RFP_Solicitation_V5.docx

RFP CC15HQR0015

IBM Notes Support Services

PART I: SCHEDULE

SECTION B – SUPPLIES OR SERVICES AND PRICES/COSTS

B.1 SCHEDULE OF SUPPLIES/SERVICES

In accordance with this contract, Offerors shall provide all management, personnel, materials, labor, equipment and services, except as specified herein to be furnished by the Government, and shall do all that which is necessary to satisfy the requirements listed in Section C – Performance Work Statement. These prices listed herein shall be in effect through the period of performance of the resulting contract.

Contract line item (CLIN) prices shall be proposed in MS Excel Spreadsheet format. Proposed prices must be, as applicable: (1) fully loaded firm fixed prices; (2) appropriate labor categories and rates for the tasks identified in the PWS; and (3) propose to the full performance objectives outlined in the PWS. The CLINs outlined are indicative of the pricing schedule being considered by the Government; however, responding vendors may modify the pricing templates or provide a substitute format that clearly addresses how pricing was derived and is commensurate with the Offeror’s technical proposal.

B.2 LABOR CATEGORIES AND CEILINGS

For CLINs designated as Labor Hour (LH), Offerors may use any combination of hours of labor categories in any task, as necessary to perform the task, provided that the Offeror understands that in the resulting contract, the selected Contractor can not exceed the task ceiling price without the prior written approval of the Contracting Officer. The selected Contractor shall notify the Contracting Officer in writing on a monthly basis whenever it has reason to believe that the level of effort expended in the performance of the labor hour task will exceed seventy-five (75%) percent of the level of effort established for the contract. As part of the notification, the selected Contractor shall provide the Contracting Officer a revised estimate of the level of effort required to perform the LH task(s).

B.3 LINE ITEM DESCRIPTION

The fully burdened hourly rates apply to all direct labor rates and are applicable to both on-site and off-site activities. Direct labor hours include all labor performed by personnel actually engaged in direct performance of the work required under this contract.

B.4 CONTRACT LINE ITEM NUMBERS (CLINS) – FIRM FIXED PRICE (FFP) AND LABOR HOUR (LH)

Base Period:

Option Period I:

Option Period II:

Option Period III:

Option Period IV:

Total Contract Value (Base Period + All Option Periods):

Notes:

FFP: Firm-Fixed-Price LH: Labor-Hours NSP: Not separately priced

The Offeror shall fill in the Rate column and the Total Price column. For the Offeror’s convenience, an Excel spreadsheet of the Price Schedule is included as Attachment 5 of Section J.

End of Section B

SECTION C – DESCRIPTION/SPECIFICATIONS/PEFORMANCE OF WORK

Please see Attachment 1, Performance Work Statement, and its associated Appendices for further details and information.

End of Section C

SECTION D – PACKAGING AND MARKING

D.1 PAYMENT OF POSTAGE AND FEES

All postage and fees related to submitting information, including forms, reports, etc., to the Contracting Officer or the Contracting Officer’s Representative (COR) shall be paid by the Contractor.

D.2 MARKING

All information submitted to the Contracting Officer or the COR shall be clearly marked to show the following:

1. Name of the Contractor

2. Contract Number; and

3. Consignee’s name and address

4. Date of Submission

D.3 REPORT COVER SHEET

Each report submitted by the Contractor shall have a cover sheet containing the following information:

1. Title of Report

2. Report Number or Type

3. Period covered by the report

4. Contract Number

5. Name and address of the Contractor

6. Name of the COR

7. Date of Submission

End of Section D

SECTION E – INSPECTION AND ACCEPTANCE

E.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this address:

<https://www.acquisition.gov>

Inspection and acceptance of the supplies and services to be furnished hereunder shall be performed at destination determined by the COR. The COR will provide written notification of the Government’s final acceptance of all services. Acceptance will only occur when the accepting authority is sure that inspections performed demonstrate compliance with contract requirements.

E.2 SURVEILANCE OF SERVICES AND TIME RECORDS (LH)

The COR shall be responsible for appropriate surveillance of all services to be performed and acceptance of all deliverables to be provided under this contract. In so doing, such official(s) shall/may (1) review the accuracy of the Contractor’s time and attendance records of all workers assigned under the contract, and (2) make periodic visits to the work site to check on the presence of workers whose time is charged thereto.

If access to a security area is required, the designated Government representative will provide continuous escort service for the Contractor’s representative.

End of Section E

SECTION F – DELIVERIES OR PERFORMANCE

F.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this address:

<https://www.acquisition.gov>

F.2 OCC 1052.242-8002 PERIOD OF PERFORMANCE (SEP 2012)

The base period of performance of this contract is from 10/01/2015 through 9/30/2016CS_243.

If exercised, the first option period will extend the contract period of performance from 10/01/2016CS_2223 through 9/30/2017CS_2222.

If exercised, the second option period will extend the contract period of performance from 10/01/2017CS_2225 through 9/30/2018CS_2224.

If exercised, the third option period will extend the contract period of performance from 10/01/2018CS_2227 through 9/30/2019CS_2226.

If exercised, the fourth option period will extend the contract period of performance from 10/01/2019CS_2229 through 9/30/2020CS_2228.

F.3 PLACE OF PERFORMANCE

The activities performed under the contract shall be performed at the OCC Headquarters locations in the Washington, DC Metropolitan area as indicated below:

Comptroller of the Currency (Headquarters) 400 7th Street SW Washington, DC 20219

Additional work may have to be performed on-site at facilities in or near OCC HQ (e.g. the OCC Data Center in Ashburn, Virginia).

F.4 BUSINESS HOURS AND COVERAGE

The OCC core business hours are 8:30 AM to 5:00 PM Eastern Standard Time, Monday through Friday, excluding Federal holidays. The Contractor shall provide project management services and access to key personnel during the core business hours. At times, performance outside of core business hours may be required. The Contractor will provide appropriate contact information for staff that is required to be available outside of core business hours.

F.5 DELIVERABLES

The complete list of deliverables is specified in the attached Performance Work Statement (Attachment 1).

F.6 LEGAL HOLIDAYS

The following legal holidays are observed:

*Holidays that fall on Saturday are observed on Friday and holidays that fall on Sunday are observed on Monday.

End of Section F

SECTION G – CONTRACT ADMINISTRATION DATA

G.1 OCC 1052.201-8000 Contracting Officer’s Representative (COR) Delegation and Authority (DEC 2013)

(a) The contracting officer's representative will be identified via separate letter to the Contractor.

(b) Performance of work under this contract is subject to the technical direction of the COR, as delegated in writing. The term "technical direction" includes, without limitation, direction to the Contractor that directs or redirects the labor effort, shifts the work between work areas or locations, fills in details and otherwise serves to ensure that tasks outlined in the work statement are accomplished satisfactorily.

(c) Technical direction must be within the scope of the specification(s)/work statement. The COR does NOT have authority to issue technical direction that:

(1) changes any of the terms, conditions, or specification(s)/work statement of the contract;

(2) in any manner causes an increase or decrease in the contract price, or the time required for contract performance;

(3) interferes with the Contractor's right to perform under the terms and conditions of the contract; or,

(4) directs, supervises or otherwise controls the actions of the Contractor's employees.

(d) Technical direction may be oral or in writing. The COR shall confirm oral direction in writing within five work days, with a copy to the contract administrator.

(e) The Contractor shall proceed promptly with performance resulting from the technical direction issued by the COR. If, in the opinion of the Contractor, any direction of the COR, falls within the limitations in (c), above, the Contractor shall immediately notify the contracting officer no later than the beginning of the next Government work day.

(f) Failure of the Contractor and the contracting officer to agree that technical direction is within the scope of the contract shall be subject to the terms of the clause entitled "Disputes".

(End of Clause) G.2 OCC 1052.215-8003 Key Personnel (APR 2014)

(a) The Contractor shall assign to this contract the key personnel identified below:

1. IBM Notes/Domino Administrator

2. Senior IBM Notes/Domino Developer

3. IBM Notes/Domino Developer/Analyst-Tester

(b) During the first ninety (90) days of performance, the Contractor shall make no substitutions of key personnel unless the substitution is necessitated by illness, death, or termination of employment. The Contractor shall notify the Contracting Officer within 15 calendar days after the occurrence of any of these events and provide the information required by paragraph (c) below. After the initial 90-day period, the Contractor shall submit the information required by paragraph (c) to the Contracting Officer at least 30 days prior to making any permanent substitutions.

(c) The Contractor shall provide a detailed explanation of the circumstances necessitating the proposed substitutions complete résumés for the proposed substitutes, and any in additional information requested by the contracting Officer. Proposed substitutes shall have comparable qualifications to those of the persons being replaced. The Contracting Officer will notify the Contractor within 15 calendar days after receipt of all required information of the decision on substitutions. The contract will be modified to reflect any approved changes of key personnel.

(End of Clause) G.3 OCC 1052.232-8000 Supplemental Invoicing Requirements (FEB 2014)

(a) The Contractor shall ensure all invoices adhere to the requirements as stated in either FAR 52.212-4(g) or FAR 52.232-25(a)(3), whichever is referenced in the award.

(b) The Contractor shall ensure the OCC award number (beginning with "TCC") is on the face sheet of all invoices.

(c) The Contractor shall include any Prompt Payment Discount terms on the face sheet of all invoices.

(d) The Contractor shall submit invoices in a format that replicates the contract line item number(s) (CLIN) and subCLIN structure of the contractual document.

(e) If the contract allows for the submission of partial or periodic invoices, the Contractor shall include a “Cumulative Invoiced Amount” column. In this column, the Contractor shall enter the total amount that has been billed for each CLIN to date.

(f) The Contractor shall submit an electronic invoice to

i. OCC’s Accounts Payable at OMAPVendorInvoice@occ.treas.gov,

ii. The COR (email provided under separate letter), and

iii. The CA (email provided under separate letter)

(g) If the Contractor does not have the means to submit an electronic invoice, a hardcopy invoice shall be sent to:

Comptroller of the Currency Accounts Payable, MS #5W-3 400 7th Street SW Washington, DC 20219

(h) The OCC may deem any invoice that does not fully comply with the invoicing requirements specified in this clause as an improper invoice and return the invoice to the Contractor for correction and resubmission.

(End of Clause)

G.4 OCC 1052.242-8000 (OCC) Evaluation of Contractor Performance (DEC 2010)

1. The OCC will evaluate the Contractor’s performance after contract award. If this contract has option periods, interim evaluations will be conducted at the end of each option period and then a final evaluation report will be prepared at the completion of the entire contract. If this contract does not have renewal options, an evaluation will be conducted upon completion of the contract. Notwithstanding the preceding, the Contracting Officer may conduct evaluations more or less frequently, if the Contracting Officer deems appropriate.

B. Evaluations will be conducted using an electronic format as established by Contractor Performance Assessment Reporting System (CPARS), an internet-based database of Contractor performance information. The OCC will enter the information, gathered from the evaluation, into the CPARS.

C. If the Contractor responds to the evaluation, and the response rebuts any or all of the ratings, the Contracting Officer will attempt to reconcile the areas of disagreement with the Contractor. If agreement cannot be reached, the evaluation and response shall be reviewed at a level higher than the Contracting Officer and a final evaluation will be issued by the reviewing official. If the reviewing official finds, either all or in part, against the Contractor, the Contractor’s response shall become part of the final evaluation. The reviewing official’s final decision shall not be subject to dispute under the terms and conditions of the Disputes clause or subject to resolution in accordance with the terms and conditions of the Alternative Dispute Resolution clause. The reviewing official will provide the Contractor with a copy of the final evaluation.

D. Any government agency authorized to access the Past Performance Information Retrieval System (PPIRS) database will be able to view the performance information related to this contract. Any government agency may also receive a copy the Contractor’s performance evaluation, and any associated comments, by contacting the OCC. The OCC will also, upon request, provide copies of any and all of the Contractor’s evaluations to the Contractor.

(End of Clause)

G.5 OCC 1052.243-8001 Authorized Changes Only by the Contracting Officer (SEP 2012)

(a) Except as specified in paragraph (b) below, no order, statement, or conduct of Government personnel who provide technical direction or in any other manner communicates with Contractor personnel during the performance of this contract shall constitute a change under the “Changes” clause of this contract.

(b) The Contractor shall not comply with any order, direction or request of Government personnel unless it is issued in writing and signed by the Contracting Officer (CO), or is pursuant to specific authority otherwise included as a part of this contract.

(c) The CO is the only person authorized to approve changes in any of the requirements of this contract and notwithstanding provisions contained elsewhere in this contract, the said authority remains solely the CO’s. In the event the Contractor effects any change at the direction of any person other than the CO, the change will be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in charges incurred as a result thereof. The CO will be identified via separate letter to the Contractor.

(End of Clause)

G.6 DTAR 1052.210-70 Contractor Publicity (AUG 2011)

The Contractor, or any entity or representative acting on behalf of the Contractor, shall not refer to the equipment or services furnished pursuant to the provisions of this contract in any news release or commercial advertising, or in connection with any news release or commercial advertising, without first obtaining explicit written consent to do so from the Contracting Officer. Should any reference to such equipment or services appear in any news release or commercial advertising issued by or on behalf of the Contractor without the required consent, the Government shall consider institution of all remedies available under applicable law, including 31 U.S.C. 333, and this contract. Further, any violation of this provision may be considered during the evaluation of past performance in future competitively negotiated acquisitions.

(End of Clause)

End of Section G

SECTION H – SPECIAL CONTRACT REQUIREMENTS

H.1 RELEASE OF CLAIMS

After completion of contract and prior to final payment, the Contractor shall furnish to the Contracting Officer, a release of claims against any outstanding balances or claims arising out of the contract. These are claims other than those specifically resulting from work that is reasonably anticipated by the Contractor when originally estimating the order.

H.2 LIMITATION OF FUNDING

The FFP CLINs under this contract will be fully-funded. In accordance with FAR 52.232-7, the LH CLINs may be fully-funded or incrementally funded.

H.3 GOVERNMENT FURNISHED EQUIPMENT

The OCC shall provide the Contractor with necessary office space, hardware, and software access to accomplish the work specific by this contract. These Government furnished facilities will be provided for the Contractor’s use, on-site at OCC HQ, for the entire period of performance and will be made available prior to the Contractor beginning work.

H.4 NOTICE OF DELAYS

In the event the Contractor (1) encounters difficulty in meeting performance requirements, (2) encounters difficulty complying with the delivery schedule, and/or (3) has knowledge that an actual or potential situation has delayed or threatens to delay the timely performance of any work, the Contractor shall immediately notify the COR and the Contracting Officer in writing, giving pertinent details. Notice of delays shall be provided at least five (5) business days in advance of the due date or deadline. Any notice of delay that is not provided in accordance with this provision shall be documented in writing with the explanation for not meeting the advance notification requirement.

H.5 OCC 1052.239-8000 Electronic and Information Technology Accessibility (JUNE 2014)

(a) Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998, all electronic and information technology (EIT) products and services developed, acquired, maintained, or used under this contract/order must comply with the “Electronic and Information Technology Accessibility Provisions” set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the “Access Board”) in 36 CFR Part 1194. Information about Section 508 is available at http://www.section508.gov/. The complete text of Section 508 Final Provisions can be accessed at http://www.access-board.gov/sec508/standards.htm.

(b) The Section 508 accessibility standards applicable to this contract/order are identified in the Statement of Work/Specification/Performance Work Statement. If it is determined by the Government that EIT products and services provided by the Contractor do not conform to the described accessibility standards in the Product Assessment Template, remediation of the products or services to the level of conformance specified in the Contractor’s Product Assessment Template will be the responsibility of the Contractor at its own expense.

(c) In the event of a modification(s) to this contract/order, which adds new EIT products or services or revises the type of, or specifications for, products or services the Contractor is to provide, including EIT deliverables such as electronic documents and reports, the Contracting Officer may require that the Contractor submit a completed Voluntary Product Accessibility Template found at http://www.itic.org/public-policy/accessibility, to assist the Government in determining that the EIT products or services support Section 508 accessibility standards.

(End of Clause)

H.6 OCC 1052.245-8001 Information Technology Security Awareness Training (JAN 2014)

(a) As used in this clause—“Network (or Logical) Access” means network access to the Office of the Comptroller of the Currency’s (Government) information resources regardless of location, and “Contractor personnel” includes advisors, consultants, or agents to the Contractor, subContractors or their personnel, or any other persons under the auspices of the Contractor.

(b) The Contractor understands that work to be performed under this contract may require network (logical) access to the Government’s information resources. Contractor personnel must complete initial training on their information technology (IT) security responsibilities and the Government’s established system rules of behavior to receive network access to the Government information resources. Contractor personnel requiring network access to the Government’s information resources must also complete security awareness training annually for the duration of this contract.

(c) The Contractor is responsible for its personnel who require access to the Government’s information resources. The Contractor shall provide a list of names to the Contracting Officer’s Representative (COR) after award to initiate the background investigation process and identify Contractor personnel who require information security awareness training. The Contractor shall update this list during contract performance to add or remove Contractor personnel to or from the contract.

(d) Contractor personnel shall complete the IT Security Awareness Training located on the the Personnel and Administration Security System (PASS) https://pass.occ.treas.gov/suite/apps before receiving network access to the Government’s information resources. The Contractor personnel must sign and date the certificate at the end of the training with their legal names, and provide electronic copies of the certificate to the Security and Compliance Services (SCS) at least two weeks prior to the need date for network access. The Contractor shall contact the COR in writing to ensure timely processing of request(s) or for situations when immediate access is required due to circumstances beyond the Contractor’s control.

(e) Contractor personnel shall complete the training annually according to the schedule provided by the Government each year. Failure to complete the training according to the Government schedule will result in those Contractor personnel having their access to the Government’s network, IT systems, and electronic equipment revoked, until completed and reinstated.

(f) Contractor personnel will be granted access to the Treasury Learning Management System (TLMS) to complete annual IT Security Awareness refresher training. The COR will provide instructions for completing the annual refresher training in TLMS. The Contractor shall ensure all Contractor personnel comply with the requirements of this clause.

(End of Clause)

H.7 OCC 1052.245-8002 Separation Notification (JAN 2014)

1. It is anticipated that during the performance of this contract, the Contractor will replace key and non-key personnel who have access to OCC’s network information resources or facilities. The Contractor shall provide the COR advance notification (at least two weeks before the departure date) of departing Contractor employees, subContractor employees or agents. When advance notification is provided, the COR shall immediately access the Personnel and Administration Security System (PASS) https://pass/occ.treas.gov/suite/apps and initiate an Off-Boarding Request. The departing Contractor employee, subContractor employee, or agent shall follow the instructions provided in the email from PASS and complete the list of off-boarding activities as identified in the Contractor’s Off-Boarding Tasks, located as Attachment 2 in Section J of the contract.

1. If the Contractor employee, subContractor employee, or agent departs with less then two weeks notification, the Contractor employee, subContractor employee, or agent shall initiate their own off-boarding request in PASS to begin the off-boarding process, thereby notifying the COR of a pending departure.

1. If a Contractor employee, subContractor employee, or agent is fired or leaves the employment of the Contractor without advance notification, the Contractor’s project manager (or other Key Personnel) shall advise the COR within 24 hours of the departure so that the COR can initiate the Off-Boarding Request. The Contractor shall ensure that all Government property and information is obtained from the departing employee, subContractor employee, or agent and returned to the OCC in accordance with the terms of the contract.

1. It is the policy of OCC that all separating Contractor employees complete the list of off-boarding activities as identified in paragraph (a). A copy of each of the completed forms for departing Contractor employees, subContractor employees, or agents shall be provided to the COR. Contractors shall ensure that no government property, correspondence, or records, including classified or confidential material, are removed from the OCC.

(End of Clause)

H.8 OCC 1052.245-8003 Confidential or Sensitive Information (JAN 2014)

(a) Because of the proprietary nature of such information, the Contractor understands that work performed by and information released to the Contractor is sensitive in nature and shall not be disclosed to anyone other than the Office of the Comptroller of the Currency (OCC) (Government) employees assigned to the contract and other Contractor personnel the Government authorizes to receive the information. The Contractor agrees to protect all confidential and/or proprietary information received by or provided to the Contractor pursuant to this contract from unauthorized disclosure or use for as long as the information remains proprietary or confidential and further agrees that it will not use such information for any purpose other than that relating to the performance of this contract. For purposes of the contract, all information provided to or received by the Contractor is deemed confidential and proprietary.

(b) The Contractor shall execute and is responsible for having all of its employees, subContractor employees, and agents working under the contract and/or having access to sensitive information under this contract execute a “Conditional Access to Sensitive but Unclassified Information Non-Disclosure Agreement”, hereafter referred to as an NDA, as provided by the Government (see Attachment 4). This NDA provides that sensitive but unclassified information provided to the Contractor or its employees, subContractors, or agents, shall not, except as permitted in connection with the performance of the contract, be further disclosed or used without the prior written approval of the Government.

(c) Contractor employees processed in the Personnel and Administration Security System (PASS) will complete the NDA electronically.

(d) Contractor employees processed outside of PASS will complete the attached hard copy NDA and submit to the Contracting Officer (CO).

(e) Executed copies of the NDA are required by each Contractor employee, subContractor employee or agent who will perform work on the contract before they can begin actual performance under the contract.

(End of Clause)

H.9 OCC 1052.245-8004 General Requirements for Background Investigations (JAN 2014)

All contractor personnel assigned to this contract who would have access to OCC facilities or systems, shall submit to a background investigation before beginning work under this contract.

The number and type of investigations will depend on factors including, but not limited to, the length of time the individual will work on a contract, the individual’s role, the sensitivity of information the individual will have access to, and the results of past investigations on that individual. Investigations typically conducted by the OCC include an FBI criminal check and/or a suitability investigation.

Contractor personnel must submit information for background investigations electronically through the e-QIP system (http://www.opm.gov/e-QIP/). The Office of Security (OS) will notify contractor personnel when e-QIP is ready to receive their information. After submitting their information, contractor personnel must print required security forms from e-QIP. Printed forms must be signed by the employee and provided to OS.

For background investigation purposes, contractor personnel are required to provide a set of fingerprints. Contractor personnel must appear in-person to provide fingerprints. See OCC Clause 1052.245-8007 for requirements regarding in-person appearances for security purposes.

The results of all background investigations will be reviewed and adjudicated by OS. Based on investigation results, the OCC has the unilateral right to bar an individual from working under a contract or otherwise restrict the individual’s role under a contract.

The costs for all investigations required under this contract will be borne by the OCC.

(End of Clause)

H.10 OCC 1052.245-8005 General Requirements for OCC-Issued Security Badges (JAN 2014)

(a) The Contracting Officer’s Representative (COR) shall determine whether Contractor personnel must obtain an Office of the Comptroller of the Currency (OCC)-issued security badge. Generally, Contractor personnel who require regular access (access lasting greater than 180 days) to an OCC (Government) facility or require access to Government information systems, either from a Government facility or remotely, will require an OCC issued HSPD-12-compliant SmartID. Contractor personnel whose access is infrequent or less than 180 days in duration are required to obtain an OCC-issued access card. These Contractor personnel must provide all required data and complete all procedures necessary for physical and/or logical access to the OCC.

(b) The COR must follow procedures to onboard Contractor personnel in the Personnel Administration and Security System (PASS) at https://pass.occ.treas.gov/suite/apps.

(c) Contractor personnel must complete their assigned tasks in PASS beginning with the personal identity verification (PIV) process.

(d) The Contractor personnel’s background fingerprints (HSPD-12 SmartID enrollment) and personnel security questionnaire (OPM’s e-QIP system) must be reviewed and adjudicated by the Office of Security (OS) before logical or physical access is approved.

(e) Failure to complete enrollment and e-QIP in a timely fashion could prevent Contractor personnel from beginning work as required under this contract. Contractor personnel shall work with the COR and OS to obtain access in a timely fashion.

(f) Contractor personnel are required to appear in person at different times to receive their access card or HSPD-12 SmartID. See OCC Clause 1052.245-8007 for additional information and requirements regarding in-person appearances for security purposes.

(g) Contractor personnel shall surrender their access card or HSPD-12 SmartID upon demand of the Contracting Officer (CO), COR or the Personnel Security Officer. Contractor personnel shall return their access card or HSPD-12 SmartID to the COR upon completing work under the contract or at any other time if for any reason they no longer require an access to the OCC.

(h) Access cards or HSPD-12 SmartIDs are the property of the Government. Contractor personnel should safeguard access cards and HSPD-12 SmartIDs against loss, theft, and damage, and must report lost or stolen badges immediately to their CO, COR and OS.

(End of Clause)

H.11 OCC 1052.245-8006 General Requirements for HSPD-12 Compliant Security Badges—SmartID (JAN 2014)

(a) The Contracting Officer’s Representative (COR) shall determine whether or not Contractor personnel must obtain a Homeland Security Presidential Directive (HSPD)-12-compliant security badge (SmartID). Generally, Contractor personnel who require regular access (access lasting greater than 180 days) to an Office of the Comptroller of the Currency (OCC) (Government) facility or require access to Government information systems, either from a Government facility or remotely, will require a SmartID. Contractor personnel who are required to obtain a SmartID must provide all required data and complete all procedures necessary for issuance of a SmartID.

(b) All Contractor personnel assigned to this contract, or anyone in the company who would have access to OCC facilities or information systems shall submit to a background investigation before beginning work under this contract. For Contractor personnel with neither physical or logical access, a Conditional Access to Sensitive but Unclassified Information Non-Disclosure Agreement (NDA) shall be signed and submitted in lieu of this background investigation.

(c) The COR must follow procedures to onboard Contractor personnel in the Personnel Administration and Security System (PASS) as https://pass.occ.treas.gov/suite/apps

(d) Contractor personnel shall complete assigned tasks in PASS to include personal identity verification process, make and attend their enrollment appointment and complete the OPM e-QIP process for a background investigation.

(e) The Contractor personnel’s background fingerprints (HSPD-12 SmartID enrollment) and personnel security questionnaire (OPM’s e-QIP system) must be reviewed and adjudicated by the Office of Security (OS) before they can receive a SmartID.

(f) Contractor personnel must appear in person twice to receive a SmartID. At the first appearance (enrollment), Contractor personnel will have their photograph taken and have their fingerprints taken. At the second appearance, Contractor personnel will receive and activate their SmartID. See OCC Clause 1052.245-8007 for requirements regarding in-person appearances for security purposes.

(g) Failure to obtain a SmartID in a timely fashion could prevent Contractor personnel from beginning work as required under this contract. Contractor personnel shall work with the COR and Office of Security (OS) to obtain their SmartID in a timely fashion.

(h) Contractor personnel shall surrender their SmartID upon demand of the Contracting Officer (CO), COR or the Personnel Security Officer. Contractor personnel shall return their SmartID to the COR upon completing work under the contract or at any other time if for any reason they no longer require a SmartID.

(i) SmartIDs are the property of the Government. Contractor personnel must safeguard SmartIDs against loss, theft, and damage, and report lost or stolen SmartIDs immediately to their CO, COR and OS.

(End of Clause)

H.12 OCC 1052.245-8007 In-Person Appearances for Security Purposes (JAN 2014)

Contractor personnel must appear in person to:

1. Have their fingerprints taken for a background investigation

2. Have their photograph taken for HSPD-12-compliant security badge (referred to as a SmartID) or an Office of the Comptroller of the Currency- (OCC) issued security badge.*

3. Receive and activate a SmartID or an OCC-issued security badge.*

Generally, items 1. and 2.above are normally completed during a single in-person appearance. An individual typically requires two in-person appearances to complete all tasks, but more in-person appearances may be required under some circumstances.

The location at which Contractor personnel must appear depends on the contract place of performance and security badge requirements. Generally, Contractor personnel performing work in the Washington, DC area will be required to appear at the OCC Headquarters, located at 400 7th Street SW, Washington, DC 20219. Contractor personnel working elsewhere will generally be required to appear at a USAccess credentialing center operated by the General Services Administration (GSA). (A list of GSA-operated credentialing centers can be found at http://www.fedidcard.gov/deployoss.aspx.)

Contractor personnel requiring in-person appearances at an OCC facility will schedule their appearance with the OCC Office of Security (OS). Appointments can be made by contacting OS at OCCSecurityProcessing@occ.treas.gov or calling the Help Desk at 202-649-6600.

*Contractor personnel who require regular access (access lasting greater than 180 days) to an OCC (Government) facility or require access to Government information systems, either from a Government facility or remotely, will require a SmartID. Contractor personnel whose access is infrequent or less than 180 days in duration are required to obtain an OCC-issued security badge.

(End of Clause)

H.13 OCC 1052.245-8008 Information Security Requirements for Unclassified OCC Information Technology Resources (JAN 2014)

I. DEFINITIONS Definitions, as used in this clause, generally refer to the Code of Federal Regulations (CFR) unless a more specific provision is noted below.

Adequate Security Security that is commensurate with the risk and magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of information. This includes assuring that systems and applications in use operate effectively and provide appropriate confidentiality, integrity, and availability through the use of managerial, operational, and technical security controls.

Availability To ensure the timely and reliable access to, and use of, information.

Confidentiality Preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information.

Information Assurance Information Assurance (IA) are the measures that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. This includes providing for restoration of information systems by incorporating protection, detection, and reaction capabilities.

Information Resource An information resource encompasses both information and information related resources such as personnel, equipment, data, and information technology.

Information System A discrete set of information resources organized for the collection, processing, maintenance, transmission, and dissemination of information, in accordance with defined procedures, whether automated or manual.

Information Technology With respect to the Office of the Comptroller of the Currency (OCC), information technology means any equipment or interconnected system or subsystem of equipment, used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the OCC, if the equipment is used by the OCC directly or is used by a contractor under a contract with the OCC that requires the use:

(i) of that equipment; or

(ii) of that equipment to a significant extent in the performance of a service or the furnishing of a product.

Information technology includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources; but does not include any equipment acquired by a federal contractor incidental to a federal contract.

Integrity Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity.

Service Provider Service Providers are non-OCC entities that support the OCC mission and information systems. These are any individual or other legal entity that (1) directly or indirectly (e.g., through an affiliate), submits offers for or is awarded, or reasonably may be expected to submit offers for or be awarded, a Government contract, including a contract for carriage under Government or commercial bills of lading, or a subcontract under a Government contract; or (2) conducts business, or reasonably may be expected to conduct business, with the Government as an agent or representative of another service provider.

Service providers are classified one of two ways: contracted or shared.

• Contracted Service Provider A Contracted Service Provider (CSP) is a general term used to refer to outsourced business processes supported by private sector information systems, outsourced information technologies, or outsourced information services. A CSP performs clearly defined functions for which there are readily identifiable security considerations and needs that are addressed in both acquisition and operations.

• Shared Service Provider A Shared Service Provider (SSP) is another federal agency functioning as a service provider for the OCC. The OCC and other federal agency would sign a Memorandum of Understanding (MOU), Interagency Agreement (IAA) or Data Exchange Agreement.

II. GENERAL REQUIREMENTS

(1) The service provider shall be responsible for adhering to OCC information technology (IT) security requirements for all information systems connected to an OCC network or operated by the service provider for, or on behalf of, the OCC, regardless of location. This clause applies to all or any part of the contract that includes information technology, information resources or services for which the service provider must have physical or electronic access to OCC information.

(2) OCC information technology and information assigned to service providers shall remain in the United States. The maintenance, operation, and/or processing of said technology and information shall take place, and originate from, within the United States.

(3) The service provider shall maintain a complete and accurate inventory of all OCC-provided information resources. The inventory shall be made available for inspection immediately upon request by the OCC.

(4) The service provider facility hosting OCC information resources shall meet all applicable federal, state, and local zoning, environmental, and building laws and regulations. The facility shall include protection against unauthorized access at all hours, including alarms and notification systems should such protection be breached.

(5) Confirmed security compromises to OCC information shall be reported to the Contracting Officer (CO), the Contracting Officer’s Representative (COR), and the Officer of Security (OS) within 60 minutes of discovery by the service provider.

(6) The service provider shall ensure that its employees, in the performance of the contract, receive and document annual information security awareness training (see Clause No. 1052.245-8001) in accordance with Office of Management and Budget (OMB) Circular A-130 and Federal Information Security Management Act of 2002 (FISMA) requirements.

(7) The service provider shall grant the Government access to any and all facilities and information resources used in support of the contract. The OCC will conduct annual reviews to ensure that the security requirements in the contract are implemented, enforced, effective, and operating as intended. These reviews include, but are not limited to, comprehensive technical testing of the control environment used to safeguard OCC information resources.

(8) At the expiration of the contract, the service provider shall return all OCC information resources provided to, or generated by, the service provider during the period of the contract. The service provider shall provide certification that all OCC information has been sanitized from any non-GFE information system in accordance with OCC standards and procedures. All equipment sanitization procedures must be environmentally sound as outlined by the U.S. Environmental Protection Agency (EPA).

(9) The service provider shall comply with the terms of the Government furnished property clauses in this contract for any OCC-issued IT that is lost, stolen, missing, unaccounted for, or damaged.

(10) For the purposes of application development, the OCC encourages and prefers the use of web-based, commercial-off-the-shelf solutions. Web-based applications must be configured to work with multiple browser and operating system types and may not favor one browser type over another.

(11) The service provider shall adhere to OCC common security configurations and practices. Security configurations and practices include:

A. The provider of information technology shall certify applications are fully functional and operate as intended on systems using the Federal Desktop Core Configuration (FDCC) and other operating system and application standards.

1. Final acceptance of the product will be based on the OCC interpretation of the National Institute of Standards and Technology, National Checklist Program Repository (NIST, NCPR). Checklists are available at the NIST, NCPR website. In situations where security configurations are not available for proposed technologies, the OCC will provide instruction.

1. The installation, operation, maintenance, and update of software shall not alter any OCC-accepted or established security configuration.

1. Applications designed for users shall run in standard user context without elevated system administrator privileges.

1. Products specifically designed for the purpose of Information Assurance (IA), and designated as such by the OCC, are exempt from these common security configuration requirements. Non-GFE IT is exempted by the OCC on a case-by-case basis.

(12) The service provider shall notify the CO and the COR of any organizational change or impact that may interfere with the full execution of the contract immediately upon identification.

(13) Throughout the term of the contract, should the service provider deliver a product or provide a service that does not meet (and maintain) these requirements, the service provider, at their own expense, shall correct issues within 90 days of notification by the CO.

III. ADDITIONAL REQUIREMENTS

(1) The service provider shall have fully completed, attested to, and submitted to the CO the OCC’s IT Accessibility Questionnaire provided as Attachment 4 in Section J of the contract, prior to the execution of the contract.

(2) All service providers who conduct formal reviews of their…