BTFA_SOW_2026-2031_v4_07082025_1.pdf

STATEMENT OF WORK

ANNUAL FINANCIAL STATEMENT AUDIT

FY 2026

Task

Financial Statement Audits of Tribal and Other Trust Funds and Individual Indian Money Accounts

I. OBJECTIVE

The objective of the Task is to obtain independent audits of the Indian trust fund managed by the Bureau of Trust Funds Administration (BTFA) for FY 2026.

II. ENTITY TO BE AUDITED

The Indian trust consists of 55 million surface acres and 57 million acres of subsurface minerals estates held in trust by the United States for American Indians, Indian tribes, and Alaska Natives. Over 11 million acres belong to individual Indians and nearly 44 million acres are held in trust for Indian tribes. On these lands, the U.S. Department of the Interior manages more than 122,817 leases. It also manages approximately $8.8 billion in trust funds.

Established by the American Indian Trust Fund Management Reform Act of 1994 (Public Law 103-412), the Office of the Special Trustee for American Indians (OST) was created to improve the accountability and management of Indian funds held in trust by the federal government. As trustee, OST had the primary fiduciary responsibility to manage both tribal trust funds and Individual Indian Money (IIM) accounts.

However, section 304(a) of the Indian Trust Asset Reform Act (ITARA), passed in June 2016, required the Secretary of Interior to prepare and submit a plan for the transition of OST’s functions to other Bureaus/Offices with DOI. Effective October 1, 2020, the Department realigned OST’s financial trust asset management functions to the Assistant Secretary for Indian Affairs and placed them in a new and separate organization, the Bureau of Trust Funds Administration (BTFA).

BTFA carries out its mission in pursuit of the following three goals:

1. To protect and preserve Indian trust assets by receipting and accurately accounting for income due to beneficiaries;

2. To provide all tribal and IIM account holders with information on their trust accounts that is timely and accurate; and

3. To engage beneficiaries in the management of their trust assets to allow them to make informed decisions.

The trust funds’ most recent financial statement audits are available upon request.

III. AUDIT BACKGROUND

This audit is required by the Chief Financial Officers (CFO) Act of 1990 (Public Law 101-576), as amended, and the Government Management Reform Act (GMRA) of 1994 (Public Law 103- 356). The audit of BTFA’s financial statements supports the annual audit of DOI’s consolidated financial statements. The Government Accountability Office (GAO) is responsible for the audit of the consolidated financial statements of the U.S. Government.

IV. AUDIT REQUIREMENT

The Contractor shall be required to conduct a full scope financial audit of BTFA’s Tribal and Other Trust Funds financial statements and Individual Indian Monies Trust Funds, collectively referred to as the “Trust Funds Financial Statements” for the fiscal year ending September 30, 2026.

The audits shall encompass all Indian and other trust funds managed by BTFA inclusive of funds in the following seven Treasury account symbols under Agency Location Code [14210651]:

Treasury Account Symbol Description 14X6039 Individual Indian Monies 14X5265 Tribal Special Fund 14X6140 Deposits of Proceeds of Lands Withdrawn for

Native Selection 14X6803 Tribal Deposit Fund 14X8030 Tribal Trust Fund 14X3220 Misc. Treasury Receipts

Additional Indian trust funds may be established at any time during the performance period.

Existing funds may also be combined, separated, or closed during the performance period.

Agency Location Code [14010001] and Treasury Account Symbol [140X0120], BTFA’s administrative program operating appropriation account, and the program operating accounts of other bureaus and agencies are not included in the scope of these audits.

The audit shall be performed in accordance with generally accepted government auditing standards (GAGAS), as specified in the most current version of the GAO’s Government Auditing Standards (GAS), and any additional audit requirements of the OMB or other authoritative sources. In conducting the audit, the methodology used shall be at a minimum, consistent with the most current version of the GAO/CIGIE FAM. Should there be any deviations from the methodology set forth in the FAM, the Contractor must provide documentation to the COR on a timely basis, demonstrating how the Contractor’s methodology satisfies the requirements of the FAM. The COR shall be notified immediately of any significant planned deviations from the

FAM.

A. Deliverables

The Contractor shall provide the following deliverables:

• Staffing list

• Independence/quality control assurance statement

• Detailed Audit Planning Document

• Audit programs

• Notification of Findings and Recommendations (NFR)

• Summary of Uncorrected Misstatements

• Status and Other Meeting Agendas

• Monthly progress reports

• Summary memo documenting the procedures performed, results, and conclusions by cycle area

• Auditors’ Reports

• Annual Report

B. Opinions

Opinions are not to be discussed with any BTFA personnel without prior approval of the Contracting Officer’s Representative (COR).

C. Information System Control Environment Review

As part of the Trust Funds Financial Statement Audit, the Contractor shall perform procedures to assess the effectiveness of the IT control environment (general and application controls).

The procedures will focus on evaluating the adequacy of information systems controls over the GAO’s Federal Information System Controls Audit Manual (FISCAM) general control areas.

This work may be utilized by other DOI OIG auditors (or contractors working on behalf of DOI OIG) with respect to the Federal Information Security Management Act (FISMA) requirements.

Thus, the information system control environment review performed under this task shall be coordinated with the OIG auditors to ensure the work is completed timely enough for the other auditors to use in performing their audits.

D. BTFA Annual Report

The Contractor shall determine whether information presented in the BTFA Annual Report is materially consistent with the Trust Funds Financial Statements. The BTFA Annual Report will include the annual Trust Funds Financial Statements and is issued approximately one week before DOI’s annual Agency Financial Report.

V. INDEPENDENCE

Throughout the audit, the Contractor shall immediately inform the COR via e-mail if the Contractor is considering proposing or has already proposed on any contracts involving this reporting entity or involving a DOI entity that may impact this reporting entity. The Contractor, in a separate statement, shall represent that it will remain independent with respect to this reporting entity. The COR will then evaluate whether award of these contracts could impair the Contractor’s independence with respect to the audit of this reporting entity. The Contractor shall notify the COR of the DOI entity, the type of contract services to be provided, the period covered and provide a copy of the applicable statement of work describing the requirements.

VI. DELIVERABLES

A. Staffing List

The Contractor shall submit, to the COR and task monitor, a list of the assigned engagement staff and their resumes (those that were not submitted with the initial proposal), including security clearance level within 15 business days after the effective date of award of the base period and for subsequent changes in staffing during the period of performance (including subsequently exercised option periods). In addition, the security clearance of each individual should be disclosed. If no clearance has been completed on an individual, please state whether the clearance is in progress. The Contractor shall notify the COR 15 business days in advance of any proposed changes to the engagement staff to ensure that any new personnel meet the qualification requirements. In the event there is a disagreement between the COR and the Contractor regarding whether the engagement staff meets the qualification requirements, the Contracting Officer will make the final decisions.

B. Independence/Quality Control Assurance Statement

The Contractor shall submit an Independence/Quality Control Assurance Statement within 15 calendar days of issuance of the task order. This assurance shall address each of the following items:

• A statement that the firm is independent with respect to this reporting entity, and that all personnel assigned to this audit maintain the number of required continuing professional education (CPEs).

• Any existing, ongoing or planned non-audit services with respect to this reporting entity.

• Any lawsuits with this reporting entity.

• Any relationships with this reporting entity that could impair independence.

• Explanation of the firm’s current internal quality management system, including such items as audit documentation review procedures, staff independence requirements, and continuing professional education requirements.

• A copy of the firm’s most recent internal inspection report or equivalent if available, external Peer Review, Letter of Comments, and Management’s response. If the peer review report is more than one year old, the firm shall discuss any changes to its quality control policies and procedures since the peer review and the results of its most recent internal inspection, including the date of the report, the period of the report, and any opinion resulting from the inspection.

• Results or a copy of the firm’s most recent Inspection Report prepared by the Public

Company Accounting Oversight Board and the firm’s response.

C. Detailed Audit Planning Document

A Detailed Audit Planning Document shall be submitted no later than 45 working days after award of the fiscal year being audited. The planning document shall include information on the following areas, at a minimum:

• Amount and basis for materiality

• Travel plan

• Staffing and review requirements

• Audit timing, including milestones and the estimated date of the auditors’ reports

For any methodology other than the GAO/CIGIE FAM, the Contractor must provide documentation to the OIG on a timely basis, demonstrating how the Contractor’s methodology satisfies the requirements of the FAM.

The COR/task monitor is responsible for review and acceptance of the Detailed Audit Planning Document. Review comments will be provided to the Contractor no later than five (5) working days after receipt of the documents.

D. Proposed audit programs for interim and year-end testing.

Draft audit programs shall be submitted no later than June 30 of the fiscal year being audited.

While the audit program may be modeled after standard work programs guidance issued by the GAO/CIGIE, AICPA or other organizations, it shall be specific to the entity under audit.

The COR/task monitor is responsible for review and acceptance of the audit programs. Review comments will be provided to the Contractor no later than five (5) working days after receipt of the documents.

E. Notification of Findings and Recommendations (NFR)

The COR and task monitor shall be kept advised of all findings and issues (both IT and financial issues). NFRs should be issued, as the finding is identified, not at the end of the audit. Prior to issuing NFRs to component management, copies of the NFRs, including recommendations, shall be provided to the task monitor at least 48 hours in advance via e-mail. Upon receiving concurrence from the task monitor, the Contractor shall provide draft NFRs of all potential findings to component management and request that they review and respond to the findings’ factual accuracy within five (5) business days. Copies of component responses shall also be provided to the task monitor. At a minimum, the NFRs should include condition, cause, criteria, effect, and recommendation.

NFRs should provide detailed perspective by describing the nature and extent of the issues being reported and the extent of the work performed that resulted in the finding. For repeat NFRs, consideration should be given to understand the implementation of prior recommendations as applicable.

F. Unadjusted Audit Differences

The Contractor shall provide four (4) business days prior to the anticipated end of fieldwork, a Summary of Unadjusted Differences (SUD) to the COR/task monitor.

G. Status and Other Meetings

Status meetings among the Contractor, BTFA management, and COR (or task monitor) will be held on a bi-weekly basis or as mutually agreed to by the aforementioned individuals. At least one business day (24 hours) in advance of each status meeting, the Contractor will provide a proposed written briefing agenda to both the COR/task monitor and BTFA, preferably via e-mail. The COR and task monitor shall be notified in advance of other meetings held to discuss audit issues and will attend as needed. Additionally, if there is any change in the scope of the audit, a meeting must be conducted with the DOI OIG.

H. Monthly Progress Reports

Monthly progress reports shall be submitted to the COR no later than the fifth (5th) working day of each month following the reported month. At a minimum, the monthly report shall detail objectives, accomplishments, complications, unresolved issues, delays, and adverse conditions.

The report shall also include a staffing list indicating hours charged to the audit to date by each team member.

I. Cycle Area Summary Memos

The Contractor shall provide to the COR and task monitor on the last day of fieldwork documentation of procedures performed, results, and conclusions in summary memos by cycle area. At a minimum, the memo should include conclusions about significant issues and their resolutions and significant judgments and their conclusions.

J. Reports

The Contractor shall issue the Annual Report, inclusive of the following sections:

• Letter from the BTFA Director (provided by BTFA management)

• OIG Memorandum (provided by the OIG)

• Independent Auditors’ Reports on the financial statements

• Financial statements and accompanying notes

• Independent Auditors’ Reports on Internal Control Over Financial Reporting and on

Compliance and Other Matters

For internal control deficiencies that are not a reportable condition in the above reports, the Contractor shall communicate the results in a management letter as described in Standards issued by the AICPA.

The Contractor shall issue all draft and final reports in compliance with the requirements of Section 508 of the Rehabilitation Act of 1973, as amended. If the reports produced and submitted under this task are not Section 508-compliant, the Contractor will provide a remedy at no cost to the Government.

VII. SUBMISSION DATES

A schedule of due dates for the draft and final Annual Report will be determined through discussions with BTFA management and the COR. The schedule of due dates will be communicated to the contractor no later than April 30 of the fiscal year being audited. For FY 2026, it is anticipated that the draft reports shall be due no later than October 15, and the final reports due no later than November 10.

VIII. ARTIFICIAL INTELLIGENCE

The Contractor is barred from using Artificial Intelligence (AI) systems that operate in an autonomous mode to meet deliverables. Instead, the Contractor must exercise human supervision of AI system outputs as defined in “human-in-the-loop” or “human-on-the-loop.”

The Contractor is barred from using a Cloud-based AI system for processing DOI data for the purposes of meeting contract deliverables.

The Contractor shall provide evidence demonstrating that the outputs of any generative AI system used in meeting contract deliverables is reliable, trustworthy, and bias free.

The Contractor shall provide evidence, as applicable, that any AI systems used in the performance of the contract comply with the October 30, 2023, Executive Order on the “Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence.”

IX. ACCEPTANCE OF DELIVERABLES

Unless otherwise specified under this task order, the COR/task monitor will have seven (7) working days to accept or reject deliverables provided by the contractor under this task order.

The COR/task monitor will notify the contractor upon acceptance of each deliverable.

In the event that a deliverable is rejected, the Contractor will be notified in writing of the rejection and the specific deficiency. The contractor will be required to correct and resubmit the item(s) within seven (7) calendar days. The COR/task monitor will have five (5) calendar days to review any corrected deliverables.

X. TERMS AND CONDITIONS

The Contractor shall propose pricing in accordance with Attachment 2 – Pricing Spreadsheet of the contract and the technical approach described in this task order Statement or Work.

XI. CONTRACTING OFFICERS REPRESENTATIVE AND TASK MONITOR

Wherever the term COR is used in this statement of work, it means the Financial Audit Director of the DOI OIG. A task monitor for this audit may also be assigned and will oversee the day-to-day activities of the audit.

XII. GOVERNMENT FURNISHED PROPERTY

BTFA will provide work areas, telephones, desks, chairs, reproduction capabilities, facsimile capabilities, access to email and DOI’s financial accounting system for the Contractor. The Department will require the contractor to connect to its computer network or store information1 using a BTFA-issued personal computer. The Contractor shall request BTFA to make the necessary arrangements.

1 “Information” defined in Section XV.A.1.

XIII. STAFFING

A. Key Personnel

The Contractor must identify in the technical proposal, the key personnel at the technical expertise level (i.e., statistician, information systems experts), and senior level management (senior auditor and above) assigned to the contract, as well as the total number of personnel assigned to the audit, the position of each person and the expected number of work hours of each. Any subsequent changes in key personnel from those in the technical proposal must be approved in advance by the COR.

All proposed personnel must meet or exceed the required statement of work and corresponding GSA labor category requirements.

B. Minimum Staff Requirements

Audit Partner/Principal The minimum experience requirements in this category include: (a) being a Partner or Principal in the Contractor’s organization, (b) having a minimum of seven (7) years audit general audit experience and three (3) years Federal government audit experience, and (c) being a Certified Public Accountant. The responsibilities in this category include overall project management and final review.

Audit Manager The minimum experience requirements in this category include: (a) being a Manager in the Contractor’s organization, (b) having a minimum of five (5) years general experience and two

(2) years Federal audit experience at a supervisory level, and (c) being a Certified Public Accountant. The responsibilities in this category include management and supervision of an audit team or teams including on-site quality control.

Supervisory Senior Auditor The minimum experience requirements in this category include: (a) being a Supervising Senior in the Contractor’s organization, (b) having a minimum of four (4) years general audit experience and two (2) years Federal audit experience, and (c) having 24 semester hours in accounting. The responsibilities in this category include on-site supervision of major segments of an audit being performed by senior or staff auditors.

Senior Auditor The minimum experience requirements in this category include: (a) being a Senior in the Contractor’s organization, (b) having a minimum of two (2) years audit experience and one (1) year Federal audit experience, and (c) having 24 semester hours in accounting. The responsibilities in this category include independent performance of a major segment of an audit.

Staff Auditor The minimum experience requirements in this category include having: (a) 24 semester hours in accounting, and (b) a four (4) year college degree. The responsibilities in this category include performing audit steps under the supervision of a supervisor or a senior auditor.

IS/IT Audit Partner The minimum experience requirements in this category include: (a) having a minimum of 10 years technical experience, and (b) being a Certified Information Systems Auditor or Certified Public Accountant. The responsibilities in this category include overall project management and final review.

IS/IT Audit Manager The minimum experience requirements in this category include: (a) having a minimum of five

(5) years technical experience, and (b) being a Certified Information Systems Auditor, Certified Information Systems Security Professional, or Certified Public Accountant. The responsibilities in this category include management and supervision of an audit team or teams including on-site quality control.

IS/IT Senior Auditor The minimum experience requirements in this category include having: a minimum of two (2) years technical experience, and (b) a bachelor’s degree in an appropriate technical field. The responsibilities in this category include independent performance of a major segment of an audit.

IS/IT Staff Auditor The minimum requirement in this category is having a bachelor’s degree in an appropriate technical field. The responsibilities in this category include performing audit steps under the supervision of a supervisor or a senior auditor.

C. Resumes

The Contractor shall include the resume of all key personnel proposed under this effort.

Whenever new personnel are hired or considered for this effort, the Contractor shall provide resumes to the COR for approval. At the time of award, the Contractor shall provide the resumes to the COR for non-key personnel.

For each option year that is exercised, the Contractor shall provide resumes for all new personnel proposed.

D. Confidentiality and Nondisclosure

By agreeing to this task order and/or any amendments, the Contractor acknowledges, understands, and accepts the following:

1. The Contractor and any Subcontractor(s) shall presume that the DOI computer systems and storage media that the Contractor or Subcontractor access have sensitive information and applications. The Contractor will comply with the contractual security requirements.

2. Any DOI information, software, applications, computer systems and hardware accessed by the Contractor in the performance of the task order remain the sole property of DOI.

3. To the extent that any software or applications on the DOI systems are protected by copyright, the Contractor agrees that it will not copy or disclose them without first obtaining the DOI OIG’s prior written authorization, which will be provided only where authorized under applicable copyright law.

4. The Contractor, the Contractor’s employees, and any Subcontractor and Subcontractor’s employees will access, or be provided access to, the DOI information, software, applications, computer systems and hardware only to the extent necessary, and only for the purpose of, performing the task order. The Contractor will take reasonable steps to ensure that it will allow only those Contractor and Subcontractor employees who need to see the DOI materials to perform the requirements of the task order, to do so. This agreement also applies to any other DOI systems or data to which the Contractor may have access to or be disclosed to the Contractor.

5. The Contractor will not authorize anyone other than those individuals who require information to perform under the task order to access, disclose, modify, or destroy the information, software or applications on the DOI systems provided or accessed under this task order without the DOI and OIG’s prior written authorization. The Contractor will refer all requests or demands for production of or access to DOI data and systems, including court orders, to the DOI, OIG, and COR for response.

6. Except as authorized under this task order, the Contractor and its employees shall not make any copies of any DOI information, including software or applications that are not copyrighted. Any copies made by the Contractor or Subcontractor shall be handled as sensitive information.

7. Except to the extent necessary to perform the task order, any information that the Contractor and its employees learn from and about DOI data and DOI computer systems shall not be recorded, and such information, whether recorded or not, shall be handled as sensitive information under this agreement. The Contractor may not use or disclose this data except as the Contractor is permitted to use or disclose DOI sensitive information under the task order and this nondisclosure agreement.

8. Upon completion or termination of the task order for any reason, the Contractor will immediately deliver all non-public DOI records, data, copies of DOI records and data, software and equipment, and information about DOI data and systems recorded or documented by the Contractor, in its possession or the possession of any Subcontractors to the DOI OIG COR. The Contractor may retain non-public copies of any of these document or data necessary to support audit report conclusions, peer review requirements, and GAO oversight.

9. The Contractor will be responsible for the actions of all individuals provided to work for DOI OIG under this task order.

XIV. SECURITY REQUIREMENTS

A. Contractor Personnel

All Contractor and Subcontractor personnel performing work under this task order shall satisfy all requirements for appropriate suitability determinations when accessing information and information systems belonging to or being used on behalf of DOI. To satisfy this requirement, all Contractor and Subcontractor personnel on this audit, must attend identity enrollment at a USAccess Credentialing Center, receive Tier 2 or equivalent investigation, scheduled or completed by DCSA (Defense Counterintelligence and Security Agency) or equivalent service provider. The Contractor shall be responsible for ensuring compliance with these requirements by all the Contractor’s and Subcontractor’s staff even if the level of clearance requirements change.

Evidence of the appropriate background investigation must be presented for each assigned Contractor personnel prior to commencing work under this task order. For assigned staff with prior background investigations, the Contractor will indicate the type of investigation, the authority or agency who conducted the review, and the date of the clearance. The investigative history for Contractor personnel must be maintained in the databases of either the OPM or the DCSA. Prior background investigations will be considered on a case by case basis for acceptance of fulfilling the DOI requirement. Until the appropriate clearances or interim clearances are granted, Contract staff will not be allowed to work on the audit. Whenever new personnel are hired or considered for this assignment, the Contractor should expedite security paperwork to minimize the waiting period before staff can be used on the audit. All costs associated with obtaining clearances for Contractor provided personnel will be the responsibility of the Contractor. In addition, the Contractor will be responsible for all fees associated with Personal Identity Verification (PIV) Cards, if applicable, and any applicable monthly maintenance costs. Fee schedule is available upon request and subject to changes in the current contract with GSA or any subsequent modification. Any background investigations that the Contractor coordinates through DOI will be billed to the Contractor for reimbursement by the appropriate DOI office.

The contractor shall safeguard all personally identifiable information (PII) in accordance with the Privacy Act of 1974, 5 U.S.C. §552a, and DoD Regulation 5400.11-R during the period of performance. The Contractor shall inform the OIG and audited entity within 24 hours of learning that DOI PII was compromised, lost or stolen. Depending on the nature of information compromised, lost or stolen, the Government has the right to invoke disciplinary action which may include civil and criminal penalties as outlined in DoD Regulation 5400.11-R, September 1, 2011. The Contractor shall ensure, by contract, that the requirements of this section are made applicable to any subcontractor(s) working on the task order.

B. Contractor System Security

The Contractor is barred from transmitting, storing, manipulating, or processing any government data on contractor workstations, servers, or in a non-FedRAMP-authorized cloud environment. Any systems that are used or operate within the contractor’s environment must be FISMA-compliant and meet DOI security policies and if data is stored, transmitted, or processed in a cloud environment must be FedRAMP-authorized. A cloud environment allows one person to upload data, and it is accessible by another person or in another location. The Contractor may not utilize cloud technology to store, transmit, manipulate, or process government data unless it is in a FedRAMP-authorized system. The Contractor is barred from using non-FedRAMP-authorized cloud-based systems for storing, transmitting, manipulating, or processing DOI data for the purposes of meeting contract deliverables.

The Contractor shall provide evidence, as applicable, that any cloud systems used in the performance of the contract comply with and are FedRAMP-authorized.

The Contractor shall ensure all Contractor IT equipment utilized under this task order is configured for the data, information, and system security requirements in accordance with DOI standard operating procedures and Federal laws, regulations, and standards. Additionally, all IT equipment utilized shall meet or exceed the Government minimum requirements for security and meet the information safeguards required by NIST SP 800-171 and DFARS 252.204-7012, “Safeguarding Covered Defense Information and Cyber Incident Reporting”. All DOI data shall be considered sensitive information, and thus must be protected by appropriate and prudent security measures, such as approved firewalls, Government-approved encryption, etc.

The COR will immediately report any violation or suspected violation to the Contracting Officer and OIG Office of Security. Any violators will temporarily or permanently be removed from the project. If a contractor has a common access card (CAC) or SIPRNet token issued from a previous engagement with another agency, that CAC and SIPRNet token must be returned to that agency before issuance of an entity sponsored CAC or SIPRNet token.

C. Contractor Security Training

All Contractor and Subcontractor employees under this task order who require access to any DOI IT system are required to complete an information security awareness course and an information privacy awareness course designated by the DOI OIG COR prior to commencement of work, and then annually thereafter. Contractors must provide copies of the certifications of completion to the COR and must maintain copies of the completion certificates for the life of this task order. This requirement is in addition to any other training that may be required of the Contractor and Subcontractor(s).

XV. PRIVACY REQUIREMENTS

A. Basic Safeguarding of Covered Contractor Information Systems

(1) Definitions. As used in this clause –

Covered contractor information system means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

Federal contract information means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public websites) or simple transactional information, such as necessary to process payments.

Information means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual.

Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (44 USC 3502).

Safeguarding means measures or controls that are prescribed to protect information systems.

(2) Safeguarding requirements and procedures.

(a) The Contractor shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls:

(i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

(ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

(iii) Verify and control/limit connections to and use of external information systems.

(iv) Control information posted or processed on publicly accessible information systems.

(v) Identify information system users, processes acting on behalf of users, or devices.

(vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

(vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

(viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access;

and control and manage physical access devices.

(x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

(xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

(xii) Identify, report, and correct information and information system flaws in a timely manner.

(xiii) Provide protection from malicious code at appropriate locations within organizational information systems.

(xiv) Update malicious code protection mechanisms when new releases are available.

(xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

(b) Other requirements. This clause does not relieve the Contractor of any other specific safeguarding requirements specified by Federal agencies and departments relating to covered contractor information systems generally or other Federal safeguarding requirements for controlled unclassified information (CUI) as established by Executive Order 13556.

(c) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract, in which the subcontractor may have Federal contract information residing in or transiting through its information system.

B. Privacy Training

(1) Definition. As used in this clause, personally identifiable information means information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual (see OMB Circular A- 130, Managing Federal Information as a Strategic Resource).

(2) Contractor shall ensure that initial privacy training, and annual privacy training thereafter, is completed by contractor employees who –

(a) Have access to a system of records;

(b) Create, collect, use, process, store, maintain, disseminate, disclose, or otherwise handle personally identifiable information on behalf of an agency; or

(c) Design, develop, maintain, or operate a system of records.

(3) The contracting agency will provide initial privacy training, and annual privacy training thereafter, to Contractor employees for the duration of this contract.

(4) The Contractor shall maintain and provide documentation of completion of privacy training to the COR.

(5) The Contractor shall not allow any employee access to a system of records, or permit any employee to create, collect, use, process, store, maintain, disseminate, disclose, dispose or otherwise handle personally identifiable information, or to design, develop, maintain, or operate a system of records unless the employee has completed privacy training, as required by this clause.

(6) The substance of this clause, including this paragraph (6), shall be included in all subcontracts under this contract, when subcontractor employees will –

(a) Have access to a system of records;

(b) Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information; or

(c) Design, develop, maintain, or operate a system of records.

XVI. AUDIT DOCUMENTATION, ACCESS TO AUDIT DOCUMENTATION AND SECURITY OF

AUDIT DOCUMENTATION

The DOI OIG shall always have ongoing access to auditors and audit documentation and may perform reviews at an interim basis after the completion of each phase of the audit. The Contractor shall, at no additional cost, provide audit documentation to the DOI OIG upon request. The Contractor shall, at no additional cost, provide training to DOI OIG staff on the usage of electronic audit documentation programs if required. Audit documentation is also subject to review by other Government auditors such as the GAO, therefore, the Contractor shall make audit documentation available to the GAO or any other federal entity conducting a peer review or any other review or audit of the DOI OIG. Based on the results of these reviews, the Contractor may be required by the COR to perform corrective action and/or additional work within the scope of the task necessary to support its audit conclusions, if necessary.

The Contractor shall provide copies of the audit documentation (i.e. workpapers) that pertain to audit evidence gathered in support of final audit reports, prepared in accordance with GAS, to the DOI OIG and COR at no additional cost. The DOI OIG will accept electronic workpapers and adequately cross referenced hard-copy files to meet this requirement. These documents shall become the property of DOI but shall not be disclosed outside of DOI and other federal agencies unless required by other statutory or regulatory requirements, without the prior consent of the contractor.

XVII. SUBCONTRACTING RESTRICTION

Except as specifically approved in writing, in advance by the CO, the Contractor shall not subcontract any work procured hereunder. It is contemplated that approval will be given for subcontracting certain phases of the work when, in the opinion of the COR and the CO, such subcontracting will not adversely affect delivery of the final product, the quality, or independence (in fact or appearance) of the contracted firm. If subcontractors are proposed, approval will be given at time of award.

XVIII. PERIOD OF PERFORMANCE

The period of performance for this task order shall be a base period starting on the day of award through December 31, 2026, plus four option years running from January 1 through December 31 of the successive four calendar years.

The option years will be exercised at the Government’s convenience and are subject to funding.

The technical and price proposals must separate the base and option years.

XIX. PLACE OF PERFORMANCE

BTFA operations are headquartered in Albuquerque, New Mexico. Minimal travel for site visits may be required.

Telework and remote work is permitted but based on position requirements and responsibilities; however, such arrangements should be approved by the COR in advance.

XX. TRAVEL

The Contractor will be reimbursed for travel costs incurred in accordance with Federal travel regulations. The Contractor shall be prudent in making travel arrangements to minimize the cost to the government. Profit and indirect rates, such as G&A, are not allowable on travel costs. All travel costs are to be included in the fixed price quotes from the Contractor. The Contractor will be required to submit receipts for airfare, hotel, rental car, and any other costs more than $75 to the COR. Travel must be reviewed and approved by the COR prior to booking.

The Contractor shall use the attached Travel Authorization Form to submit travel requests.