Attachment 1 -- Statement of Work.pdf

Attachment 1

U.S. DEPARTMENT OF TRANSPORTATION

ENTERPRISE SERVICES CENTER

ESC SSAE Independent Assessment of Controls

STATEMENT OF WORK

Version 1.0 September 14, 2022

U.S. DEPARTMENT OF TRANSPORTATION

ENTERPRISE SERVICES CENTER

Table of Contents Section Description Page

1 OVERVIEW

2 BACKGROUND

3 SCOPE REQUIREMENTS

4 OBJECTIVES

5 AUDIT STANDARDS / GUIDANCE

6 REQUIREMENTS

7 CONTRACT DELIVERY SCHEDULE

8 SPECIAL CONTRACT REQUIREMENTS

9 LIST OF DOCUMENTS, EXHIBITS AND ATTACHMENTS

1 OVERVIEW

1.1 The Enterprise Services Center (ESC) is a Federal Aviation Administration (FAA) matrix organization within the U.S.

Department of Transportation (DOT) that provides system hosting, transaction processing and financial reporting support services to Federal government entities. The transaction processing and financial reporting services are provided utilizing the Oracle-based Delphi Financial Management application and ESC’s Portable Reusable Integrated Software Modules (PRISM), a procurement application. Operating Administrations (OAs) include DOT-OAs and Non-DOT OAs, with the DOT-OAs representing the largest block of Financial Services Division customers. Support services are defined for each customer in annual service level agreements (SLA), and can include Accounts Receivable (AR), Accounts Payable (AP), Purchasing (PO), Fixed Assets (FA), Project Accounting, (PA), General Ledger (GL), financial reporting support, and other transaction-based services. Delphi and ESC PRISM are hosted by the ESC at the FAA Mike Monroney Aeronautical Center (MMAC), located in Oklahoma City, Oklahoma.

The purpose of this contract is to perform two Readiness Assessments for ESC:

• Statement on Standards for Attestation Engagements (SSAE) Type II Examination of the DOT’s Enterprise

Services Center (ESC) as it relates to ESC’s Application Hosting, Hardware and Software Maintenance, utilized to support the Delphi & ESC PRISM applications.

• Financial Statement Examination of the DOT’s Enterprise Services Center (ESC) as it relates to ESC’s Application Hosting, Hardware and Software Maintenance, utilized to support the CASTLE application.

The purpose of these two reports will document the results and conclusions from each Fiscal Year review of ESC’s Security Program Controls, Logical Access Controls, Configuration Management and Change Controls, Computer Operations Controls and Physical Access and Environmental Controls.

The key objective for this contract is to provide ESC constructive feedback on the possible results that will be obtained by a service auditor if the service auditor attempts to obtain reasonable assurance about whether, in all material respects, based on suitable criteria,

i. Management’s description of ESC’s system fairly presents the system that was designed and implemented throughout the specified period.

ii. The controls related to the control objectives stated, in management’s description of ESC’s system, were suitably designed throughout the specified period.

iii. The controls operated effectively to provide reasonable assurance that the control objectives, stated in management’s description of ESC’s system, were achieved throughout the specified period.

An additional objective is to provide ESC management with a justification for the written assertion that ESC will have to provide to their SSAE service auditor as part of their upcoming SSAE examination. One of the requirements in SSAE is that the service organization management (i.e. ESC) has to provide to their service auditor a written assertion from management about the fairness of the presentation of the description of its system, the suitability of the design and the operating effectiveness of the controls included in their description.

The SSAE requires that the service organization’s internal controls are a living document and subject to change. Prior to issuance of a task order, the contractor will receive notice that the internal controls have not changed, or a revised set of internal controls. Changes may dictate negotiations on estimated number of controls and the on-site period of performance (POP).

2 BACKGROUND

2.1 The Enterprise Services Center (ESC) is a Federal Aviation Administration (FAA) matrix organization, within the U.S. Department of Transportation (DOT), which provides:

• System hosting, transaction processing and financial reporting support services to Federal government entities. The transaction processing and financial reporting services in scope for this System and Organization Controls (SOC) 1®1 report are provided utilizing the Oracle-based Delphi Financial Management application (also referred to as “Delphi”), including the Delphi iSupplier portal, and ESC’s Procurement Request Information System Management (PRISM), a purchase request application. The DOT Operating Administrations (OAs) represent the largest block of Financial Services (FS) Division customers (within this report, the terms “customer,” “user entity” and “OA” are used interchangeably). Support services are defined for each customer in annual service level agreements (SLAs) and can include Accounts Receivable (AR), Accounts Payable (AP), Purchase Order (PO), Fixed Assets (FA), Project Accounting (PA), General Ledger (GL), financial reporting support, and other transaction-based services. Delphi is hosted by the ESC at the FAA Mike Monroney Aeronautical Center (MMAC) located in Oklahoma City, Oklahoma.

• ESC’s PRISM application provides a holistic approach to acquisition lifecycle management, transaction processing and reporting to Federal government entities. The acquisition services in scope for this SOC 1 report are provided utilizing the Unison Prism module, with the DOT OAs representing the largest block of acquisition-supported customers. Support services are defined for each customer in annual SLAs, and can include Acquisition processing, as well as Award and Grants processing. While ESC PRISM is hosted by the ESC at the FAA MMAC located in Oklahoma City, Oklahoma, the FAA is not a customer of the system.

1 System and Organization Control and SOC are registered marks of the AICPA, which reserves all rights.

3 SCOPE REQUIREMENTS

3.1 This Statement of Work (SOW) is for an independent audit firm to perform a SSAE Type II Assessment based on:

• Fairness of presentation of description of service organization’s system,

• Suitability of design of controls to achieve related control objectives stated in description, &

• Operating effectiveness of controls to achieve related control objectives stated in description.

Referred to hereafter as Fairness, Suitability, and Operating Effectiveness.

3.2 Contract PoP

3.2.1 Base Year: Annual review of the entire scope of systems / services

3.2.2 Option Year 1: Annual review of the entire scope of systems / services

3.2.3 Option Year 2: Annual review of the entire scope of systems / services

3.2.4 Option Year 3: Annual review of the entire scope of systems / services

3.2.5 Option Year 4: Annual review of the entire scope of systems / services

Task POP’s are estimated for Base year and each option year; if exercised, and will be negotiated with the issuance of individual task orders.

Task PoP SCOPE OF SYSTEM Contract PoP Oct 2022 – Dec 2023 11/1/2022 – 1/31/2023 Fairness CASTLE, Delphi, ESC PRISM, ESC EDC and ESC Level Controls Suitability CASTLE, Delphi, ESC PRISM, ESC EDC and ESC Level Controls Operating effectiveness CASTLE, Delphi, ESC PRISM, ESC EDC and ESC Level Controls

Travel for CLIN 0001

Oct XX – Dec XX, 2023 (TBD) 11/1/2023 – 1/31/2024 Fairness CASTLE, Delphi, ESC PRISM, ESC EDC and ESC Level Controls Suitability CASTLE, Delphi, ESC PRISM, ESC EDC and ESC Level Controls Operating effectiveness CASTLE, Delphi, ESC PRISM, ESC EDC and ESC Level Controls

Travel for CLIN 0003

Oct XX – Dec XX, 2025 (TBD) 11/1/2024 – 1/31/2025 Fairness CASTLE, Delphi, ESC PRISM, ESC EDC and ESC Level Controls Suitability CASTLE, Delphi, ESC PRISM, ESC EDC and ESC Level Controls Operating effectiveness CASTLE, Delphi, ESC PRISM, ESC EDC and ESC Level Controls

Travel for CLIN 0005

Oct XX – Dec XX, 2026 (TBD) 11/1/2025 – 1/31/2026 Fairness CASTLE, Delphi, ESC PRISM, ESC EDC and ESC Level Controls Suitability CASTLE, Delphi, ESC PRISM, ESC EDC and ESC Level Controls Operating effectiveness CASTLE, Delphi, ESC PRISM, ESC EDC and ESC Level Controls

Travel for CLIN 0007

Oct XX – Dec XX, 2027 (TBD) 11/1/2026 – 1/31/2027 Fairness CASTLE, Delphi, ESC PRISM, ESC EDC and ESC Level Controls Suitability CASTLE, Delphi, ESC PRISM, ESC EDC and ESC Level Controls Operating effectiveness CASTLE, Delphi, ESC PRISM, ESC EDC and ESC Level Controls

Travel for CLIN 0009

3.3 Scope Description Summary

The scope of this SOW includes:

• Delphi (DOT's financial application)

• ESC PRISM

• CASTLE/IR, Time and Attendance (T&A)

• Enterprise Services Center’s (ESC), Enterprise Data Center (EDC)

3.4 Scope Detailed

3.4.1 Systems: CASTLE, Delphi & ESC PRISM

3.4.2 Systems hosting includes installation and maintenance; system management; configuration management;

data backup; logical and physical access control; and continuously monitored and controlled environment for HVAC and power (Includes Infrastructure Support).

Systems: ESC EDC

4 OBJECTIVES

4.1 This SOW has two objectives:

• The objective of this SOW is for the Independent Public Accounting (IPA) firm to act as confidential internal auditors (referencing the AICPA’s SSAE, Reporting on Controls at a Service Organization) to support the ESC in its attestation of Fairness, Suitability, and Operating Effectiveness as required by SSAE. This is a Type II engagement and covers Delphi & ESC PRISM.

4.1.1. Fairness

The IPA will perform and document an independent assessment of the fairness of presentation of description of service organization’s system,

4.1.2. Suitability

The IPA will perform and document an independent assessment of the suitability of design of controls to achieve related control objectives stated in description.

4.1.3. Operating Effectiveness

The IPA will perform and document an independent assessment, by individual control, of the effectiveness of these controls, which are stated in the description of ESC's systems / services. This assessment shall document the effectiveness of controls (pass/fail) employed by the ESC as it relates to the service offerings as described in Section 3. If a control does not pass the IPA's test the contractor will support, as requested by the Audit Liaison, the ESC's development of a corrective action.

The final deliverable of each Phase will be a Type II assessment which will become the property of the government and will be used by the ESC as the basis for its attestation in ESC’s annual SSAE Type II engagements in Fiscal Years 2023/2024/2025/2026/2027. The Report will be comprised of two sections;

a summary by the IPA explaining the engagement, and the results of the tests by control. A template is attached for the controls. All documentation will become the property of the government and shall be prepared by the contractor.

• The objective of this SOW is for the Independent Public Accounting (IPA) firm to act as confidential internal auditors to support the ESC in its attestation of Fairness, Suitability, and Operating Effectiveness as required by the DOT Compendium & NIST 800-53. This engagement covers CASTLE.

4.2.1. Fairness

The IPA will perform and document an independent assessment of the fairness of presentation of description of service organization’s system,

4.2.2. Suitability

The IPA will perform and document an independent assessment of the suitability of design of controls to achieve related control objectives stated in description.

4.2.3. Operating Effectiveness

The IPA will perform and document an independent assessment, by individual control, of the effectiveness of these controls, which are stated in the description of ESC's systems / services. This assessment shall document the effectiveness of controls (pass/fail) employed by the ESC as it relates to the service offerings as described in Section 3. If a control does not pass the IPA's test the contractor will support, as requested by the Audit Liaison, the ESC's development of a corrective action.

The final deliverable of each Phase will be a Type II assessment which will become the property of the government and will be used by the ESC, as it prepares for the DOT OIG Financial Statement Audit Engagement in Fiscal Years 2023/2024/2025/2026/2027. The Report will be comprised of two sections;

a summary by the IPA explaining the engagement, and the results of the tests by control. A template is attached for the controls. All documentation will become the property of the government and shall be prepared by the contractor.

5 AUDIT STANDARDS / GUIDANCE

5.1 Audit Standards / Guidance. The Contractor shall perform the review in accordance with standards and guidance established by the American Institute of Certified Public Accountants (AICPA), Government Accountability Office (GAO), Office of Management and Budget (OMB), Public Laws, etc., that are in effect for Fiscal Year (FY) 20220 These include but are not limited to:

5.1.1 AICPA Standards.

5.1.1.1 Codification of Statements on Auditing Standards, AU §324.44.

5.1.2 GAO Standards and Manuals.

5.1.2.1 Generally Accepted Government Auditing Standards (GAGAS).

5.1.2.2 Federal Information Systems Controls Audit Manual (FISCAM).

5.1.2.3 President’s Council on Integrity and Efficiency (PCIE) Financial Audit Manual (FAM).

5.1.3 Public Law.

Federal Information Security Management Act (FISMA), a part of the E-Government Act of 2002 (PL No.

107-347).

5.1.4 National Institute of Standards and Technology (NIST) Standards, as applicable.

5.1.5 DOT Cybersecurity Compendium; latest revision “March 2018”

5.1.6 OMB Memorandums.

6 REQUIREMENTS

6.1 Initial Planning Meeting with ESC Audit Liaison

The Contractor and Audit Liaison shall discuss; via conference call, the internal assessment process and expectations including sampling methodologies, an overview of ESC PBC Tracker Application “ES3”, {Provided by Client (PBC) tracking repository}, and all deliverables. The Contractor shall prepare all documentation, including the Report, using Microsoft Windows Office Suite of products (i.e., Word, Excel) so they are compatible with the Audit Liaison's software. The ESC Audit Liaison will assist the Contractor in the process to obtain personnel security clearances for access to the MMAC for the on-site engagement period.

6.2 Provided by Client (PBC) Requests

To ensure expeditious submittal of PBCs commencing the contractor shall become familiar with the comprehensive system/services controls that are outlined within the ESC SSAE description and controls document. PBC requests shall be incrementally entered by the contractor into the designated ES3 Readiness Assessment PBC Tracker Application. The ESC Audit Liaison will provide an import template to the contractor, so that PBC Requests can be automatically uploaded into the ES3 Readiness Assessment PBC Tracker Application. The contractor shall “assign” each PBC to the applicable point of contact (POC), with a two week suspense date.

6.3 Control Modifications or creation

Throughout each assessment, the contractor may become aware of discrepancies within the ESC SSAE management assertions document, in which ESC needs assistance in modifying the control objectives. In coordination with the ESC Audit Liaison and FAA Contracting Officer, the contractor shall provide revised control language or proposed additional controls that pertain to the scope of the current assessment. Control modifications or the creation of new controls must be negotiated between FAA and the contractor and approved prior to implementation. In doing so, the contractor will have assisted ESC by ensuring it is prepared for official DOT Office of Inspector General (OIG), SSAE Audit Engagement.

6.4 Draft Assessment Report

The results of this assessment will be provided within a 2 section report, consisting of Delphi/ESC PRISM results and another section for CASTLE results. The Delphi/ESC PRISM report will be the basis of and incorporated into ESC's Attestation Report for the FYs 2023/2024/2025/2026/2027. SSAE engagements.

The contractor shall discuss and may incorporate suggestions made by the Audit Liaison, with the exception changing the outcome of the tests.

The contractor will prepare and provide a draft assessment report of all controls, complete with all testing notes and results, in softcopy format. The draft Independent Service Auditor’s Report will document in two sections, the assessment performed; a summary by the IPA explaining the engagement, and the completed testing results by individual control.

6.5 Final Assessment Report

This documentation will become the property of the Government.

The Contractor will prepare and provide a signed final assessment report of all controls, complete with all testing notes and results, in softcopy format. The Independent Service Auditor’s Report will document in two sections, the assessment performed; a summary by the IPA explaining the engagement, and the completed testing results by individual control.

6.6 Work Papers

The Contractor shall protect all work papers from unauthorized access and/or disclosure.

7 CONTRACT DELIVERY SCHEDULE

Delivery Schedule for Base year:

The Contractor shall comply with the following delivery schedule. Any changes to the delivery schedule shall require the COR and/or CO approval. The Contractor shall submit all deliverables to the Audit Liaison no later than 3:00 P.M.

(CT) on the due date.

Delivery schedules will be negotiated for each of the option years. These will be included in the individual task orders.

DELIVERABLE DUE DATE TO AUDIT LIAISON

Provided by Client (PBC) Request ES3 Import Listing 4 weeks prior to onsite testing Provided by Client (PBC) Requests; additional As required Immediate notification of Failed Control As required Draft Assessment Report 1 week prior to End of Performance Period Final Assessment Report, entitled Service Auditor’s Report NLT Last day of Period of Performance Invoice w/Receipts (Electronic Only) NLT 30 days from End of Performance Period

8 SPECIAL CONTRACT REQUIREMENTS

8.1 Contracting Officer (CO), Contracting Officer Representative (COR) / Audit Liaison.

The Contractor shall interact with the Contracting Officer, COR/Audit Liaison. Specifically,

8.2 Contracting Officer (CO)

Franchise Acquisition Division, AAQ-722 MMAC, MBP Bldg.

6500 S. MacArthur Blvd.

Oklahoma City, OK 73169

8.3 Audit Liaison / COR

As assigned by Contracting Officer (CO) Federal Aviation Administration Mike Monroney Aeronautical Center 6500 South MacArthur Boulevard Oklahoma City, Oklahoma 73169

8.4 Contractor Audit Lead / Manager. The contractor shall provide a Lead / Manager who shall be responsible for the performance of the work specified in accordance with the terms and conditions of the resulting contract and/or task orders issued thereunder. The individual shall have full authority to act on behalf of the contractor for all issues pertaining to contract administration for subject contract. The Lead/Manager will possess at least three years of SAS70 and SSAE audit experience for government agencies similar in scope to that of ESC’s requirement. The lead/manager must be a Certified Public Accountant (CPA) and possess a certification in one of the following:

Certified Information Systems Auditor (CISA) or Certified Information Systems Manager (CISM) or equivalent.

Equivalent certification must be validated. Qualifications of the proposed lead/manager are subject to Government review and approval and will be considered “Key Personnel” in the performance of this contract.

Contractor Audit Lead / Manager is considered Key Personnel and as such must be employed with the firm at the time of award and shall be maintained to the maximum extent possible throughout this program. Should changes be necessary, the contractor shall notify the Government in writing of the proposed substitution and their qualifications. Implementation of the changes shall be subject to Government approval in accordance with Clause 3.8.2-17 (Key Personnel and Facilities.) If the Government determines that certain personnel are considered “key” to successful completion of a task order, they will be designated as key task order personnel in the task order and subject to the provisions of the aforementioned clause. Resumes shall be submitted detailing the qualifications and experience of key personnel prior to award. The Government retains the authority to accept or reject the qualifications of any key personnel.

8.5 Support Audit Team. The contractor shall provide highly skilled and qualified auditors to support the Audit Lead/Manager in the performance of all SSAE Readiness Assessments.

Each auditor must have at a minimum:

-two (2) years of auditing experience in SSAE Examinations or Information Technology Audits; and -Certified to an industry standard such as CISA, CISM or equivalent.

The contractor must provide resumes for support auditors that may be substituted during the performance of the contract. The Government retains the authority to accept or reject the qualifications of the support auditors.

Prior to the audit team being issued Government Furnished Equipment (GFE) (Laptop), each contractor must take the latest Security Training and provide a copy of the certificate to the ESC COR. Security Training Includes DOT Security Awareness Training (SAT) and Office of Security and Hazardous Materials Safety (ASH) Security Awareness Virtual Initiative (SAVI) Training

8.6 Confidentiality Statement. All work performed under this contract is confidential and is not to be released to outside parties without the ESC’s written permission.

8.7 Security Clearances. All Contractor employees working on this SOW are will have a Background Investigation completed justifying a Risk Level of Moderate.

In order for the contactor to support this contract, they will be required to obtain the FAA PIV Card, as it is required to access the FAA Network and/or systems, such as the ES3 Readiness Assessment PBC Tracker Application. The ESC Audit Liaison will assist contractors in obtaining the government identification badges;

however they will need access to a DOT Government Location, so that the FAA PIV can be enabled.

8.8 Geographic Locations. Due to COVID-19 Pandemic, no travel is required at this time. Should travel be required, the Contractor will work on-site, in government furnished facilities at the FAA’s Mike Monroney Aeronautical Center, in Oklahoma City, Oklahoma.

8.9 Building Access. Building access during off duty hours is not needed for this SOW.

8.10 Government Furnished Property and Work Space. Due to COVID-19 Pandemic, all work is conducted remotely; onsite work is not required for this SOW. Should the remote work requirement be terminated, the ESC will supply work areas, at least one LAN line telephone, desks, and chairs at the MMAC in Oklahoma City, Oklahoma for the period of on-site performance. The Contractor must ensure that sensitive and confidential information and documentation is kept in a locked, secure place when not in use by contract staff, and must ensure that Government property is kept locked up after regular business working hours (6 a.m. - 6 p.m. Monday – Friday, except for government holidays or shutdowns). The Government will issue a temporary laptop to use for this task and will returned to the Government when during the exit meeting.

The Contractor will supply its own monitors, printers, calculators, office supplies, and other equipment. The contractor will allow the FAA, MMAC Helpdesk Team the opportunity to scan their device(s) prior to accessing the FAA Network Connection while onsite at the FAA MMAC.

8.11 Furnished Software. Furnished software will not be included within this SOW. The ES3 Readiness Assessment PBC Tracker Application, referenced above, is a .Net application and can only be accessed from within the FAA Firewall.

8.12 Travel. Due to COVID-19 Pandemic, no travel is required at this time. Should travel be required on future option years, SOW & IGCE will be amended. The Contractor shall be reimbursed for authorized travel IAW the Federal Travel Regulations (FTR) and applicable AMS clause(s). The contractor will provide travel authorizations for COR review and approval prior to travel. Reference AMS Clause 3.3.2-2 Reimbursement for Travel and Subsistence incorporated into the contract.

9 LIST OF DOCUMENTS, EXHIBITS AND ATTACHMENTS

The following list applies to the base year. Attachments for option years will be provided with each individual task order issued, or as needed.

• SSAE Management Assertions – GITC Description & Controls

The Contractor will prepare and deliver the completed forms below in the format provided as part of the solicitation, which shall become part of the official file:

• DOT Sensitive Information Form; for each contractor supporting this contract