy of the survey to the bank, if requested. The Contractor shall notify the COR of all such instances for a given survey when submitting the Monthly Report.

The Contractor shall provide up to three weekly electronic mail reminders to the bank POCs who have not submitted the survey. The first reminder will be sent seven (7) calendar days after the email that contains the survey link and weekly thereafter on an agreed upon day of the week. The reminders will cease if the POC submits the survey or at the POC’s request. (Each reminder counts as one (1) communication, up to a total of three (3) communications.)

The Contractor shall assist bank POCs with technical issues related to the survey.

The Contractor shall send bank POCs a thank you letter electronically within one (1) business day of receiving the survey.

The Contractor shall ensure the survey link is active for 30 calendar days for bank POCs who have not yet submitted survey responses.

Monthly, the Contractor will provide survey response data to the COR in a specified

Excel format (Survey Response file).

The Contractor shall annually provide industry benchmarks for survey response rates.

The Contractor shall periodically provide suggested best practices to improve survey response rates. The frequency of this information will be as deemed necessary by the COR or Contractor, and when the trend of survey response rates fall below the historical average rate.

Survey Platform

The Contractor will utilize a web-based platform to administer the surveys to banks.

The OCC will provide survey questions to the Contractor.

The Contractor shall select a web-based platform that allows completion and submission of the survey via a desktop or mobile device and the ability to return and complete a partially saved survey.

The Contractor shall select a web-based platform that is user friendly and utilizes intuitive survey logic.

The Contractor shall upload questions into its survey administration platform and follow COR instructions noted in the survey when creating survey rules on the platform. During the 60 calendar day Start-Up period, the Contractor will provide a demonstration of the survey, the COR will test the survey, and the Contractor will make all necessary changes prior to finalizing the survey and presenting it to the COR for approval. The Contractor will implement the survey platform in production upon receipt of COR’s written approval.

The Contractor shall create and email unique survey links to bank POCs to track responses by individual institutions. The link shall point the respondent’s web browser directly to the unique survey for completion.

2.2.1 Survey Reporting, Analysis, and Validation

The Contractor shall:

Provide an overall summary of survey results.

Provide quality analysis reports of survey results that are user friendly. The reports must meet the criteria that the COR will provide upon contract award as well as the following criteria:

o Look appealing and approachable at first glance through the use of layout, font, and color.

o Are easy to read, navigate, and identify the main points and important information.

o Demonstrate easy to understand charts and graphs and visuals that reinforce the content.

The reports shall provide a narrative analysis of the quantitative and qualitative survey data for the respective reporting period.

The Contractor shall report on the salient trends observed in the survey responses, with supporting analysis and data visualization (e.g. charts and/or graphs) with trend analysis included for the prior two (2) reporting periods.

Use the calculation provided by the COR during the Start-Up period to compute averages for responses to individual questions and sections in the Examination Survey.

Implement an effective validation approach to ensure accuracy of survey response data and analysis of results, calculation of data used for analysis reports, and content of analysis reports.

2.3 Validation of Examination Survey Questions (AT THE OCC’s OPTION)

Should the OCC wish to revise the wording or order of survey questions during the contract period, the Contractor shall:

Recommend verbiage to alter or add survey questions based on COR direction.

Recommend re-ordering of survey questions based on COR direction.

Validate that the changes to survey question verbiage and/or order do not alter the meaning of the question.

The OCC estimates this optional task would require a maximum of 200 labor hours (150 data analyst and 50 project manager). An optional, nonrecurring CLIN will be assigned to this service, to be used at the OCC’s option during the contract period.

2.4 Host Data

The Contractor shall maintain the survey response data (host data) for data analysis and reporting purposes. Refer to the relevant sections below for maintaining the security of the host data.

2.5 Data Security

The Contractor shall maintain data security as follows:

Secure survey response data through the use of firewalls or other means and ensure that the survey, survey data, communications with the OCC, and other deliverables are not accessible on the Internet. See Section 8.0 Information Security and Privacy Requirements for additional details.

Information transmitted between an OCC location and a Contractor or sub-contractor’s location must be encrypted during transmission.

Email communication must be secure and encrypted, except for the Contractor’s emails related to survey administration transmitted to bank POCs. However, the Contractor shall host the survey on a secure server.

Authenticate bank POCs throughout the survey process.

All storage media, including written or printed media, shall be secured or shredded.

Encryption standard will be Federal Information Processing Standard (FIPS 140-2, as superseded).

Once the COR has received copies of data, all OCC data will be deleted or destroyed from the Contractor’s records within three (3) business days after the COR accepts the final deliverable. The Contractor will provide evidence of data destruction in accordance with Section 8.0 of the Performance Work Statement (PWS).

The Contractor will be required to work with the OCC CyberSecurity Office in accordance with Section 8.0 of the PWS.

The Contractor shall provide to the OCC evidence of reviews for continuous security monitoring requirements to include monthly account listings and activity audit logs to ensure there is no suspicious activity and ensure the system remains in compliance throughout the year.

The Contractor shall provide to the OCC evidence of a vulnerability management policy and process.

2.5 Communication

Meetings will be held via conference call unless an on-site meeting is requested by the

OCC.

Bi-weekly meetings between the COR and the Contractor shall be held to discuss the status of the surveys and other issues or concerns related to the deliverables. The Contractor will provide a bi-weekly meeting agenda to the COR. At least one member identified as key personnel from Section 9.0 of the PWS will attend the bi-weekly meetings.

In addition to the bi-weekly meetings, upon the COR’s or Contractor’s request:

o Meetings will be held between the COR and the Contractor to discuss any survey issues or discrepancies.

o Meetings shall be held prior to the creation of each Annual and Semi-Annual

Report to discuss report analysis criteria and incorporate any OCC organizational changes.

2.6 Business Continuity

Within 30 calendar days of contract award, the Contractor will provide the COR a copy of its latest Business Continuity Plan and the last date it was tested. The Contractor will communicate with the COR within one (1) hour of any survey outage incident, regarding any business continuity issues related to the contract, such as delay in survey availability. The Contractor shall provide contact information for all information technology (IT) POCs to the OCC POCs listed in Section 8 upon contract award. The Contractor will provide any updated contact information for the designated IT POCs within seven (7) calendar days of the change.

Within 30 calendar days of contract award, the Contractor will provide the COR with a copy of its Business Impact Analysis (BIA) to provide acceptable levels of downtime and losses, using key metrics of Maximum Tolerable Downtime (MTD), Recovery Time Objective (RTO) and Recovery Point Objective (RPO).

3.0 Deliverables

3.1 Required Deliverables

Table 1, Required Contract Deliverables, lists the deliverables to be produced by the Contractor under this contract. All deliverables shall be submitted electronically to the OCC. Unless specified, the Contractor will recommend the deliverable format to the OCC. The OCC will approve the deliverable format prior to its use. The deliverable format may be subject to change at the written request of the Contractor or the OCC. The OCC must approve in writing any change in deliverable format. Changes to deliverable format are not expected to be a regular occurrence.

Except for the base year, the OCC anticipates administration of twelve surveys annually. The number of surveys administered in the base year will depend on the timing of the Privacy and Security Authorization.

The Contractor shall provide one semi-annual and one annual analysis report to the COR each calendar year. Reporting periods will be January 1st through June 30th for the semi-annual report and January 1st through December 31st for the annual report. Reports must be timely, accurate, grammatically correct, and free of calculation errors. Typos should be minimal.

The Contractor shall provide a Quality Control Plan (QCP) to the OCC that outlines the quality control actions necessary to meet the performance requirements outlined in this PWS. The QCP should also discuss the method for validating the accuracy of data and analysis reports derived from manual and/or technology systems employed by the Contractor. The Contractor will update and resubmit the QCP to the OCC, as required, based on changes to its organization, processes, staffing, errors in deliverables, and other relevant factors.

Table 1 Required Contract Deliverables

Deliverable Comments Due Date

2.1 Initial

Start-Up Plan

14 calendar days after contract award

2.1 Final Start-

Up Plan

The Contractor will incorporate OCC feedback and submit final plan.

7 calendar days after receiving COR comments

2.1 Project

Timeline/ Deliverable schedule

The Contractor will provide a schedule of the survey administration and deliverable submissions.

Base Year: 30 calendar days after award Option Year: 3 business days after option is exercised

2.1 Quality

Control Plan

End of the Start-Up period

2.2 Survey

Response File

The Contractor will submit the spreadsheet via OCC Secure Email or Transport Layer Security (TLS) Connection in the format provided by the OCC.

Within 7 calendar days of survey close date

2.2 Monthly

Report

Report, in the format provided by the OCC, containing summary information to include technical issues faced by the vendor or bank POCs, survey response rate, changes in bank POCs, bank requests for copy of the survey, and survey content metrics.

Within 7 calendar days of survey close date

Deliverable Comments Due Date

3.1 Semi-

Annual Report

The semi-annual report must perform a narrative analysis of the current six-month period and provide comments regarding the trend of the prior three (3) six-month periods’ results.

Within 30 calendar days of receipt of the results of the last month’s data for the respective six-month period

3.1 Annual

Report

The annual report must perform a narrative analysis of the current calendar year’s results and provide comments regarding the trend of the prior three (3) calendar year results.

Within 30 days of receipt of the results of the last month’s data for the respective calendar year

2.1 Transition-

Out Plan

The Contractor shall be responsible for assisting in the transition of this requirement to another Contractor.

Within 30 calendar days of request from the Contracting Officer

3.2 Submission of Deliverables

The Contractor will send all deliverables to the COR via email using encryption. The subject line or title of the submission shall clearly identify that it is a deliverable notification. The COR may specify additional recipients to be copied on the deliverable notification for a given deliverable. The COR may forward deliverables to employees within the OCC for review, as necessary. The COR will communicate acceptance or denial of the deliverables with the Contractor’s Program Manager.

3.3 Review Times and Acceptance of Deliverables

The COR will have five (5) business days to review the monthly deliverables and ten (10) business days to review the semi-annual and annual deliverables. The COR will provide written comments to the Contractor. (The Contractor shall incorporate this requirement into its schedule for planning purposes.) If the COR does not provide written comments within the specified review time indicated in this paragraph for review, the Contractor shall consider the deliverable accepted by the COR. Deliverables receiving comments from the COR are considered unacceptable. Any previously submitted unacceptable deliverable is considered acceptable when the COR affirmatively accepts the deliverable.

Upon receipt of comments from the COR, the Contractor will have three (3) business days to revise the monthly deliverables and five (5) business days to revise the semi-annual and annual deliverables. Requests for additional revision time shall be made to the COR and will be evaluated on a case-by-case basis.

3.4 Remediation of Unacceptable Deliverables

The COR will require the Contractor to re-work and re-submit any version of a deliverable that is unacceptable. The Contractor will correct deliverables produced under fixed-price tasks without additional cost to the OCC. The Contractor may not invoice for unacceptable deliverables until the COR informs the Contractor that the final version is approved.

3.5 Invoicing

The Contractor shall provide timely invoices to the COR that include sufficient detail to identify the associated deliverables that map back to the associate contract line item number (CLIN). For example, the invoice shall include the month and year of the survey administered, period of data analyzed for the analysis reports, etc.

4.0 Performance Requirements Summary

The Contractor shall accept the performance objectives in Table 2, Performance Requirements Summary (PRS). The OCC will begin to implement the disincentives outlined in the table six

(6) months after the contract has been awarded to the vendor, to allow a period of performance and the opportunity for the vendor to fully understand the performance requirements.

Table 2 Performance Requirements Summary

Deliverable/ Specification Item

Performance Measure/ Objective

Target Metric/ Performance Standard

Disincentive (D) Surveillance Methods

Frequency

Communications with bank POCs

Survey link is distributed within expected timeframe (i.e.

14 calendar days after receiving a list of bank POCs from the COR), as noted in Section 2.2 Survey Administration Requirements

Weekly survey reminders (emails one, two, & three) per Section 2.2 Survey Administration Requirements are only sent to bank POCs who have not

95 percent of monthly bank POCs receive the survey link and weekly reminders (as applicable) within the timeframe defined in the contract year survey schedule.

If the survey link or reminders are not delivered within the established timeframe, there must be no more than a 48-hour delay.

(D) = 3% deduction of monthly invoice amount (for CLIN X001) for late survey links or reminders not meeting requirements in any given month.

An additional 2% deduction of the monthly invoice amount (for CLIN X001) if the 48 hour window is missed for any bank POCs.

100% inspection of Survey Response File

Random inspection of 10 bank POCs listed in the monthly Survey Response file and customer feedback, if any

Monthly

Specification Item

Performance Measure/ Objective

Target Metric/ Performance Standard

Disincentive (D) Surveillance Methods

Frequency completed the survey

Survey Response File

File format meets specifications provided by the

OCC

Data is error-free

Correct format and error-free data for 100 percent of monthly data files

(D) = 5% deduction of monthly invoice amount for CLIN X001.

100 percent Inspection

Monthly

Monthly Report Report format meets specifications approved by the

OCC

Information is error-free

Correct format and error-free information for 95 percent of monthly reports

(D) = 5% deduction of invoice amount (for CLIN X002) for incorrect information and report format

100 percent Inspection

Monthly

Semi-Annual Report

Correct grammar with minimal typos

No calculation or data errors

Agreed upon analysis criteria and format

No more than five typos

No calculation or data errors

Agreed upon analysis criteria and format used in 100 percent of the reports

(D) = 10% deduction of invoice amount (for CLIN X003) if more than five typos, for any calculation or data errors, and/or if agreed upon analysis criteria and format are not used

100 percent Inspection

Semi-Annually

Annual Report Correct grammar with minimal typos

No calculation or data errors

Agreed upon analysis criteria and format five typos

No calculation or data errors

Agreed upon analysis criteria and format used in 100 percent of the reports

(D) = 10% deduction of monthly invoice amount (for CLIN X004) if more than five typos, any calculation or data errors, and/or if agreed upon analysis criteria and format are not used

100 percent Inspection

Annually

Specification Item

Performance Measure/ Objective

Target Metric/ Performance Standard

Disincentive (D) Surveillance Methods

Frequency

Timeliness of Deliverables

Submitted by deadline established in Table 1 Required Contract Deliverables

11 of 12 (or 92 percent) monthly deliverables submitted timely. Any late monthly deliverable is submitted within two business days.

one business day delay in submission of either one of the semi-annual or annual report

(D) = 10% deduction of invoice amount (for CLIN X001 or X002) for every late monthly deliverable after the first allowed instance. An additional 5% deduction of the invoice amount will be charged if the deliverable is submitted after two business days.

(D) = 5% deduction of invoice amount (for CLIN X003 or X004) for every day past the one business day grace period.

100 percent Inspection

Monthly

5.0 Government-Furnished Information

Government-provided information may take the form of policies, standards, guidelines, technical data, specifications, or other applicable documents. The COR will provide historical data required to perform analysis, document samples, and required formats. The safeguarding and disposition of this information shall be in accordance with Agency regulations and/or the direction of the PWS. The Contractor shall protect from unauthorized disclosure of any materials or information made available by the Government or that the Contractor has access to, by virtue of the provisions of this contract that are not intended for public disclosure.

Government-Furnished Information shall include:

During the Start-Up period

Survey Response File template

Survey questions and logic

Sample communications sent to bank POCs

Sample monthly report

Post OCC Security and Privacy Authorization

Criteria for the analysis reports

Survey response data from the three (3) prior years.

6.0 Travel

Travel is not required or intended for this contract.

7.0 IT Accessibility – Section 508 Compliance

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities. As such, the following requirements apply to this solicitation:

i. Products, platforms and services delivered as part of this work statement that are ICT, or contain ICT, must conform to the Revised 508 Standards, which are located at 36 C.F.R.

§ 1194.1 & Apps. A, C & D, and available at https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines.

ii. E102 / 702.10 – Web Content Accessibility Guidelines (WCAG) 2.0 guidelines success criteria level A & AA are incorporated as a requirement. The referenced WCAG criteria is available at http://www.w3.org/TR/WCAG20/.

iii. A completed Accessibility Conformance Report (ACR) found at https://www.itic.org/policy/accessibility/vpat, using Voluntary Product Accessibility Template (VPAT) Revised Section 508 Edition, Version 2.4, is required to assist the Government in determining that the ICT products or services support Section 508 accessibility standards.

iv. E202 – No General Exceptions Authorized by OCC.

The following items are identified as containing ICT:

Software Applications & Operating Systems

Web-based Intranet and Internet Information and Applications

Information, Documentation, and Support

Applicable Functional Performance Criteria: All functional performance criteria apply when using an alternative design or technology that achieves substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4-6 of the Revised 508 Standards, or when Chapters 4-6 do not address one or more functions of ICT.

Applicable requirements for software and Web products:

E207 – WCAG Level A & AA Success Criteria E302 – Functional Performance Criteria E502 – Interoperability with Assistive Technology E503 – Application E504 – Authoring Tool E501 – Web-based applications, independent of platform services

Applicable requirements for electronic documents and/or support services:

E205 – WCAG Level A & AA Success Criteria E302 – Functional Performance Criteria E602 – Support Documentation E603 – Support Services

8.0 INFORMATION SECURITY AND PRIVACY REQUIREMENTS

A. Compliance with Applicable Laws, Regulations, and Standards

Federal Laws. The contractor and all of its respective subcontractors shall follow and remain compliant at all times with the Federal Acquisition Regulation (FAR), Privacy Act of 1974 (5 U.S.C. 552a - the Act), Federal Information Security Modernization Act of 2014 (Public Law

107-347) (FISMA).

Secure User-to-Cloud Communications Standards. All user-to-cloud service communications (e.g., via internet) must be encrypted with the latest industry standard browser protocol.

OCC Policies and Procedures. The OCC understands that there are limitations in applying agency-specific policies to systems and environments shared with other organizations or customers. The requirements in this OCC Policies and Procedures subsection applies to all activities specifically performed for the OCC by the contractor (e.g., professional services to develop or customize a component for the OCC). The intent of this section is to require contractor compliance with OCC policies and procedures for those activities, tasks, and deliverables specifically and uniquely performed and/or completed for the OCC by the contractor that is not a typical service or component of the existing contractor system/solution. This section also applies to contractors with access and use of OCC information resources (i.e., OCC network, systems, laptops, other IT equipment, and/or OCC information).

The contractor and all of its respective subcontractors shall comply with all OCC security and privacy policies and standards in effect at the time of the award of the contract, as well as those requirements that may be added during the contract.

The contractor/service provider shall conform to OCC administrative regulations, policies, and procedures, as listed in section [cite corresponding location in contracting document], in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. The contractor shall work with OCC internal organizations, as needed, to ensure that policies, procedures, configuration control, and product life-cycle requirements are fulfilled to the satisfaction of OCC ITS.

NIST SP 800-171. The contractor and its respective subcontractors shall ensure all components of contractor systems and organizations that process, store, and/or transmit OCC CUI or that provide protection for such components comply with the security requirements in NIST SP 800- 171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.

B. General Requirements

Location. Information collected, used, stored, maintained, or otherwise processed by the contractor in the performance of this contract shall be accessed, transferred, stored or processed only within the United States. In addition, the maintenance and support operations of the contractor's technology and information must take place, and originate from, within the United States.

The contractor shall not host any portion of the information, information system, infrastructure, or environment in facilities outside the contiguous United States, Alaska, Hawaii, and other U.S.

Territories.

Authorization to Use, Store, or Share Sensitive Information. The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all government data, equipment, etc.

by treating the information as sensitive. All information gathered or created under this contract shall be considered as Controlled but Unclassified (CUI) information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets.

Confidentiality. The contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

Non-Disclosure Agreement. Each individual who has access to sensitive OCC data and/or the OCC network, systems, applications, laptops, or other OCC information resources that may process, store or transmit sensitive OCC data under this contract shall execute a Non-Disclosure Agreement before being allowed such access.

Deliverables. The security deliverables in this contract will be submitted to the OCC POCs, which include the OCC Information Systems Security Officer and the OCC Contracting Officer.

The deliverables that are considered CUI will not be shared with any other organization without prior written approval from the OCC Contracting Officer.

C. Security and Privacy Authorization

Authorization Boundary. The contractor shall provide a diagram specific for the OCC, that clearly demarcates the information system authorization boundary and depicts all of its connections and components, including the means for monitoring and controlling communications at the external boundary and at key internal boundaries within the system. The contractor shall address all components and managed interfaces of the information system authorized for operation (e.g., routers, firewalls). The diagram must include a predominant border drawn around all system components and services included in the authorization boundary.

If there are OCC-specific components (e.g., components developed or customized for the OCC, OCC-hosted components, etc.) and/or other components supporting this solution that are not in the scope of the contractor's existing security documentation, then identify those components in the diagram as well, as part of a separate OCC-specific boundary since those are unique to OCC and shall be part of the OCC-specific security authorization. The diagram must be easy to read and understand. Formal names of components as they are known at the service provider organization in functional specifications, configuration guides, other documents and live configurations shall be named on the diagram and described. The contractor shall provide a key for symbols used.

External Service Provider Compliance & Monitoring Background. The FISMA and OMB policies require that federal agencies using external service providers to process, store, or transmit federal information or operate information systems on behalf of the federal government, assure that such systems meet the information security protections commensurate with the information and system sensitivity. Federal agencies are responsible and accountable for the information security risk incurred by the use of information system services provided by external providers.

Such risk is addressed by incorporating the Risk Management Framework (RMF)1 and security requirements for external information systems and services as part of the terms and conditions of

1 NIST Special Publication 800-37, as amended, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy.

the contracts with external providers. Federal agencies can also require external providers to provide appropriate evidence to demonstrate that they have complied with protecting federal information. Prior to the implementation of the contractor's system or services, the OCC ensures compliance with the RMF by issuing an Authorization to Operate (ATO) or Authorization to Use (ATU), based on its review and analysis of the external provider's security documentation (described in detail in the next section) and assessment of customer (OCC's) security responsibilities.

Non-Federal External Service Provider Security Documentation. Non-federal organizations with primarily non-federal customers have limitations with respect to complying with all federal requirements. As a result, the OCC obtains assurance through other industry standard security reviews, like the Statement on Standards for Attestation Engagements (SSAE) No. 18. For the evaluation of non-federal security requirements, the OCC will accept the following:

a. A contractor’s FedRAMP Authorization.

b. If the contractor does not have a FedRAMP authorization,

a. The Standards for Attestation Engagements (SSAE) no.18 Service Organization Controls (SOC) 2, Type 2, or

b. A 27001 Certification assessment report, or

c. A Payment Card Industry Data Security Standard (PCI DSS) Report on

Compliance (RoC) and Attestation of Compliance (AoC).

c. If the contractor does not have any of the above, at a minimum, the contractor must have a third party NIST 800-171 compliance report.

OCC Security Authorization to Use. The determination of whether to issue an OCC security authorization will be made by the OCC based on the identified risks to the OCC's data and operations. These risks include: (1) deficiencies noted in the contractor's most recent security report, (2) the gaps identified in the IT security and privacy control assessments performed specific to OCC customer responsibility implementations as designated in the CRM.

D. Configuration Management

Security Configuration Settings. The contractor shall establish and enforce security configuration settings for information technology products employed in the Examination Survey.

Security Updates and Patches. The contractor shall ensure that the Examination Survey is properly maintained and monitored, to include immediate response to critical security patches, routine maintenance windows to allow for system updates, and compliance with the defined configuration management and change control processes. All patches and system updates shall be properly tested in a development environment before being implemented in the production environment.

Least Functionality. The contractor shall restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services for information technology products employed in the Examination Survey.

E. Continuous Monitoring

Compliance Reviews and Audits. The contractor shall permit and support compliance reviews and audits under applicable laws to allow the OCC to meet legal and compliance obligations and shall implement processes that allow visibility into the privacy and security controls employed and their effectiveness. The contractor shall provide the OCC or authorized designated officials with information requested by auditors in a timely manner, consistent with the respective auditor's deadline, in support of security compliance reviews and various annual audits, e.g., FISMA, Financial Statement Audit, A-123, etc.

In addition, the contractor shall provide the OCC or authorized designated officials logical and physical access to the contractor's facilities, installations, technical capabilities, operations, records, and databases pertinent to this contract within seven (7) calendar days upon request for these purposes.

Annual Security Reviews. As mentioned in Section C, "Security and Privacy Authorization," the contractor shall provide annual security reports to the OCC for review in support of continuous monitoring activities.

F. Data Protection

Such measures include controls listed in NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, as amended, in the following areas:

Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity.

Data Separation. Unless otherwise directed by the OCC and/or controls are implemented to ensure adequate separation, any storage of data shall be contained within the resources allocated by the contractor to support the OCC and may not be on systems that are shared with other commercial or government clients.

General Use of Controlled Unclassified Information (CUI). The contractor shall not use any CUI or CUI subcategories, including, Personally Identifiable Information (PII) or low-sensitivity PII (e.g., E-mail Groups and Lists), for any purpose other than those activities necessary to the performance of this contract.

Use of Contractor Equipment. Use of contractor-owned laptops or other equipment (e.g., media storage devices, servers, etc.) to process, transmit, or store OCC information or to access the OCC network or other OCC information resources without OCC's formal approval is prohibited. This restriction does not apply to the use of non-OCC laptops or PCs to use OCC-approved virtual desktop infrastructure to remotely access the OCC network.

Contractor Equipment Approval. In order to obtain OCC's approval to process, store, or transmit OCC CUI on contractor equipment, the contractor shall provide written assurance of compliance with NIST SP 800-171 (as amended), Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, requirements for all contractor system and organization components that will process, store or transmit OCC CUI.

G. Incident Response

Notification. The contractor must report all information security incidents that potentially or actually cause the compromise of OCC information, even if the contractor believes the security incident may be limited, small, or insignificant with respect to OCC data or systems. The OCC will determine when the contractor's reported security incident requires additional focus and attention.

Within one (1) hour from the time the contractor validates that an information security incident has occurred, the contractor must report the security incident information to OCC:

ComputerSecurityIncidentResponse@occ.treas.gov, (202) 649-7930, regardless of day or time.

The contractor must provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC with the following text in the subject line of the email: “Supplementary Information/Report related to previously reported incident # [insert number].”

Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

When notifying the OCC CDC, copy the Contracting Officer if possible or, if reporting by phone or Contracting Officer's email is not immediately available, contact the Contracting Officer immediately after reporting the incident to the OCC CDC.

Information, System and Tool Availability. The contractor shall make available any information, systems, and tools necessary for the OCC to respond to incidents in a manner consistent with NIST SP 800-61, as amended. In the case of a reported security incident, the contractor shall provide the OCC with access to the contractor's system and/or facilities within 72 hours of the OCC's request.

H. Information Ownership

Government Access. The government will retain unrestricted rights to government data. The OCC retains ownership of any user created/loaded data and deliverables (e.g., documents, applications, custom code, diagrams, workflows, data sets, etc.) hosted on contractor's equipment, systems, infrastructure, etc., as well as maintains the right to request full copies of these at any time.

Removal of OCC Data. The contractor acknowledges the OCC's exclusive right of ownership of the information and is required to transfer, return, and/or delete all agency data collected, processed, stored or maintained by the contractor on behalf of OCC upon termination of services, and shall provide written certification and supporting documentation attesting to the transfer, return and/or deletion of agency information or data generated, collected, processed, maintained, or stored by the contractor and any subcontractors, per instructions the "Security and Privacy Vendor Deliverables" section.

Documents and Deliverables. The preliminary and final OCC-specific deliverables and all associated working papers are the property of the U.S. Government. The contractor shall not release any information without the written consent of the Contracting Officer. All work papers, preliminary and final deliverables must be submitted to the COR at the conclusion of the contract in an acceptable and usable format, which may include the original format.

eDiscovery. The contractor must ensure data preservation requirements (i.e., halt destruction and maintain data the contractor may not otherwise have to maintain) related to litigation holds are met. The contractor shall also ensure that metadata associated with litigation holds are preserved. Metadata is electronically-stored information that describes the history, tracking, or management of an electronic document. It is created automatically when a user creates, modifies, accesses, or takes other actions with respect to an electronic document.

The contractor shall provide immediate access to all government data and government-related data impacting government data for review or scan, or conduct of a forensic evaluation, and physical access to any contractor facility with government data.

I. System Access

Government Right to Terminate Access. The OCC, at its discretion, may suspend or terminate the access to any systems and/or facilities when an information security incident or other electronic access violation, use or misuse issue gives cause for such action. The suspension or termination may last until such time as OCC determines that the situation has been corrected or no longer exists.

The system shall implement multi-factor authentication for remote users.

J. Training Requirements

Security Awareness Training. All contractor personnel with access to OCC data and systems must complete OCC-provided mandatory security and privacy training prior to gaining such access. Non-compliance may result in revocation of system access.

Role-Based Training. The contractor shall ensure that IT personnel supporting this contract complete eight (8) hours of role-based specialized IT security training on an annual basis. The contractor must identify the IT personnel and their respective IT role2that they serve in support

2 IT Personnel include systems engineers; software developers; systems security engineers; privacy engineers;

system, network, and database administrators;…