CC17HQQ0072.docx

Request for Quote (RFQ)

CC17HQQ0072

Request for Quote (RFQ)

CC17HQQ0072

PART I - SUPPLIES OR SERVICES AND PRICES/COSTS

1.0 LINE ITEM DESCRIPTION

The Contractor shall furnish all technical, management, supervision, labor, materials, licensing, and any other support necessary to provide the services as described in the Performance Work Statement (PWS).

2.0 PRICING

The Contractor shall provide the services at a Firm Fixed Unit Price. The contract will consist of a base period and four one-year option periods. The option periods will be exercised at the sole discretion of the Government consistent with FAR 52.217-9.

Qty

Base Period: October 4, 2017 – November 3, 2018

$2,000.00

Option Period 1: November 4, 2018 – November 3, 2019

$2,000.00

Option Period 2: November 4, 2019 – November 3, 2020

$2,000.00

Option Period 3: November 4, 2020 – November 3, 2021

$2,000.00

Option Period 4: November 4, 2021 – November 3, 2022

$2,000.00

TOTAL OF ALL CLINs: __________________

PART II – PERFORMANCE WORK STATEMENT (PWS)

1.0 PURPOSE

The Entry-level Bank Examiner Candidate Testing initiative is to ensure that all candidates are tested prior to being further considered for next steps in the application process. The Contractor schedules, administers, accurately records results, appropriately maintains and provides results to the Office of the Comptroller of the Currency (OCC).

2.0 BACKGROUND

The Office of the Comptroller of the Currency (OCC) was established in 1863 as a bureau of the Department of the Treasury. It is responsible for regulating and supervising the national banking system. The OCC charters, regulates and examines approximately 2,200 national banks and 52 federal branches and agencies of foreign banks in the United States. The OCC's nationwide staff of examiners conducts on-site examinations of national banks and provides sustained supervision of bank operations. Its mission is to ensure a safe, sound and competitive national banking system that supports the citizens, communities and economy of the United States.

The OCC hires approximately 150 entry-level bank examiners (also known as Assistant National Bank Examiners (ANBE)) every year in two recruitment cycles, one in the Fall and one in the Spring. Applications are received during set dates in the campaigns - in September (Fall) and February (Spring). Applications are received via an online Applicant Tracking System (ATS) developed by Monster Government Solutions (MGS), hosted by the Department of Treasury’s Enterprise Business Solutions and administered by the OCC.

Applicant qualifications are auto-screened via self-certification in the ATS. If the applicant self-certifies they qualify, the applicant receives an invitation to proceed to the next step in the process. As part of this next step, candidates are currently tested on two items: a multiple-choice Knowledge Test (KT) and a Written Communications Skills Test (WCST). Annually, the OCC tests approximately 2500 candidates over the two recruitment cycles.

If the candidate passes both tests, there is a verification of the qualifications and recruiters conduct screening interviews. If the candidate passes the screening interview, they are recommended for further consideration.

In 2016, the OCC partnered with the Office of Personnel Management to conduct an evaluation of the current assessment process of the Assistant National Bank Examiner position. The current assessment process is based on thorough job analysis data and sound assessment development science and was implemented in September 2013, however parts of the process have been in use for approximately 15 years.

Based on the analysis conducted, opportunities exist to modernize or refresh pieces of the process to reflect the current job and applicant pool, and to take advantage of advances in assessment technology. The recommendations were to:

1. Adjust the two knowledge tests (Form A and Form B) to reflect current critical competencies and ensure item quality.

2. Use an off-the-shelf writing assessment to focus on basic writing skills.

3. Add an off-the-shelf assessment of analytical skills/critical thinking.

4. Review cut scores to ensure appropriate applicant flow.

The Contractor shall be responsible for implementing item numbers 2 and 3. The Government will be responsible for implementing items 1 and 4.

3.0 CONTRACT OBJECTIVE

The Contractor shall (1) provide nationwide testing facility sites for entry-level candidates to complete the electronic assessment as part of their candidacy via the use of automated assessment scoring technology; (2) provide off-the-shelf options for the writing and analytical skills assessments; (3) schedule, and proctor the required assessments.

4.0 SCOPE

The Contractor shall provide the full range of services necessary to successfully achieve the requirements described in this Performance Work Statement (PWS). The work consists of administering approximately 2,500 tests nationwide annually (1,250 tests per campaign).

The Contractor shall provide nationwide testing facility sites for entry-level candidates to attend and complete three electronic tests as part of their candidacy for the ANBE. Each testing facility shall have the capability to ensure confidentiality of OCC information. Testing facility sites shall provide a safe and secure environment for all applicants and OCC information or data. Access to these sites shall be restricted to applicants, contractors, OCC staff, and any other authorized personnel. The Contractor will employ quality control by checking identification at the testing locations.

The Contractor staff shall not disclose any information obtained in connection with work completed under the contract. Services shall be provided in a manner that prohibits inadvertent transfer of OCC information or data.

The Contractor shall provide a candidate scheduling web portal accessible via the internet. The Contractor shall provide appropriate electronic hardware and software with internet connection and a confidential electronic testing web portal for test candidates, and shall set up, maintain, proctor and administer the three ANBE assessments. The Contractor will accurately score and record the results. The Contractor shall provide an administrator web portal accessible via the internet for assigned OCC POC(s). The scores and the questions and answers shall be available to the OCC via the administrator web portal.

The Contractor shall offer the ANBE assessments during test periods as specified by the Contracting Officer’s Representative (COR). Each test period will be approximately four weeks in length. The test periods are during the January/February and September/October timeframes. Subject to limitations, the Contractor shall allow candidates to schedule and take the ANBE assessments at any time during the scheduled test period.

The Contractor shall provide to the OCC all reasonably applicable and appropriate information technology, network and software upgrades.

The Contractor shall provide a mobile testing solution in the case there are no established testing centers in remote locations. The mobile testing solution shall staff proctors and provide the necessary hardware and software to access the testing web portal.

The Contractor shall provide two versions of a validated off-the-shelf Written Communication Skills and Analytical Reasoning Tests based on critical competencies sought in the ANBE job analysis.

5.0 ANBE REQUIREMENTS

Test/Data Automation and Programming Services The Contractor shall provide all data automation, programming and related services necessary to electronically administer the ANBE Assessments in accordance with the requirements specified herein. The minimum (or equivalent) key performance parameters for the online testing web portal include:

1. Providing an easy- to-use interface for both OCC users and candidates.

2. Providing an administrator web portal to upload approved candidates with a unique identifier for testing.

3. Utilizing a unique identifier for each candidate that is generated by OCC’s ATS (Career Connector) in order to integrate the candidate test data and the ATS application data throughout the process and allow the candidate’s test results and test session be tied to that unique identifier.

4. Providing a scheduling web portal for applicants allowing candidates to self-register and schedule tests during set dates.

5. Providing candidates with the ability to submit reasonable accomodation requests during the test scheduling process and alert OCC to review and approve the request via email. The Contractor shall provide the ability to make individual testing exceptions for candidates needing reasonable accomodations (i.e., extended test time, solitary testing areas, etc.) based on OCC’s approval.

6. Providing the hardware, software, internet connection and confidential testing web portal to administer tests.

7. Providing a confidential testing web portal for applicants to take all three assessments (Knowledge Test, Written Test and Analytical Reasoning Test), including the ability to provide instructions for use.

8. Providing information to candidates upon arrival to the test center, such as via programming of screens to include:

1. Welcome information

2. Instructions

3. Thank you

4. Pass/Fail and Next Step Notifications

9. Scoring and making test scores available to designated OCC POC(s) online for export to an excel spreadsheet, or other usable format, that is sortable, searchable, and with the ability to filter on results.

10. Providing a web-based OCC administrator web portal to house and provide real-time records of the full assessment process, along with reporting capabilities to assist in the management of the assessment program. Examples of the reporting would be data on how many applicants have scheduled, how many have tested, how many haven’t tested, how many have passed/failed, etc.

11. The Contractor shall send email reminders to applicants to help minimize no-shows at the testing centers. The Contractor shall not be held accountable for the no-show rate.

12. Immediately scoring and displaying a preliminary pass/fail grade to the test candidate after either 1) the candidate finishes and submits the test, or 2) the test is automatically terminated due to allotted test time expiring.

13. The test application must time each test and terminate the test once the allotted time is up.

14. The application must provide an on-screen training/instructions explaining how each of the tests works. This training must be provided prior to the test beginning, and shall be available at all times during the test. The tutorial shall cover, for example, explaining the multiple-choice test format for the KT, the procedure for answering questions, the procedure for reviewing and changing answers, the procedure for submitting the completed tests, the time limit and the time remaining on-screen, and the pass/fail notification.

15. Notifying candidates that do not pass that they will not be allowed to continue. The language shall be provided by the OCC within 30 calendar days of contract award.

16. Providing a statement at conclusion of the tests advising candidates of their next steps with language provided by the OCC. This language shall be provided within 30 calendar days of contract award and as amended with each campaign.

17. Depending on the scoring scenario for all three tests, notifications will be provided to test candidates after each test, and then an overall results email within 48 hours after completion of all three tests.

18. At all times, providing protection and security of all test and test related data, and candidate data. The Testing Center must ensure that the application, test-delivery methodology and equipment is functioning properly, and must provide an immediate response and solution.

19. The Contractor shall be responsible for “end-to-end” availability of testing resources, such as being responsible for the servers which hosts the assessments and the hardware/software provided, as well as being available on both the client and server side. Conducting quality control to ensure that the tests are fully operational and accessible by the test candidates, and provide documentation to the COR after each incident. Providing a campaign debrief that covers lessons learned and recommendations for improvement.

20. Working with an assigned OCC contracted industrial-organizational (IO) psychologist in setting and validating cut scores for the validated off-the-shelf tests, as well as implementing the scoring scenario for all three tests on the testing web portal.

21. Ensuring test materials are safeguarded to prevent unauthorized exam content exposure, such as ensuring test centers are locked after hours and ensuring tests can only be accessed by specific pre-determined IP addresses at the testing centers.

Test Center Requirements

1. The Contractor shall have a network of at least 500 established, computer-based testing centers across the United States, with at least one in each State. As used herein “established” means facilities that are regularly used for electronic testing purposes. The Contractor shall provide a network of nationwide physical testing sites for candidates to travel to take the assessments. Historically, locations have been near accredited colleges and universities, where at least 90% of candidates have traveled within 2 hours (or 120 mile radius) to a testing center.

2. The test centers shall be compliant with Americans with Disabilities Act, 42 U.S.C. Section 12101 et seq. (ADA) and all Electronic Information Technology used for testing within the facility compliant with Rehabilitation Act of 1973, as amended, 29 U.S.C 794d (Section 508)

3. The Contractor shall comply with reasonable accommodation requests approved by the OCC during the scheduling phase.

4. The test centers shall be open during normal business hours for candidate testing. “Normal business hours” means between the hours of 8:00 a.m. and 5:00 p.m. locally, Monday through Friday, including evenings and weekends for some locations.

5. The Contractor shall provide convenient parking/access and convenient access to mass transit where available.

6. The Contractor’s facilities shall allow each test candidate to be tested in his/her own test carrel to provide a distraction-free, secure, temperature controlled, and well-lighted environment.

Mobile Test Center Requirements

1. The requirements for logistical planning and placement of Mobile Centers are based upon CONUS sites.

2. At the request of OCC, the Contractor shall provide a plan for mobile test center usage in locations where a physical or local testing facility is not available within a 2 hour drive or is in a remote location.

3. The Contractor shall allow the OCC to choose the city and date(s) to have a mobile test center.

a. The OCC can request the location, but logistics are handled by the Contractor and final location is based on availability of space.

b. The OCC shall give at least one week’s notice to the Contractor.

4. The Contractor shall allow the candidates to register and schedule tests during the set date(s) provided by OCC via the scheduling web portal.

a. Candidates can schedule and register during the time window defined, up to the date of the mobile test center. Once the mobile test has occurred, candidates would not be allowed to schedule at that facility.

5. Security and confidentiality of Contractor proctored testing are held to the same standards as physical testing centers.

6. Historically, mobile test centers have been used one to two times a year with about 10-15 students/test takers per site set up.

Delivery of Tests

1. The Contractor shall administer the test to the OCC test candidates at the approved physical test centers.

2. The Contractor’s test centers shall be ready to administer the test to any approved OCC test candidate who has scheduled the test(s) each campaign.

3. The Contractor shall provide trained test center personnel to serve as proctors to administer the tests taken by candidates.

4. Before allowing any test candidate to take the test, the test center’s personnel shall make visual verification of the candidate’s identity. To verify their identity, candidates shall be required to produce a government-issued photo ID that also bears the candidate’s signature. The Contractor shall not allow any candidate that does not have the required identification to take the tests.

5. Once the candidate’s identity has been verified, the test center’s personnel shall provide the test candidate with a brief description of the policies and procedures of the test center and shall then answer questions posed by the candidate that are of an administrative nature.

6. The test center shall provide pre-test instructions to inform the candidate of important information prior to the start of the tests, such as testing room restrictions and consequences for the breach of testing policies, such as cheating.

7. The test center’s personnel shall provide the test candidate with scratch paper, a calculator, a pencil and/or pen. The candidate is not allowed to bring personal articles, such as coats, briefcases, purses, cell phone, paper, pen/paper, and reference material, into the testing area. The test center shall provide lockers for candidate’s to lock their personal items while taking the test.

8. The test center’s personnel shall escort the candidate to his/her test corral and shall verify that the test program is on the screen and ready for the test candidate’s use.

9. The test center shall have a proctor monitor the testing session to ensure that the test candidate(s) is taking the test in a fair manner and that security of the test is not breached. If problems or irregularities are noted, the Contractor shall document them in the form of an incident report in the proctor console and notify the COR within 24 hours via email of the date of the test was taken or the following Monday if the test was taken on Friday.

10. The test center’s proctor shall verify that the test candidate was present through the entire time the test was in progress. Breaks are permitted, but only between each test and during the allotted time.

11. At the end of the test, the test center’s personnel shall collect all materials from the test candidate and shred any paper related items.

12. In the event of inclement weather, the test center shall notify scheduled candidates of test center closure and allow the candidate to reschedule an additional session at no cost to the OCC.

Knowledge Test, Written Communications Test and Analytical Test

1. Should an applicant be eligible to complete all three tests, the tests combined and break times shall not exceed 4 hours in length. All candidates shall be given the allotted time for each test and each break.

2. Administer, proctor and score a multiple-choice KT provided by the OCC. The development of two versions of the KT will be completed by a third-party (Office of Personnel Management), along with a cut score, to be loaded onto the Contractor’s testing web portal. Candidates shall be given 60 minutes. The OCC will provide the KT within 7 business days of contract award.

3. Provide IO psychologist support to determine the appropriate cut-scores for both the WCST and Analytical Reasoning Tests. Work with COR and third-party on evaluating and applying the inclusion of a weighting paradigm across the three assessments. The weighting paradigm and score combination are to be piloted during the Spring 2018 campaign. Once piloted, the Contractor shall work with the COR and third-party vendor to review the performance of the weighting paradigm to make adjustments where needed (i.e. test it out, collect the data, and adjust). This would include reviewing applicant flow (and appropriate demographic data, where available) to verify cut scores are set at optimal levels; that is, the cut score shall represent the level of competency that is required to be minimally qualified. The Contractor shall implement the weighting and score combination paradigm when administering the tests.

4. Provide two versions, administer, proctor and score an off-the-shelf Written Communication Skills Test and Analytical Reasoning Test that have been validated by a licensed IO psychologist:

a. The WCST is a critical assessment to have in the overall process due to the need to measure written communication skills that must be brought to the job. The test shall measure grammar, syntax and structure, spelling, organization of writing, vocabulary and word selection, focus, attention to subject, flow, and coherence. Allow candidates the allotted time to complete the WCST

b. The Analytical Reasoning Test is a new requirement based on the evaluation conducted by OPM. This test shall measure analytical skills and critical thinking. Results of analyses consistently suggests that the ability to analyze data from multiple sources, recognize and understand patterns or trends in the data, and develop recommendations based on the data is critical to success as an entry-level bank examiner. Allow candidates the allotted time to complete the Analytical Reasoning Test.

Data Management

1. Accurately record scores and provide data management capabilities to the OCC, such as via the use of dashboards that authorized OCC POC(s) can access to gain visibility into the testing web portal. The system shall provide for reporting on individual applicant responses, as well as provide aggregate data extractions for off-line analysis as standard functionality.

2. Provide a central repository for real-time test results within the administrator web portal that provides OCC with accurate and timely information. OCC administrators shall be able to see if the candidate has accessed the site to schedule, see if sessions have been scheduled, check-in for a session, or has completed their scheduled appointment, as well as candidate test results.

3. The OCC shall own all test results data.

4. The Contractor shall certify that all non-public agency information is purged at the conclusion of the contract consistent with 9.0 INFORMATION SECURITY AND PRIVACY REQUIREMENTS, 18. Information Ownership

6.0 DELIVERABLES

Deliverable 1: A Quality Control Plan to be provided no later than 30 calendar days from the date of contract award. The Government shall review prior to acceptance by the COR. The Contractor shall submit the revised deliverable within 5 calendar days of receipt of the Government's comments. The deliverable shall be made final once all comments are addressed.

Deliverable 2: A plan for the process and use of a Mobile Test Center to be provided no later than 30 calendar days from the date of contract award. The Government shall review prior to acceptance by the COR. The Contractor shall submit the revised deliverable within 5 calendar days of receipt of the Government's comments. The deliverable shall be made final once all comments are addressed.

Deliverable 3: Conduct a demonstration of the scheduling web portal, testing web portal, and administrator web portal along with a training/instruction manual. Providing Computer-Based Training (CBT) for the scheduling web portal, testing web portal, and administrator web portal within 45 calendar days after contract award.

Deliverable 4: Off-the-shelf written communication skills tests and analytical reasoning tests and approach on determining the initial scoring scenario and appropriate cut score no later than 45 calendar days from the date of contract award.

Deliverable 5: A listing of available test centers to be provided no later than 30 calendar days before the beginning of each test period.

Deliverable 6: Live scheduling web portal no later than 84 calendar days from the date of the contract award.

Deliverable 7: Live testing web portal no later than 84 calendar days from the date of contract award.

Deliverable 8: Live administrator web portal no later than 84 calendar days from the date of contract award. The portal shall provide real time activity and data, such as no show rates, electronic test scores and results.

Deliverable 9: Unlimited ad hoc reports (for example, distance/miles travelled per candidate and other related reports related to the administration of testing) within 2 business days after request if the data cannot be pulled from the administrator web portal.

Deliverable 10: Report incidents where tests are not fully operational and accessible by the test candidates to the COR within 2 business days of each incident.

Deliverable 11: Provide a campaign debrief that covers lessons learned and recommendations for improvement 14 calendar days after the conclusion of each campaign.

7.0 PERFORMANCE REQUIREMENTS SUMMARY

The following factors are those that the government considers to be key performance factors for this requirement. The standards are set for each of the factors, and the measurement is the most likely method of surveillance the government will use. The acceptable quality level describes the level the government will accept. If any of the acceptable quality levels are not met during performance evaluation, the government may note the Contractor’s performance evaluation.

8.0 SECTION 508 COMPLIANCE

The Contractor must ensure all Electronic Information Technology (EIT) meets applicable standards of Section 508 of the Rehabilitation Act of 1973, as amended. This applies to all software user-interfaces, web-based user-interfaces, and documents such as reports and plans. All documents, reports, or plans submitted must be suitable for sharing within the OCC Intranet by meeting “Web-based Intranet” standards. The following standards apply:

1194.21 – Software Applications and Operating Systems

1194.22 – Web-based Intranet and Internet information and applications

1194.31 – Functional Performance Criteria

1194.41 - Information, Documentation and Support Services

9.0 INFORMATION SECURITY AND PRIVACY REQUIREMENTS

1. Applicability

This section applies to the Contractor, its subcontractors, and Contractor personnel (hereafter referred to collectively as “Contractor”) and addresses specific OCC requirements in addition to those included in the Federal Acquisition Regulation (FAR), Privacy Act of 1974 (5 U.S.C. 552a - the Act), the Health Insurance Portability and Accountability Act of 1996 (HIPAA, Pub. L. 104-191, 110 Stat. 1936), the Sarbanes-Oxley Act of 2002 (SOX, Pub. L. 107-204, 116 Stat 745), and other laws, mandates, or executive orders pertaining to the development and operations of information systems and the protection of sensitive information and data. The following shall not be construed to alter or diminish civil and/or criminal liabilities provided under various laws or mandates.

2. Information Types

The term Information is synonymous with data, regardless of format or medium. Personally Identifiable Information (PII) is a subset of Sensitive Information. Sensitive PII is a subset of PII, and therefore a subset of Sensitive Information. All requirements for Sensitive Information apply to PII and Sensitive PII. All requirements for PII apply to Sensitive PII.

Sensitive Information

Sensitive Information is any information, which if lost, compromised, or disclosed, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual, the Government, or the Government’s interests. Sensitive Information is subject to stricter handling requirements because of the increased risk if the data is compromised. Some categories of Sensitive Information include Financial, Medical or Health, Legal, Strategic and Business, Human Resources, Personally Identifiable Information (PII), and Sensitive PII. These categories of information require appropriate protection as stand-alone information and may require additional protection in aggregate.

Personally Identifiable Information (PII)

PII, as defined in OMB Memorandum M-17-12, refers to information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual. Because there are many different types of information that can be used to distinguish or trace an individual's identity, the term PII is necessarily broad. To determine whether information is PII, the agency shall perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available -in any medium or from any source -that would make it possible to identify an individual.

Sensitive PII (SPII)

Sensitive PII refers to information that can be used to target, harm, or coerce an individual or entity, assume or alter an individual’s or entity’s identity, or alter the outcome of an individual’s or entity’s activities. Sensitive PII requires stricter handling because of the increased risk to an individual or associates if the information is compromised. Some categories of Sensitive PII include stand-alone information, such as Passport Numbers, Social Security Numbers (SSN) or biometric identifiers. Other information such as a financial account, date of birth, maiden names, citizenship status, or medical information, in conjunction with the identity of an individual (directly or indirectly inferred), are also considered Sensitive PII. In addition, the context of the information may determine whether it is sensitive, such as a list of employees with poor performance ratings or a list of employees who have filed a grievance or complaint.

3. Contract Security Categorization

The OCC has determined that the Contractor providing the Entry-level Bank Examiner Candidate Testing will be required to collect, process, transmit, store and dispose of Sensitive Information related to members of the public and/or OCC employees and OCC operations including Personally Identifiable Information (PII). As a result, the OCC has determined that all Federal Information Security Management Act of 2002 (Public Law 107-347) (FISMA) security and privacy requirements for a MODERATE impact system apply to the Contractor and the Contractor systems supporting these services.

FISMA requires each agency to develop, document, and implement an agency-wide Information Security program to safeguard information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, Contractor (including subcontractors) or other source on behalf of an agency. That is, agency information security programs apply to all organizations (sources) which have physical or electronic access to a Federal agency’s computer systems, networks, or IT infrastructure; or use information systems to generate, store, process, or exchange data with a Federal agency, or on behalf of a Federal agency, regardless of whether the data resides on a Federal Agency or a Contractor’s information system. This includes services that are either fully or partially provided; including other agency hosted, outsourced, and cloud computing solutions.

The Contractor and all of its respective subcontractors shall follow and remain compliant at all times with all OCC and Federal Information Technology (IT) Security standards, policies, and reporting requirements, as well as all National Institute of Standards and Technology (NIST) standards and guidelines, other Government-wide laws and regulations for the protection and security of Government Information.

The Contractor shall ensure that any system, application or environment being operated on behalf of OCC or being used to process any OCC information must meet all FISMA requirements including those specified in NIST SP 800-53 Rev. 4, “Security and Privacy Controls for Federal Information System and Organizations”

If the Contractor proposes a Cloud-Based solution, the solution must be fully FedRAMP certified prior to being placed into production.

4. Entry-level Bank Examiner Candidate Testing Services Specific Information Security and Privacy Requirements

Disaster Recovery Requirements

· The Contractor is required to provide continuous coverage and satisfactory performance for the systems and services being provided during disruptive events such as an Information Technology failure; events effecting the normal operation of the data center/facility hosting the system such as any national, state or locally declared emergencies, including hurricanes, floods, wildfires, civil disobedience, and terrorist events that could threaten the availability of system resources located at the data center/facility itself.

· In case of a catastrophic failure at the IT or facility level, the Contractor system(s) must have a Disaster Recovery (DR) capability at an alternate facility that can be brought on line within 48 hours. No part of the alternate facility used to provide DR services for the Contractor’s system may be located outside of the United States or at another facility not covered/identified in the contract at time of award

· The Contractor is required to maintain an up to date Disaster Recovery Plan (DRP), updated at least annually, which can be made available to the OCC within seven (7) calendar days upon request. The initial DRP shall be submitted within thirty (30) calendar days of contract award.

· The Contractor’s system(s) and the associated DRP must be tested at least annually with the latest test results made available to the OCC within thirty (30) calendar days of contract award and within seven (7) calendar days upon request thereafter.

· Any failed test result must be tracked via a Plan of Actions & Milestones (POAM) process that identifies, at a minimum, the risk, Corrective Action Plan, responsible official, and schedule for resolution. Any DR related POAM will be included in the Contractor’s overall POAM program and made available to OCC within seven (7) calendar days upon request.

5. General Information Security and Privacy Requirements

Authorization to Use, Store, or Share Sensitive Information

(a) Information collected, used, stored, maintained, or otherwise processed by the Contractor in the performance of this contract shall be accessed, transferred, stored or processed only within the sole jurisdiction of the United States Federal Government. The Contractor shall not host any portion of the information, data, information system, infrastructure, or environment in facilities outside the contiguous United States, Alaska, Hawaii, and other U.S. Territories.

(b) The Contractor's primary location and facilities and backup data centers that process Government data shall be located within the sole jurisdiction of the United States Federal Government.

(c) In addition, the maintenance and support operations of Contractor’s technology and information must take place, and originate from, within the United States.

(d) The Contractor shall comply and agree to at all times to protect the Government's information and data in accordance with the terms of this contract. The data that is processed, maintained, or stored by Contractor shall be protected against unauthorized access, disclosure or modification, theft, or destruction.

(e) Information made available to the Contractor by the Government for the performance or administration of this effort shall be used only for those purposes and shall not be used in any other way without the written agreement of the CO.

(f) The deliverables in this contract will be considered sensitive and shall not be shared with any other organization without prior approval from the OCC CO.

(g) The Contractor, and any sub-Contractors, shall not use any Personally Identifiable Information (PII), E-mail Groups, Lists, or contract information for any purpose other than those activities necessary to the performance of this contract.

(h) Written approval by the Chief Information Security Officer (CISO), or delegate, is required prior to the use or storage of OCC Sensitive Information or sharing of OCC Sensitive Information by the Contractor with any subcontractor, person, or entity other than OCC.

(i) The Contractor shall not remove Sensitive Information from approved OCC location(s), electronic device(s), or other container(s), without prior written approval of the OCC CISO, or designate.

(j) The Contractor agrees to assume responsibility for protecting the confidentiality of Government records associated with this contract, which are not public information. Each Contractor or employee of the Contractor to whom information may be made available or disclosed shall be notified in writing by the Contractor that such information may be disclosed only for a purpose and to the extent authorized herein.

(k) The Contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The Contractor shall also protect all Government data, equipment, etc. by treating the information as sensitive. All information about the systems, gathered or created under this contract shall be considered as Sensitive But Unclassified (SBU) information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If Contractor personnel must remove any information from the primary work area they shall protect it to the same extent they would their proprietary data and/or company trade secrets. The use of any information that is subject to the Privacy Act will be utilized in full accordance with all rules of conduct as applicable to Privacy Act Information.

(l) Sensitive information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The Contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected. When no longer required, this information, data, and/or equipment will be returned to Government control, destroyed, or held until otherwise directed. Destruction of items shall be accomplished by following NIST Special Publication 800-88, Guidelines for Media Sanitization (available at www.nist.gov).

6. Information Security Incidents

An Information Security Incident is an incident that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access of any Contractor or Government systems or information, including, but not limited to, Sensitive Information.

Information Security Incident Reporting Requirements

All Information Security Incidents, including those that potentially or actually cause the compromise of OCC information must be reported in accordance with the requirements below, even if it is believed the incident may be limited, small, or insignificant. OCC will determine when an incident requires additional focus and attention.

(a) Contractor employees must report all information security incidents to the OCC Cyber Defense Center (CDC) immediately (within 1 hour), after becoming aware of the incident, at: Computer.Security@occ.treas.gov, (202) 649-7930, regardless of day or time.

(b) When notifying the OCC CDC, copy the Contracting Officer if possible, or if reporting by phone or Contracting Officer’s email is not immediately available; contact the Contracting Officer immediately after reporting the incident to OCC CDC.

(c) If you have questions regarding these procedures, please contact the Contracting Officer.

(d) Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

(e) Contractor employees must also provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC; with the following text in the subject line of the email: “Supplementary Information/Report related to previously reported incident ## [insert number].”

Information Security Incident Response Requirements

(a) All determinations related to information security incidents, including response activities, notifications to affected individuals and/or Federal agencies, and related services (e.g., credit monitoring) will be made by authorized OCC officials at OCC’s discretion.

(b) The Contractor and Contractor employees must provide full access and cooperation for all activities determined by OCC to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of information security incidents.

(c) Incident response activities determined to be required by OCC may include but are not limited to, inspections; investigations; forensic reviews; data analyses and processing; and final determinations of responsibility for the incident and/or liability for any additional response activities.

(d) OCC, at its sole discretion, may obtain the assistance of Federal agencies and/or third party firms to aid in incident response activities, as needed.

(e) The Contractor shall be responsible for all costs and related resource allocations required for all subsequent incident response activities determined to be required by OCC, whether incurred by OCC, agents under contract or on assignment to OCC, or by third party firms.

7. Security Controls

(a) The Contractor shall, with the knowledge and concurrence of the Government system owner, be responsible for IT security for all non-government-owned systems processing OCC information in the fulfillment of contract requirements. This includes hardware, software, databases, networks, and telecommunications systems.

(b) Contractors will be required to ensure compliance with the security control requirements of the current version of NIST SP 800-53 or Federal Information Processing Standard (FIPS) 200 that are appropriate to the sensitivity and criticality of the data or system.

(c) Applications must undergo FISMA Compliant Security Assessment and Authorization (SA&A) prior to going into production and undergo Continuous Monitoring as described in the next section.

(d) The Contractor must follow the current version of the following NIST documents (available at www.nist.gov):

· NIST SP 800-37

· 800-34

· 800-18

· 800-30

· 800-60

· 800-53

· 800-53A

· Federal Information Processing Standard (FIPS) 199 and 200

(e) The Contractor must follow the current version of the following OCC documents:

· Associated OCC guides/templates

· OCC Privacy Impact Assessment (PIA)

(f) The Contractor will work with OCC to define a clearly demarcated security authorization boundary for the system supporting this contract.

(g) The Contractor will provide supporting documentation to OCC as necessary in support of the SA&A process.

(h) The Contractor shall provide access to the OCC, or their designee acting as their agent, when requested, in order to verify compliance with the requirements for an Information Technology security program.

(i) The OCC reserves the right to conduct on-site inspections. The Contractor shall make appropriate personnel available for interviews and provide all necessary documentation during this review.

FISMA Compliance

(a) At all times, the Contractor shall comply with FISMA and OMB Circular A-130 requirements to the extent applicable.

(b) The Contractor shall provide the solution as a managed service implemented within a non-OCC data center. The proposed hosting data center and IT network infrastructure must have a current ATO provided by a Federal Agency that is leveraging the data center to host production systems/applications. The Contractor must provide all hardware and software associated with the solution. Key requirements related to this implementation approach include:

· Software Design and Implementation: The Contractor shall be responsible for the design, testing, and implementation of all components of the solution within the Contractor data center, in accordance with OCC policies, standards, and procedures, to include:

· OCC IT Security Policies and Procedures for each NIST Special Publication 800-53 Control Family (Current Revision)

· OCC Secure Configuration Baselines for Operating Systems, Database Management Systems (DBMS), Web Application Platforms, and other platforms as defined by OCC

These documents will be made available upon contract award.

The Contractor shall be responsible for provisioning all required hardware and environments (production, staging, test, and development) for the solution.

· Service/Solution-Specific Security Artifacts: The Contractor shall develop a System Security Plan (SSP) specific to the OCC services solution as part of the Security Assessment & Authorization (SA&A) package. The SSP shall (1) detail the control allocations, status, and implementation details of the organizational common controls, facility controls, and IT network infrastructure controls supporting the solution; and (2) detail the control allocations, status, and implementation details for all controls applicable/allocated to the solution at the operating system, DBMS, web application platform, and application level, other than those inherited directly from the organizational common controls, facility controls, and IT network infrastructure. In addition, the Contractor shall develop the following security artifacts specific to the OCC solution (these documents will be made available upon contract award):

· FIPS 199 Impact Assessment (based on OCC-issued template)

· E-Authentication Risk Assessment (based on OCC-issued template)

· Privacy Impact Assessment (PIA) (based on OCC-issued template)

· Information System Contingency Plan (ISCP) (based on Contractor template or OCC-issued template)

· ISCP test results (based on Contractor template or OCC-issued template)

· Continuous Monitoring Plan (CMP) for the solution, to include Customer Responsibilities (based on Contractor template or OCC-issued template)

· Interconnection Security Agreements, Service Level Agreements, and Memoranda of Understanding.

These documents will be made available upon contract award.

· IT Security Control Assessments: The Contractor shall be responsible for performing an initial IT security control assessment of all applicable controls for each IT component associated with the requirements in Section 5, to include facility controls and IT network infrastructure controls, with the exception of the organizational common controls inherited from OCC. The Contractor shall also be responsible for performing annual or more frequent IT security control assessments of all applicable controls for each IT component associated with the solution, to include facility controls and IT network infrastructure controls, with the exception of any organizational common controls inherited from OCC. The assessments shall be performed by a certified Third-Party Assessment Organization (3PAO) or an qualified independent assessor that meets the qualifications and independence requirements and guidelines specified in NIST SP 800-37 and NIST SP 800-53 (Current Revision). As part of the SA&A package, the Contractor shall be responsible for documenting a Security Control Assessment (SCA) Plan and a Security Assessment Report (SAR) for each assessment, as well as a Plan of Action and Milestones (POAM) for each deficiency identified during the initial and annual/ongoing IT security control assessments.