RFP_CC16HQR0001_(FBO)_V6.docx

RFP CC16HQR0001

Managed Email Services

PART I: SCHEDULE

SECTION B – SUPPLIES OR SERVICES AND PRICES/COSTS

B.1 SCHEDULE OF SUPPLIES/SERVICES

This is a FAR Part 12 contract for commercial supplies and services. In accordance with this contract, the Contractor shall provide all management, personnel, materials, labor, equipment and services, except as specified herein to be furnished by the Government, and shall do all that which is necessary to satisfy the requirements listed in Section C – Performance Work Statement (PWS). These prices listed herein shall be in effect through the period of performance of the resultant contract. This contract will be firm-fixed-price. The monthly rates herein shall include all overhead, fringe benefits, general and administrative expenses, and profit for the successful performance of all specified tasks.

B.2 LEVEL OF EFFORT

During the base period of performance and each exercised option period, the Contractor shall provide services and supplies for the Managed Email Services (MES) solution.

The entire anticipated period of performance is as follows:

Base Period: April 1, 2016 – March 31, 2017 Option Period I: April 1, 2017 – March 31, 2018 Option Period II: April 1, 2018 – March 31, 2019 Option Period III: April 1, 2019 – March 31, 2020 Option Period IV: April 1, 2020 – March 31, 2021

B.3 CONTRACT LINE ITEM NUMBERS (CLINS) – FIRM FIXED PRICE (FFP)

The following CLINs represent the deliverables and activities necessary for the successful implementation of the MES solution:

Base Period:

One-Time Deliverables (completed during initial 6 months of Base Period)

Recurring Services (performed final 6 months of Base Period)

Total Price (Base Period)

Option Period I:

Total Price (Option Period I)

Option Period II:

Total Price (Option Period II)

Option Period III:

Total Price (Option Period III)

Option Period IV:

Total Price (Option Period IV)

Summary:

Total Price (Base Period + All Option Periods)

Please refer to Section L of this RFP for further details and important instructions regarding the content of an Offeror’s Price Proposal.

End of Section B

SECTION C – DESCRIPTION/SPECIFICATIONS/PEFORMANCE OF WORK

Please see Attachment 1, Performance Work Statement (PWS), for further details and information. Upon award, the PWS shall be incorporated into the resultant contract. The Contractor shall perform work in accordance with the PWS and any modifications thereto.

End of Section C

SECTION D – PACKAGING AND MARKING

D.1 PAYMENT OF POSTAGE AND FEES

All postage and fees related to submitting information, including forms, reports, etc., to the Contracting Officer or the Contracting Officer’s Representative (COR) shall be paid by the Contractor.

D.2 MARKING

All information submitted to the Contracting Officer or the COR shall be clearly marked to show the following:

1. Name of the Contractor

2. Contract Number; and

3. Consignee’s name and address

4. Date of Submission

D.3 REPORT COVER SHEET

Each report submitted by the Contractor shall have a cover sheet containing the following information:

1. Title of Report

2. Report Number or Type

3. Period covered by the report

4. Contract Number

5. Name and address of the Contractor

6. Name of the COTR

7. Date of Submission

End of Section D

SECTION E – INSPECTION AND ACCEPTANCE

E.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this address:

<https://www.acquisition.gov>

Inspection and acceptance of the supplies and services to be furnished hereunder shall be performed at destination determined by the COR. The COR will provide written notification of the Government’s final acceptance of all services. Acceptance will only occur when the accepting authority is sure that inspections performed demonstrate compliance with contract requirements.

End of Section E

SECTION F – DELIVERIES OR PERFORMANCE

F.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this address:

<https://www.acquisition.gov>

F.2 OCC 1052.242-8002 PERIOD OF PERFORMANCE (SEP 2012)

The base period of performance of this contract is from April 1, 2016 – March 31, 2017.

If exercised, the first option period will extend the contract period of performance from April 1, 2017 – March 31, 2018.

If exercised, the second option period will extend the contract period of performance from April 1, 2018 – March 31, 2019.

If exercised, the third option period will extend the contract period of performance from April 1, 2019 – March 31, 2020.

If exercised, the fourth option period will extend the contract period of performance from April 1, 2020 – March 31, 2021.

F.3 PLACE OF PERFORMANCE

The principal places of performance are dependent upon the solution type proposed by the Contractor. However, it is anticipated that the activities performed under the task order shall be performed at the OCC Headquarters location in the Washington, DC Metropolitan area as indicated below:

Comptroller of the Currency (Headquarters) 400 7th Street SW Washington, DC 20219

Depending on the Contractor’s proposal, additional work may have to be performed on-site at additional facilities in or near OCC HQ (e.g. the OCC Data Center in Ashburn, Virginia) or at Contractor-owned facilities. Such addresses will be provided at the time of award, as needed.

F.4 BUSINESS HOURS AND COVERAGE

The OCC core business hours are 8:00 AM to 5:00 PM Eastern Standard Time (EST), Monday through Friday, excluding Federal holidays. The Contractor shall provide project management services and access to key personnel during the core business hours. At times, performance outside of core business hours may be required. Upon request, the Contractor will provide appropriate contact information for staff that is required to be available outside of core business hours.

F.5 DELIVERABLES

The complete list of required deliverables is specified in the attached PWS (Attachment 1).

F.6 LEGAL HOLIDAYS

The following legal holidays are observed:

*Holidays that fall on Saturday are observed on Friday and holidays that fall on Sunday are observed on Monday.

However, it is of importance to note that the vendor is expected, at the very least, to maintain the OCC’s current levels of service capability as outlined in the PWS.

End of Section F

SECTION G – CONTRACT ADMINISTRATION DATA

G.1 OCC 1052.201-8000 Contracting Officer’s Representative (COR) Delegation and Authority (DEC 2013)

(a) The contracting officer's representative will be identified via separate letter to the Contractor.

(b) Performance of work under this contract is subject to the technical direction of the COR, as delegated in writing. The term "technical direction" includes, without limitation, direction to the Contractor that directs or redirects the labor effort, shifts the work between work areas or locations, fills in details and otherwise serves to ensure that tasks outlined in the work statement are accomplished satisfactorily.

(c) Technical direction must be within the scope of the specification(s)/work statement. The COR does NOT have authority to issue technical direction that:

(1) changes any of the terms, conditions, or specification(s)/work statement of the contract;

(2) in any manner causes an increase or decrease in the contract price, or the time required for contract performance;

(3) interferes with the Contractor's right to perform under the terms and conditions of the contract; or,

(4) directs, supervises or otherwise controls the actions of the Contractor's employees.

(d) Technical direction may be oral or in writing. The COR shall confirm oral direction in writing within five work days, with a copy to the contract administrator.

(e) The Contractor shall proceed promptly with performance resulting from the technical direction issued by the COR. If, in the opinion of the Contractor, any direction of the COR, falls within the limitations in (c), above, the Contractor shall immediately notify the contracting officer no later than the beginning of the next Government work day.

(f) Failure of the Contractor and the contracting officer to agree that technical direction is within the scope of the contract shall be subject to the terms of the clause entitled "Disputes".

(End of Clause) G.2 OCC 1052.215-8003 Key Personnel (APR 2014)

(a) The Contractor shall assign to this contract, as per the PWS, the key personnel identified below:

1. Project Manager

2. Senior E-mail Subject Matter Expert (SME)

(b) During the first ninety (90) days of performance, the Contractor shall make no substitutions of key personnel unless the substitution is necessitated by illness, death, or termination of employment. The Contractor shall notify the Contracting Officer within 15 calendar days after the occurrence of any of these events and provide the information required by paragraph (c) below. After the initial 90-day period, the Contractor shall submit the information required by paragraph (c) to the Contracting Officer at least 30 days prior to making any permanent substitutions.

(c) The Contractor shall provide a detailed explanation of the circumstances necessitating the proposed substitutions complete résumés for the proposed substitutes, and any in additional information requested by the contracting Officer. Proposed substitutes shall have comparable qualifications to those of the persons being replaced. The Contracting Officer will notify the Contractor within 15 calendar days after receipt of all required information of the decision on substitutions. The contract will be modified to reflect any approved changes of key personnel.

(End of Clause) G.3 OCC 1052.242-8000 (OCC) Evaluation of Contractor Performance (DEC 2010)

1. The OCC will evaluate the Contractor’s performance after contract award. If this contract has option periods, interim evaluations will be conducted at the end of each option period and then a final evaluation report will be prepared at the completion of the entire contract. If this contract does not have renewal options, an evaluation will be conducted upon completion of the contract. Notwithstanding the preceding, the Contracting Officer may conduct evaluations more or less frequently, if the Contracting Officer deems appropriate.

B. Evaluations will be conducted using an electronic format as established by Contractor Performance Assessment Reporting System (CPARS), an internet-based database of Contractor performance information. The OCC will enter the information, gathered from the evaluation, into the CPARS.

C. If the Contractor responds to the evaluation, and the response rebuts any or all of the ratings, the Contracting Officer will attempt to reconcile the areas of disagreement with the Contractor. If agreement cannot be reached, the evaluation and response shall be reviewed at a level higher than the Contracting Officer and a final evaluation will be issued by the reviewing official. If the reviewing official finds, either all or in part, against the Contractor, the Contractor’s response shall become part of the final evaluation. The reviewing official’s final decision shall not be subject to dispute under the terms and conditions of the Disputes clause or subject to resolution in accordance with the terms and conditions of the Alternative Dispute Resolution clause. The reviewing official will provide the Contractor with a copy of the final evaluation.

D. Any government agency authorized to access the Past Performance Information Retrieval System (PPIRS) database will be able to view the performance information related to this contract. Any government agency may also receive a copy the Contractor’s performance evaluation, and any associated comments, by contacting the OCC. The OCC will also, upon request, provide copies of any and all of the Contractor’s evaluations to the Contractor.

(End of Clause)

G.4 OCC 1052.243-8001 Authorized Changes Only by the Contracting Officer (SEP 2012)

(a) Except as specified in paragraph (b) below, no order, statement, or conduct of Government personnel who provide technical direction or in any other manner communicates with Contractor personnel during the performance of this contract shall constitute a change under the “Changes” clause of this contract.

(b) The Contractor shall not comply with any order, direction or request of Government personnel unless it is issued in writing and signed by the Contracting Officer (CO), or is pursuant to specific authority otherwise included as a part of this contract.

(c) The CO is the only person authorized to approve changes in any of the requirements of this contract and notwithstanding provisions contained elsewhere in this contract, the said authority remains solely the CO’s. In the event the Contractor effects any change at the direction of any person other than the CO, the change will be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in charges incurred as a result thereof. The CO will be identified via separate letter to the Contractor.

(End of Clause)

G.5 DTAR 1052.232-7003 Electronic Submission of Payment Requests (APR 2015)

(a) Definitions. As used in this clause—

(1) “Payment request” means a bill, voucher, invoice, or request for contract financing payment with associated supporting documentation. The payment request must comply with the requirements identified in FAR 32.905(b), “Content of Invoices” and the applicable Payment clause included in this contract.

(b) Except as provided in paragraph (c) of this clause, the Contractor shall submit payment requests electronically using the Invoice Processing Platform (IPP). Information regarding IPP, including IPP Customer Support contact information, is available at www.ipp.gov or any successor site.

(c) The Contractor may submit payment requests using other than IPP only when the Contracting Officer authorizes alternate procedures in writing in accordance with Treasury procedures.

(c) If alternate payment procedures are authorized, the Contractor shall include a copy of the Contracting Officer's written authorization with each payment request.

(End of Clause)

End of Section G

SECTION H – SPECIAL CONTRACT REQUIREMENTS

H.1 RELEASE OF CLAIMS

After completion of contract and prior to final payment, the Contractor shall furnish to the Contracting Officer, a release of claims against any outstanding balances or claims arising out of the contract. These are claims other than those specifically resulting from work that is reasonably anticipated by the Contractor when originally estimating the order.

H.2 GOVERNMENT FURNISHED EQUIPMENT

The OCC shall provide the Contractor with necessary office space, hardware, and software access to accomplish the work specific by this contract. These Government furnished facilities will be provided for the Contractor’s use, on-site at OCC HQ, for the entire period of performance and will be made available prior to the Contractor beginning work. Any other Government furnished equipment (GFE), optional or otherwise, is outlined in the PWS.

H.3 NOTICE OF DELAYS

In the event the Contractor (1) encounters difficulty in meeting performance requirements, (2) encounters difficulty complying with the delivery schedule, and/or (3) has knowledge that an actual or potential situation has delayed or threatens to delay the timely performance of any work, the Contractor shall immediately notify the COR and the Contracting Officer in writing, giving pertinent details. Notice of delays shall be provided at least five (5) business days in advance of the due date or deadline. Any notice of delay that is not provided in accordance with this provision shall be documented in writing with the explanation for not meeting the advance notification requirement.

H.4 TRAVEL

The Government does not anticipate requiring travel under this contract. However, if needed, the Government reserves the right to add a reimbursable travel CLIN to this contract. Such travel would be subject to Federal Travel Regulations (FTR) and approval by the OCC and the contract’s associated COR.

H.5 OCC 1052.239-8000 Electronic and Information Technology Accessibility (JUNE 2014)

(a) Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998, all electronic and information technology (EIT) products and services developed, acquired, maintained, or used under this contract/order must comply with the “Electronic and Information Technology Accessibility Provisions” set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the “Access Board”) in 36 CFR Part 1194. Information about Section 508 is available at http://www.section508.gov/. The complete text of Section 508 Final Provisions can be accessed at http://www.access-board.gov/sec508/standards.htm.

(b) The Section 508 accessibility standards applicable to this contract/order are identified in the Statement of Work/Specification/Performance Work Statement. If it is determined by the Government that EIT products and services provided by the Contractor do not conform to the described accessibility standards in the Product Assessment Template, remediation of the products or services to the level of conformance specified in the Contractor’s Product Assessment Template will be the responsibility of the Contractor at its own expense.

(c) In the event of a modification(s) to this contract/order, which adds new EIT products or services or revises the type of, or specifications for, products or services the Contractor is to provide, including EIT deliverables such as electronic documents and reports, the Contracting Officer may require that the Contractor submit a completed Voluntary Product Accessibility Template found at http://www.itic.org/public-policy/accessibility, to assist the Government in determining that the EIT products or services support Section 508 accessibility standards.

(End of Clause)

H.6 OCC 1052.245-8001 Information Technology Security Awareness Training (JAN 2014)

(a) As used in this clause—“Network (or Logical) Access” means network access to the Office of the Comptroller of the Currency’s (Government) information resources regardless of location, and “Contractor personnel” includes advisors, consultants, or agents to the Contractor, subContractors or their personnel, or any other persons under the auspices of the Contractor.

(b) The Contractor understands that work to be performed under this contract may require network (logical) access to the Government’s information resources. Contractor personnel must complete initial training on their information technology (IT) security responsibilities and the Government’s established system rules of behavior to receive network access to the Government information resources. Contractor personnel requiring network access to the Government’s information resources must also complete security awareness training annually for the duration of this contract.

(c) The Contractor is responsible for its personnel who require access to the Government’s information resources. The Contractor shall provide a list of names to the Contracting Officer’s Representative (COR) after award to initiate the background investigation process and identify Contractor personnel who require information security awareness training. The Contractor shall update this list during contract performance to add or remove Contractor personnel to or from the contract.

(d) Contractor personnel shall complete the IT Security Awareness Training located on the the Personnel and Administration Security System (PASS) https://pass.occ.treas.gov/suite/apps before receiving network access to the Government’s information resources. The Contractor personnel must sign and date the certificate at the end of the training with their legal names, and provide electronic copies of the certificate to the Security and Compliance Services (SCS) at least two weeks prior to the need date for network access. The Contractor shall contact the COR in writing to ensure timely processing of request(s) or for situations when immediate access is required due to circumstances beyond the Contractor’s control.

(e) Contractor personnel shall complete the training annually according to the schedule provided by the Government each year. Failure to complete the training according to the Government schedule will result in those Contractor personnel having their access to the Government’s network, IT systems, and electronic equipment revoked, until completed and reinstated.

(f) Contractor personnel will be granted access to the Treasury Learning Management System (TLMS) to complete annual IT Security Awareness refresher training. The COR will provide instructions for completing the annual refresher training in TLMS. The Contractor shall ensure all Contractor personnel comply with the requirements of this clause.

(End of Clause)

H.7 OCC 1052.245-8002 Separation Notification (JAN 2014)

1. It is anticipated that during the performance of this contract, the Contractor will replace key and non-key personnel who have access to OCC’s network information resources or facilities. The Contractor shall provide the COR advance notification (at least two weeks before the departure date) of departing Contractor employees, subContractor employees or agents. When advance notification is provided, the COR shall immediately access the Personnel and Administration Security System (PASS) https://pass/occ.treas.gov/suite/apps and initiate an Off-Boarding Request. The departing Contractor employee, subContractor employee, or agent shall follow the instructions provided in the email from PASS and complete the list of off-boarding activities as identified in the Contractor’s Off-Boarding Tasks, located as Attachment 5 in Section J of the contract.

1. If the Contractor employee, subContractor employee, or agent departs with less then two weeks notification, the Contractor employee, subContractor employee, or agent shall initiate their own off-boarding request in PASS to begin the off-boarding process, thereby notifying the COR of a pending departure.

1. If a Contractor employee, subContractor employee, or agent is fired or leaves the employment of the Contractor without advance notification, the Contractor’s project manager (or other Key Personnel) shall advise the COR within 24 hours of the departure so that the COR can initiate the Off-Boarding Request. The Contractor shall ensure that all Government property and information is obtained from the departing employee, subContractor employee, or agent and returned to the OCC in accordance with the terms of the contract.

1. It is the policy of OCC that all separating Contractor employees complete the list of off-boarding activities as identified in paragraph (a). A copy of each of the completed forms for departing Contractor employees, subContractor employees, or agents shall be provided to the COR. Contractors shall ensure that no government property, correspondence, or records, including classified or confidential material, are removed from the OCC.

(End of Clause)

H.8 OCC 1052.245-8003 Confidential or Sensitive Information (JAN 2014)

(a) Because of the proprietary nature of such information, the Contractor understands that work performed by and information released to the Contractor is sensitive in nature and shall not be disclosed to anyone other than the Office of the Comptroller of the Currency (OCC) (Government) employees assigned to the contract and other Contractor personnel the Government authorizes to receive the information. The Contractor agrees to protect all confidential and/or proprietary information received by or provided to the Contractor pursuant to this contract from unauthorized disclosure or use for as long as the information remains proprietary or confidential and further agrees that it will not use such information for any purpose other than that relating to the performance of this contract. For purposes of the contract, all information provided to or received by the Contractor is deemed confidential and proprietary.

(b) The Contractor shall execute and is responsible for having all of its employees, subContractor employees, and agents working under the contract and/or having access to sensitive information under this contract execute a “Conditional Access to Sensitive but Unclassified Information Non-Disclosure Agreement”, hereafter referred to as an NDA, as provided by the Government (see Attachment 6). This NDA provides that sensitive but unclassified information provided to the Contractor or its employees, subContractors, or agents, shall not, except as permitted in connection with the performance of the contract, be further disclosed or used without the prior written approval of the Government.

(c) Contractor employees processed in the Personnel and Administration Security System (PASS) will complete the NDA electronically.

(d) Contractor employees processed outside of PASS will complete the attached hard copy NDA and submit to the Contracting Officer (CO).

(e) Executed copies of the NDA are required by each Contractor employee, subContractor employee or agent who will perform work on the contract before they can begin actual performance under the contract.

(End of Clause)

H.9 OCC 1052.245-8004 General Requirements for Background Investigations (JAN 2014)

All contractor personnel assigned to this contract who would have access to OCC facilities or systems, shall submit to a background investigation before beginning work under this contract.

The number and type of investigations will depend on factors including, but not limited to, the length of time the individual will work on a contract, the individual’s role, the sensitivity of information the individual will have access to, and the results of past investigations on that individual. Investigations typically conducted by the OCC include an FBI criminal check and/or a suitability investigation.

Contractor personnel must submit information for background investigations electronically through the e-QIP system (http://www.opm.gov/e-QIP/). The Office of Security (OS) will notify contractor personnel when e-QIP is ready to receive their information. After submitting their information, contractor personnel must print required security forms from e-QIP. Printed forms must be signed by the employee and provided to OS.

For background investigation purposes, contractor personnel are required to provide a set of fingerprints. Contractor personnel must appear in-person to provide fingerprints. See OCC Clause 1052.245-8007 for requirements regarding in-person appearances for security purposes.

The results of all background investigations will be reviewed and adjudicated by OS. Based on investigation results, the OCC has the unilateral right to bar an individual from working under a contract or otherwise restrict the individual’s role under a contract.

The costs for all investigations required under this contract will be borne by the OCC.

(End of Clause)

H.10 OCC 1052.245-8005 General Requirements for OCC-Issued Security Badges (JAN 2014)

(a) The Contracting Officer’s Representative (COR) shall determine whether Contractor personnel must obtain an Office of the Comptroller of the Currency (OCC)-issued security badge. Generally, Contractor personnel who require regular access (access lasting greater than 180 days) to an OCC (Government) facility or require access to Government information systems, either from a Government facility or remotely, will require an OCC issued HSPD-12-compliant SmartID. Contractor personnel whose access is infrequent or less than 180 days in duration are required to obtain an OCC-issued access card. These Contractor personnel must provide all required data and complete all procedures necessary for physical and/or logical access to the OCC.

(b) The COR must follow procedures to onboard Contractor personnel in the Personnel Administration and Security System (PASS) at https://pass.occ.treas.gov/suite/apps.

(c) Contractor personnel must complete their assigned tasks in PASS beginning with the personal identity verification (PIV) process.

(d) The Contractor personnel’s background fingerprints (HSPD-12 SmartID enrollment) and personnel security questionnaire (OPM’s e-QIP system) must be reviewed and adjudicated by the Office of Security (OS) before logical or physical access is approved.

(e) Failure to complete enrollment and e-QIP in a timely fashion could prevent Contractor personnel from beginning work as required under this contract. Contractor personnel shall work with the COR and OS to obtain access in a timely fashion.

(f) Contractor personnel are required to appear in person at different times to receive their access card or HSPD-12 SmartID. See OCC Clause 1052.245-8007 for additional information and requirements regarding in-person appearances for security purposes.

(g) Contractor personnel shall surrender their access card or HSPD-12 SmartID upon demand of the Contracting Officer (CO), COR or the Personnel Security Officer. Contractor personnel shall return their access card or HSPD-12 SmartID to the COR upon completing work under the contract or at any other time if for any reason they no longer require an access to the OCC.

(h) Access cards or HSPD-12 SmartIDs are the property of the Government. Contractor personnel should safeguard access cards and HSPD-12 SmartIDs against loss, theft, and damage, and must report lost or stolen badges immediately to their CO, COR and OS.

(End of Clause)

H.11 OCC 1052.245-8006 General Requirements for HSPD-12 Compliant Security Badges—SmartID (JAN 2014)

(a) The Contracting Officer’s Representative (COR) shall determine whether or not Contractor personnel must obtain a Homeland Security Presidential Directive (HSPD)-12-compliant security badge (SmartID). Generally, Contractor personnel who require regular access (access lasting greater than 180 days) to an Office of the Comptroller of the Currency (OCC) (Government) facility or require access to Government information systems, either from a Government facility or remotely, will require a SmartID. Contractor personnel who are required to obtain a SmartID must provide all required data and complete all procedures necessary for issuance of a SmartID.

(b) All Contractor personnel assigned to this contract, or anyone in the company who would have access to OCC facilities or information systems shall submit to a background investigation before beginning work under this contract. For Contractor personnel with neither physical or logical access, a Conditional Access to Sensitive but Unclassified Information Non-Disclosure Agreement (NDA) shall be signed and submitted in lieu of this background investigation.

(c) The COR must follow procedures to onboard Contractor personnel in the Personnel Administration and Security System (PASS) as https://pass.occ.treas.gov/suite/apps

(d) Contractor personnel shall complete assigned tasks in PASS to include personal identity verification process, make and attend their enrollment appointment and complete the OPM e-QIP process for a background investigation.

(e) The Contractor personnel’s background fingerprints (HSPD-12 SmartID enrollment) and personnel security questionnaire (OPM’s e-QIP system) must be reviewed and adjudicated by the Office of Security (OS) before they can receive a SmartID.

(f) Contractor personnel must appear in person twice to receive a SmartID. At the first appearance (enrollment), Contractor personnel will have their photograph taken and have their fingerprints taken. At the second appearance, Contractor personnel will receive and activate their SmartID. See OCC Clause 1052.245-8007 for requirements regarding in-person appearances for security purposes.

(g) Failure to obtain a SmartID in a timely fashion could prevent Contractor personnel from beginning work as required under this contract. Contractor personnel shall work with the COR and Office of Security (OS) to obtain their SmartID in a timely fashion.

(h) Contractor personnel shall surrender their SmartID upon demand of the Contracting Officer (CO), COR or the Personnel Security Officer. Contractor personnel shall return their SmartID to the COR upon completing work under the contract or at any other time if for any reason they no longer require a SmartID.

(i) SmartIDs are the property of the Government. Contractor personnel must safeguard SmartIDs against loss, theft, and damage, and report lost or stolen SmartIDs immediately to their CO, COR and OS.

(End of Clause)

H.12 OCC 1052.245-8007 In-Person Appearances for Security Purposes (JAN 2014)

Contractor personnel must appear in person to:

1. Have their fingerprints taken for a background investigation

2. Have their photograph taken for HSPD-12-compliant security badge (referred to as a SmartID) or an Office of the Comptroller of the Currency- (OCC) issued security badge.*

3. Receive and activate a SmartID or an OCC-issued security badge.*

Generally, items 1. and 2.above are normally completed during a single in-person appearance. An individual typically requires two in-person appearances to complete all tasks, but more in-person appearances may be required under some circumstances.

The location at which Contractor personnel must appear depends on the contract place of performance and security badge requirements. Generally, Contractor personnel performing work in the Washington, DC area will be required to appear at the OCC Headquarters, located at 400 7th Street SW, Washington, DC 20219. Contractor personnel working elsewhere will generally be required to appear at a USAccess credentialing center operated by the General Services Administration (GSA). (A list of GSA-operated credentialing centers can be found at http://www.fedidcard.gov/deployoss.aspx.)

Contractor personnel requiring in-person appearances at an OCC facility will schedule their appearance with the OCC Office of Security (OS). Appointments can be made by contacting OS at OCCSecurityProcessing@occ.treas.gov or calling the Help Desk at 202-649-6600.

*Contractor personnel who require regular access (access lasting greater than 180 days) to an OCC (Government) facility or require access to Government information systems, either from a Government facility or remotely, will require a SmartID. Contractor personnel whose access is infrequent or less than 180 days in duration are required to obtain an OCC-issued security badge.

(End of Clause)

H.13 OCC 1052.245-8008 Information Security Requirements for Unclassified OCC Information Technology Resources (JAN 2014)

I. DEFINITIONS

Definitions, as used in this clause, generally refer to the Code of Federal Regulations (CFR) unless a more specific provision is noted below.

Adequate Security Security that is commensurate with the risk and magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of information. This includes assuring that systems and applications in use operate effectively and provide appropriate confidentiality, integrity, and availability through the use of managerial, operational, and technical security controls.

Availability To ensure the timely and reliable access to, and use of, information.

Confidentiality Preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information.

Information Assurance Information Assurance (IA) are the measures that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. This includes providing for restoration of information systems by incorporating protection, detection, and reaction capabilities.

Information Resource An information resource encompasses both information and information related resources such as personnel, equipment, data, and information technology.

Information System A discrete set of information resources organized for the collection, processing, maintenance, transmission, and dissemination of information, in accordance with defined procedures, whether automated or manual.

Information Technology With respect to the Office of the Comptroller of the Currency (OCC), information technology means any equipment or interconnected system or subsystem of equipment, used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the OCC, if the equipment is used by the OCC directly or is used by a contractor under a contract with the OCC that requires the use:

(i) of that equipment; or

(ii) of that equipment to a significant extent in the performance of a service or the furnishing of a product.

Information technology includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources; but does not include any equipment acquired by a federal contractor incidental to a federal contract.

Integrity Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity.

Service Provider Service Providers are non-OCC entities that support the OCC mission and information systems. These are any individual or other legal entity that (1) directly or indirectly (e.g., through an affiliate), submits offers for or is awarded, or reasonably may be expected to submit offers for or be awarded, a Government contract, including a contract for carriage under Government or commercial bills of lading, or a subcontract under a Government contract; or (2) conducts business, or reasonably may be expected to conduct business, with the Government as an agent or representative of another service provider.

Service providers are classified one of two ways: contracted or shared.

• Contracted Service Provider A Contracted Service Provider (CSP) is a general term used to refer to outsourced business processes supported by private sector information systems, outsourced information technologies, or outsourced information services. A CSP performs clearly defined functions for which there are readily identifiable security considerations and needs that are addressed in both acquisition and operations.

• Shared Service Provider A Shared Service Provider (SSP) is another federal agency functioning as a service provider for the OCC. The OCC and other federal agency would sign a Memorandum of Understanding (MOU), Interagency Agreement (IAA) or Data Exchange Agreement.

II. GENERAL REQUIREMENTS

(a) The service provider shall be responsible for adhering to OCC information technology (IT) security requirements for all information systems connected to an OCC network or operated by the service provider for, or on behalf of, the OCC, regardless of location. This clause applies to all or any part of the contract that includes information technology, information resources or services for which the service provider must have physical or electronic access to OCC information.

(b) OCC information technology and information assigned to service providers shall remain in the United States. The maintenance, operation, and/or processing of said technology and information shall take place, and originate from, within the United States.

(c) The service provider shall maintain a complete and accurate inventory of all OCC-provided information resources. The inventory shall be made available for inspection immediately upon request by the OCC.

(d) The service provider facility hosting OCC information resources shall meet all applicable federal, state, and local zoning, environmental, and building laws and regulations. The facility shall include protection against unauthorized access at all hours, including alarms and notification systems should such protection be breached.

(e) Confirmed security compromises to OCC information shall be reported to the Contracting Officer (CO), the Contracting Officer’s Representative (COR), and the Officer of Security (OS) within 60 minutes of discovery by the service provider.

(f) The service provider shall ensure that its employees, in the performance of the contract, receive and document annual information security awareness training (see Clause No. 1052.245-8001) in accordance with Office of Management and Budget (OMB) Circular A-130 and Federal Information Security Management Act of 2002 (FISMA) requirements.

(g) The service provider shall grant the Government access to any and all facilities and information resources used in support of the contract. The OCC will conduct annual reviews to ensure that the security requirements in the contract are implemented, enforced, effective, and operating as intended. These reviews include, but are not limited to, comprehensive technical testing of the control environment used to safeguard OCC information resources.

(h) At the expiration of the contract (or whenever any data storage devices are de-installed, retired, excessed, or replaced), the service provider shall return all OCC information resources provided to as GFE, or funded by the Government. The service provider shall provide certification that all OCC information on any aforementioned data storage devices have been sanitized in accordance with OCC standards and procedures. All equipment sanitization procedures must be environmentally sound as outlined by the U.S. Environmental Protection Agency (EPA).

(i) The service provider shall comply with the terms of the Government furnished property clauses in this contract for any OCC-issued IT that is lost, stolen, missing, unaccounted for, or damaged.

(j) For the purposes of application development, the OCC encourages and prefers the use of web-based, commercial-off-the-shelf solutions. Web-based applications must be configured to work with multiple browser and operating system types and may not favor one browser type over another.

(k) The service provider shall adhere to OCC common security configurations and practices. Security configurations and practices include:

(1) The provider of information technology shall certify applications are fully functional and operate as intended on systems using the Federal Desktop Core Configuration (FDCC) and other operating system and application standards.

(2) Final acceptance of the product will be based on the OCC interpretation of the National Institute of Standards and Technology, National Checklist Program Repository (NIST, NCPR). Checklists are available at the NIST, NCPR website. In situations where security configurations are not available for proposed technologies, the OCC will provide instruction.

(3) The installation, operation, maintenance, and update of software shall not alter any OCC-accepted or established security configuration.

(4) Applications designed for users shall run in standard user context without elevated system administrator privileges.

(5) Products specifically designed for the purpose of Information Assurance (IA), and designated as such by the OCC, are exempt from these common security configuration requirements. Non-GFE IT is exempted by the OCC on a case-by-case basis.

(l) The service provider shall notify the CO and the COR of any organizational change or impact that may interfere with the full execution of the contract immediately upon identification.

(m) Throughout the term of the contract, should the service provider deliver a product or provide a service that does not meet (and maintain) these requirements, the service provider, at their own expense, shall correct issues within 90 days of notification by the CO.

III. ADDITIONAL REQUIREMENTS

(a) The service provider shall have fully completed, attested to, and submitted to the CO the OCC’s Service Provider Self Assessment provided as Attachment 7 in Section J of the contract, prior to the execution of the contract.

(b) All service providers who conduct formal reviews of their internal controls over the services, systems, and facilities supporting the OCC shall provide the resultant reports to the CO immediately upon contract award and on an annual basis thereafter to be used as part of the OCC’s Service Provider Review and Office of Management and Budget Circular A-123 compliance processes. Examples of such reports would include but are not limited to SAS-70 or SSAE-16 Type II audit reports performed by independent third parties. If not available, internal reviews of a similar nature will be acceptable. OCC will adhere to the requirements of a mutually acceptable Non-Disclosure Agreement with regard to the contents of these reports.

(c) The service provider shall maintain a computing environment with adequate security at all times. This includes, but is not limited to, the description and documentation of the processes and procedures that will be followed to ensure the security of IT resources that are developed, processed, transmitted, used, or maintained under this contract and comprehensive technical testing of the contractor’s computing environment by the OCC.

(d) Prior to the execution of the contract, the OCC may validate adequate security controls in the contractor’s environment. When a validation is required, the validation will be conducted by the OCC as part of an on-site and/or remote testing inspection process.

(1) The service provider agrees to demonstrate, to personnel authorized by the OCC, the technical, operational, and management safeguards that protect the confidentiality, integrity, and availability of OCC information that it develops, processes, transmits, uses, or maintains during the execution of this contract.

(2) The on-site inspection serves to ensure the computing environment complies with Federal laws that include, but are not limited to, the Federal Information Security Management Act of 2002 (FISMA); and with Federal policies and procedures that include, but are not limited to, OMB Circular A-130, FIPS Publications 199 and 200, Department of the Treasury Directive 85-01, and OCC Policy and Procedures Manual 4000-1 (REV). Copies of these documents are maintained by the OCC Information Risk Management and are available upon request.

(3) The OCC has the right to perform manual or automated audits, scans, reviews, or other inspections of the Contractor’s IT environment being used to provide or facilitate services for the OCC. In accordance with the FAR clause 52.239-1, Con-tractor shall be responsible for the following privacy and security safeguards:

i. The Contractor shall not publish or disclose in any manner, without the Contracting Officer’s written consent, the details of any safeguards either designed or developed by the Contractor under this contract or otherwise provided by the OCC.

ii. To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, confidentiality, integrity, and availability of OCC data, the Contractor shall afford the OCC access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases within 72 hours of notification. The pro-gram of inspection shall include, but is not limited to:

· Authenticated and unauthenticated operating system/network vulnerability scans.

· Authenticated and…