RFQ_CC17HQQ0082.docx

Request for Quote (RFQ)

CC17HQQ0072

Request for Quote (RFQ)

CC17HQQ0082

PART I - SUPPLIES OR SERVICES AND PRICES/COSTS

1.0 LINE ITEM DESCRIPTION

The Contractor shall furnish all technical, management, supervision, labor, materials, licensing, and any other support necessary to provide the services as described in the Performance Work Statement (PWS).

2.0 PRICING

The Contractor shall provide the services at a Firm Fixed Unit Price. Contract Line Item Numbers (CLINs) 0004, 1004, 2004, 3004, and 4004 are OPTIONAL CLINs for additional UCE Tests within a given period. These OPTIONAL CLINs will only be funded if additional UCE Tests are required by the OCC. The contract will consist of a base period and four one-year option periods. The option periods will be exercised at the sole discretion of the Government consistent with FAR 52.217-9.

Base Period: October 1, 2017 – September 30, 2018

Option Period 1: October 1, 2018 – September 30, 2019

Option Period 2: October 1, 2019 – September 30, 2020

Option Period 3: October 1, 2020 – September 30, 2021

Option Period 4: October 1, 2021 – September 30, 2022

TOTAL OF ALL CLINs: __________________

PART II – PERFORMANCE WORK STATEMENT (PWS)

1.0 BACKGROUND

The Office of the Comptroller of the Currency (OCC) charters, regulates, and supervises all national banks and federal savings associations as well as federal branches and agencies of foreign banks. The OCC is an independent bureau of the U.S. Department of the Treasury. The mission of the OCC is to ensure that national banks and federal savings associations operate in a safe and sound manner, provide fair access to financial services, treat customers fairly, and comply with applicable laws and regulations. Headquartered in Washington, D.C. the OCC (independent bureau of the U.S. Department of the Treasury) has 67 offices nationwide, including four district offices, and an office in London that supervises the international activities of national banks. The OCC charters, regulates and examines approximately 1500 institutions, which are comprised of large banks, midsize banks, community banks, federal branches, and federal savings associations.

The Uniform Commission Examination (UCE) is an OCC certification program used to assess the skills and practical knowledge of potential National Bank Examiners. A commission from the Comptroller of the Currency signifies that a National Bank Examiner is qualified to perform examinations of National Banks, their affiliates, bank service corporations, and thrift institutions.

2.0 SCOPE

The contractor shall:

2.1 Institute, maintain, and administer computer-based, multiple-choice tests for the UCE program. The UCE is comprised of one test described in section 3.0, Uniform Commission Examination Test.

2.2 Administer the UCE test at testing facilities as described in section 4.2.a. To this end, the contractor shall have at least one testing facility within a 50-mile radius of at least 50 of the 67 OCC offices listed in Attachment 1.

2.3 Offer the UCE test to candidates during test periods specified by the Contracting Officer’s Representative (COR). Each test period will be approximately eight weeks long. There will be three test periods during the base year of the contract and during each one-year option period, if exercised. The test periods are typically scheduled in January to March, April to June and August through September (Attachment 2). The estimated maximum candidates tested per performance period is 150. The contractor shall allow candidates to register and take the UCE test during scheduled test periods.

3.0 UNIFORM COMMISSION EXAMINATION TEST

The following matrix identifies the components of the Test:

in each test

· Test Category. The candidate test is described above. The GEN test is for employees seeking a commission in bank safety and soundness.

· Pools of Questions in the Test. The tests is comprised of one pool of questions.

· Approximate Number of Questions in the Pool. Listed above is the approximate number of questions in the pool. The exact number will be determined by the COR. The contractor will randomly select a certain quantity of these questions, but not all of them, for the test.

· Number of Knowledge Domains in each Pool. The pool is comprised of fourteen knowledge domains. A specific number of questions from each knowledge domain shall be randomly selected for the test. The COR shall determine the exact number of questions from each knowledge domain.

· Number of Questions to be Given in the Test. The GEN test is comprised of 225 questions.

· Maximum Time Allotted to Take Test. The test has a specified time limit: 4 ½ hours with a 15 minute hard break. If the candidate has not completed the test by the designated stop time, the contractor’s computer system shall automatically end the test, saving the results.

4.0 DESCRIPTION OF REQUIRED SERVICES AND FACILITIES

4.1 Data Automation and Programming Services

The contractor shall provide all data automation, programming and related services necessary to electronically administer randomly-selected, multiple choice examinations to OCC UCE candidates in accordance with the requirements specified herein. These services include the tasks that follow.

1. The contractor shall design and develop a database for storing the test and test-related data.

· Within 15 calendar days of contract award, the COR will provide the contractor with the following data: pool of test questions, knowledge domains, an exhibit, multiple choice responses, answers, grading schematic, and survey information.

· The exhibit (graphics, charts, tables) consists of data that is pertinent to specific test questions.

· The COR will provide all documents electronically, for example in Microsoft Word, Microsoft Excel, or Adobe PDF.

2. The contractor shall populate the database with data (exam questions, answers).

3. The contractor shall provision, implement, and maintain the software application(s) necessary to perform the following functions in support of the examination:

· Registration of examination candidates

· Online delivery of the examination to candidates

· Scoring of the examination

· Collection of post-examination survey from candidates

· Reporting of examination results.

4. The overall design and development of the databases and applications necessary to meet the requirements of this contract is left to the discretion of the contractor. The final design and development of the databases and applications shall meet the following minimum requirements:

· The candidate’s name or code must be captured on the test.

· A unique control number must be assigned to each test question.

· The exhibit must be linked to the corresponding test question(s).

· Test questions must be randomly selected and must be drawn from the pool of questions and knowledge domains based on the number of questions from each knowledge domain as provided by the COR.

· The test must be immediately scored and a preliminary pass/fail grade conveyed to the test candidate after either: 1) the candidate finishes and submits the test or 2) the test is automatically terminated because the allotted test time expires.

· The application must time each test and terminate the test once the allotted time is up.

· The application must provide an on-screen tutorial explaining how the test works. This tutorial must be provided prior to the test beginning, and be available at all times during the test. The tutorial shall cover an explanation of the multiple-choice test format, the procedure for answering the questions, the procedure for reviewing and changing answers, the procedure for submitting the completed test, the time limit, the pass/fail grade, and other pertinent information.

· The application must provide for a post-examination survey following the completion of the test. (Note: There will be a maximum of 10 survey questions. All survey questions will be provided by the COR after contract award within 15 calendar days. The survey will be provided to the test candidate after the test candidate has been told he/she passed/failed.)

· The contractor must, at all times, provide for the protection and security of all test and test-related data and OCC personnel data.

· The application must provide for all required reports (see section 4.2.d).

· The user interface for the exams must be a Graphical User Interface (GUI) that is user friendly and highly intuitive. The interface must:

· Conduct quality assurance activities to ensure that the tests are fully operational and usable by the test candidates. The COR will have the right to be present at the quality assurance activities.

5. Delivery, inspection, and acceptance requirements.

· The contractor shall complete the automation and programming requirements and have a fully operational, inspected, and accepted test delivery system within 75 calendar days of receipt of OCC’s test data.

· Within 10 calendar days after receipt of the OCC’s test data, the contractor shall provide the COR with a project implementation schedule. In developing the project implementation schedule, the contractor shall allow enough time to correct problems identified by the COR and still meet the 75 calendar day delivery deadline.

· The project implementation schedule shall show key project milestones and allow for periodic review and approval by the COR (within 7 calendar days of receipt) of the following deliverables:

· The contractor’s project implementation schedule shall allow for COR reviews and inspections (within 7 calendar days of receipt) early in the development process to ensure that problems can be identified and corrected as soon as possible.

· As a result of its reviews and inspections, and within reasonable limits, the COR shall have the right to require, at no additional cost, revisions to any of the deliverables listed above.

· The time the COR takes inspecting and approving the contractor’s deliverables shall not be considered as part of the contractor’s 75 calendar day delivery schedule. The COR shall inspect and approve the contractor’s deliverables within 7 calendar days.

4.2 Test Delivery and Administration

The contractor shall provide all facilities, services, and related support, such as reasonable accommodations necessary to register test candidates, deliver tests, and provide reports as specified in this Section. The required services and support shall include the following:

4.2.a Test Center Requirements

1. The contractor shall have a network of established, computer-based testing centers. As used herein “established” means facilities that are regularly used for electronic testing purposes. The contractor shall have at least one testing facility within a 50-mile radius of at least 50 of the 67 OCC offices listed in Attachment 1.

2. The test centers shall be compliant with Americans with Disabilities Act, 42 U.S.C. Section 12101 et seq. (ADA).

3. The test centers shall be open during normal business hours for candidate testing. As used herein, “normal business hours” means between the hours of 9:00 a.m. and 5:00 p.m. locally, Monday through Friday, except Federal Holidays. The OCC recognizes the following legal holidays: New Year’s Day, Martin Luther King Jr. Day, President’s Day, Memorial Day, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving Day, and Christmas Day.

4. The contractor’s facilities shall allow each test candidate to be tested in his/her own test carrel.

5. The test centers will offer testing accommodations such as alternate methods of scheduling the test, location of the test, testing environment, software, equipment, or personal assistants. All reasonable accommodations will be pre-approved by the COR and discussed with the contractor.

4.2.b Registration of Test Candidates

1. Subject to the limitations specified in Section 4.2 of this Part, the contractor shall allow candidates to register and take the UCE test during normal business hours during a scheduled test period. The COR will determine the dates of each test period and notify the contractor once the dates are finalized. The OCC will notify the Contractor of the test dates within 15 calendar days of the start of the base year and each subsequent option year, if exercised. Each test period will be approximately eight weeks long.

2. At least 15 calendar days prior to the beginning of a test period, the COR will provide the contractor with a list of test candidates. The format of the list will be determined by the COR with input from the contractor. This list will provide the following information about each candidate:

· Name of each candidate,

· OCC Employee ID number,

· The test, including specified knowledge domains, to be electronically administered to the candidate.

3. Within 5 calendar days after receiving the list of test candidates from the COR, the contractor shall:

· enter the beginning and ending dates of the test period, the names of the candidates, and the corresponding candidate information into its web-based system;

· notify its test centers of this information, as necessary; and

· notify the COR when the test candidates may register (test candidates shall be able to register at least 7 calendar days prior to the first test day).

4. The contractor shall provide the capability for test candidates to register online, via email, by telephone (toll-free), and by fax. Registration online, via email and by fax shall be available 24/7. Registration by contacting the contractor’s registrar by phone shall be available during normal business hours. Unless the contractor accepts a shorter time period, candidates will be required to register at least 48 hours in advance of the desired test date. At the time of registration, each candidate will stipulate his/her test date, time, and test center. If the candidate does not know the nearest test center, the contractor shall identify the nearest test center for the candidate. Once the candidate has registered, the contractor shall, within 24 hours, provide the candidate with email confirmation of the date, time, and location of the test.

4.2.c Delivery of Tests

1. The contractor shall deliver and administer the test to the OCC test candidates at the approved test centers.

2. The contractor’s test centers shall be ready to administer the test to any approved OCC test candidate who has met the 48-hour-advanced-notification requirement specified in paragraph 4.2.b.4 above.

3. The contractor shall provide qualified test center personnel to administer the test and monitor the test candidates while the test is being taken.

4. Before allowing any test candidate to take the test, the test center’s personnel shall verify the candidate’s identity. To verify their identity, candidates shall be required to produce government-issued photo identification (Driver’s License, Passport, Military ID). Other means of photo identification can be used if agreed to by the COR and Contractor. The contractor shall not allow any candidate that does not have the required identification to take the test.

5. Once the candidate’s identity has been verified, the test center’s personnel shall provide the test candidate with a brief description of the policies and procedures of the test center and shall then answer questions posed by the candidate that are of an administrative nature.

6. The test center’s personnel shall provide the test candidate with scratch paper and a pencil and/or pen. The candidate is not allowed to bring personal articles, such as coats, briefcases, purses, cell phone, paper, pen/pencils, and reference material, into the testing area. The candidate is allowed to bring in and use an approved calculator based on testing center guidance. The test center shall provide lockers for candidate’s to lock their personal items while taking the test.

7. The test center’s personnel shall escort the candidate to his/her test carrel and shall verify that the test program is on the screen and ready for the test candidate’s use.

8. The test center shall have a proctor monitor the testing session to ensure that the candidate is taking the test in a fair manner and that security of the test is not breached. If problems or irregularities are noted, the contractor shall document them and notify the COR via email within 24 hours of the date the test was taken or the following Monday if the test was taken on Friday.

9. The test center’s proctor shall verify that the test candidate was present through the entire time the test was in progress. This may be accomplished by having the test candidate sign in before the test begins and sign out at the completion of the test, or by other means approved by the COR. Test candidates may leave the testing room to go to the bathroom at any time and during their 15 minute break. The time on the test will continue to count down when a bathroom break is taken during the test and not during the 15 minute break.

10. At the end of the test, the test center’s personnel shall collect the scratch paper and pencil/pen from the test candidate.

4.2.d Reporting

1. The contractor shall provide all reports in Microsoft Word or in other applications, if acceptable to the COR. The contractor shall provide an electronic copy of all reports.

2. The following reports are required:

· Registration Report.

b. Delivery requirement: The contractor shall submit the registration report weekly during the test period to the COR.

· Cancellation/No Show Report.

b. Delivery requirement: The contractor shall submit the Cancellation/No Show Report to the COR on a monthly basis, at the same time it submits its invoice to OCC.

· Test Results Summary Report.

b. Delivery requirement: The contractor shall provide electronic access to the test results summary report within 24 hours following the day on which a test was taken. If a candidate tests on Friday, results will be provided on the following Monday.

· Year-End Aggregate Report.

b. Delivery requirement: The contractor shall furnish the Year-End Aggregate Report within 15 calendar days of the last test period of the year.

· Post-Examination Survey Report.

a. Contents: This report consists of each candidate’s written post-examination survey.

b. Delivery requirements: The contractor shall furnish the test candidate’s post-examination survey within forty-eight (48) hours of completion of the test.

4.3 Data Maintenance Services

1. The OCC shall revalidate all of the test questions and answers on a semi-annual basis. The OCC may, at that time, delete, revise and/or add up to a maximum of 30% of the questions.

2. The contractor shall provide data maintenance services to include the following:

· Accept the OCC’s revised and/or new test questions, related exhibit, multiple choice responses, answers, and grading schematic in electronic format.

· Load OCC’s revised and/or new data into the database.

· Secure and encrypt the revised and/or new data.

· Conduct quality assurance activities to ensure that the revised tests are fully operational and usable by the test candidates. The COR will have the right to be present at the quality assurance activities.

3. The data maintenance services, including quality assurance, shall be performed within 60 calendar days of receipt of the OCC’s revised test data. The length of time the deliverables, such as the draft of the test format, are in the possession of the COR for approval does not count towards the 60 calendar day period. The COR shall inspect and approve the contractor’s deliverables within 2 calendar days.

4. Intermediate deadlines for such deliveries as the draft of the revised test format shall be established by the COR and contractor, but must be approved by the COR. The test format, GUI, etc. shall be approved by the COR prior to the administration of the first revised test in the first test period of the Option Year. The COR shall review the contractor’s deliverables within 2 calendar days.

5. Notwithstanding the foregoing, the contractor is responsible for meeting the 60-day deadline.

5.0 CANCELLATIONS and NO SHOWS

The contractor shall be paid for the cancellation of a test as follows:

A test candidate may cancel his/her scheduled test date. There shall be no charge for the cancellation if it is made a minimum of forty-eight (48) hours in advance of the scheduled test date. If the cancellation is made within 48 hours of a scheduled test date, the cancellation fee applies.

The contractor shall be paid in the event a test candidate did not show up to take a scheduled test.

6.0 DESTRUCTION OF GOVERNMENT FURNISHED DATA

Upon the conclusion of the contract, the contractor shall destroy all tests, answers, grading schematics, and related data. The contractor shall provide the COR with written certification that all OCC data has been destroyed. OCC Security will need to approve the manner of the destruction.

7.0 CONTRACT ADMINISTRATOR (CA) and ALTERNATE CA

The contractor shall provide a CA to serve as a single point of contact for the coordination of all contract activities. The designated individual shall be experienced in contract administration and in computer-based testing services.

The contractor shall also designate an Alternate CA in the event the CA is absent. The Alternate CA shall be experienced in the industry.

The contractor shall notify the COR in writing of any intended replacement for the CA or Alternate CA.

8.0 PERFORMANCE REQUIREMENT SUMMARY

9.0 SECTION 508

The Contractor must ensure all Electronic Information Technology (EIT) meets the applicable standards of Section 508 of the Rehabilitation Act of 1973, as amended. This includes all computer based test systems, Web-based registration. All documents, reports, study aids or plans submitted must be suitable for sharing within the OCC Intranet by meeting “Web-based Intranet” standards. Specifically, the following standards apply:

1194.21 - Software Applications and Operating Systems

1194.22 – Web-based Intranet and Internet information and applications

1194.31 – Functional Performance Criteria

10.0 INFORMATION SECURITY AND PRIVACY REQUIREMENTS

1. Applicability

This section applies to the Contractor, its subcontractors, and Contractor personnel (hereafter referred to collectively as “Contractor”) and addresses specific OCC requirements in addition to those included in the Federal Acquisition Regulation (FAR), Privacy Act of 1974 (5 U.S.C. 552a - the Act), the Health Insurance Portability and Accountability Act of 1996 (HIPAA, Pub. L. 104-191, 110 Stat. 1936), the Sarbanes-Oxley Act of 2002 (SOX, Pub. L. 107-204, 116 Stat 745), and other laws, mandates, or executive orders pertaining to the development and operations of information systems and the protection of sensitive information and data. The following shall not be construed to alter or diminish civil and/or criminal liabilities provided under various laws or mandates.

2. Information Types

The term Information is synonymous with data, regardless of format or medium. Personally Identifiable Information (PII) is a subset of Sensitive Information. Sensitive PII is a subset of PII, and therefore a subset of Sensitive Information. All requirements for Sensitive Information apply to PII and Sensitive PII. All requirements for PII apply to Sensitive PII.

Sensitive Information

Sensitive Information is any information, which if lost, compromised, or disclosed, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual, the Government, or the Government’s interests. Sensitive Information is subject to stricter handling requirements because of the increased risk if the data is compromised. Some categories of Sensitive Information include Financial, Medical or Health, Legal, Strategic and Business, Human Resources, Personally Identifiable Information (PII), and Sensitive PII. These categories of information require appropriate protection as stand-alone information and may require additional protection in aggregate.

Personally Identifiable Information (PII)

PII, as defined in OMB Memorandum M-17-12, refers to information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual. Because there are many different types of information that can be used to distinguish or trace an individual's identity, the term PII is necessarily broad. To determine whether information is PII, the agency shall perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available -in any medium or from any source -that would make it possible to identify an individual.

Sensitive PII (SPII)

Sensitive PII refers to information that can be used to target, harm, or coerce an individual or entity, assume or alter an individual’s or entity’s identity, or alter the outcome of an individual’s or entity’s activities. Sensitive PII requires stricter handling because of the increased risk to an individual or associates if the information is compromised. Some categories of Sensitive PII include stand-alone information, such as Passport Numbers, Social Security Numbers (SSN) or biometric identifiers. Other information such as a financial account, date of birth, maiden names, citizenship status, or medical information, in conjunction with the identity of an individual (directly or indirectly inferred), are also considered Sensitive PII. In addition, the context of the information may determine whether it is sensitive, such as a list of employees with poor performance ratings or a list of employees who have filed a grievance or complaint.

3. Contract Security Categorization

The OCC has determined that the Contractor providing the Entry-level Bank Examiner Candidate Testing will be required to collect, process, transmit, store and dispose of Sensitive Information related to members of the public and/or OCC employees and OCC operations including Personally Identifiable Information (PII). As a result, the OCC has determined that all Federal Information Security Management Act of 2002 (Public Law 107-347) (FISMA) security and privacy requirements for a MODERATE impact system apply to the Contractor and the Contractor systems supporting these services.

FISMA requires each agency to develop, document, and implement an agency-wide Information Security program to safeguard information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, Contractor (including subcontractors) or other source on behalf of an agency. That is, agency information security programs apply to all organizations (sources) which have physical or electronic access to a Federal agency’s computer systems, networks, or IT infrastructure; or use information systems to generate, store, process, or exchange data with a Federal agency, or on behalf of a Federal agency, regardless of whether the data resides on a Federal Agency or a Contractor’s information system. This includes services that are either fully or partially provided; including other agency hosted, outsourced, and cloud computing solutions.

The Contractor and all of its respective subcontractors shall follow and remain compliant at all times with all OCC and Federal Information Technology (IT) Security standards, policies, and reporting requirements, as well as all National Institute of Standards and Technology (NIST) standards and guidelines, other Government-wide laws and regulations for the protection and security of Government Information.

The Contractor shall ensure that any system, application or environment being operated on behalf of OCC or being used to process any OCC information must meet all FISMA requirements including those specified in NIST SP 800-53 Rev. 4, “Security and Privacy Controls for Federal Information System and Organizations”

If the Contractor proposes a Cloud-Based solution, the solution must be fully FedRAMP certified prior to being placed into production.

4. Entry-level Bank Examiner Candidate Testing Services Specific Information Security and Privacy Requirements

Disaster Recovery Requirements

· The Contractor is required to provide continuous coverage and satisfactory performance for the systems and services being provided during disruptive events such as an Information Technology failure; events effecting the normal operation of the data center/facility hosting the system such as any national, state or locally declared emergencies, including hurricanes, floods, wildfires, civil disobedience, and terrorist events that could threaten the availability of system resources located at the data center/facility itself.

· In case of a catastrophic failure at the IT or facility level, the Contractor system(s) must have a Disaster Recovery (DR) capability at an alternate facility that can be brought on line within 48 hours. No part of the alternate facility used to provide DR services for the Contractor’s system may be located outside of the United States or at another facility not covered/identified in the contract at time of award

· The Contractor is required to maintain an up to date Disaster Recovery Plan (DRP), updated at least annually, which can be made available to the OCC within seven (7) calendar days upon request. The initial DRP shall be submitted within thirty (30) calendar days of contract award.

· The Contractor’s system(s) and the associated DRP must be tested at least annually with the latest test results made available to the OCC within thirty (30) calendar days of contract award and within seven (7) calendar days upon request thereafter.

· Any failed test result must be tracked via a Plan of Actions & Milestones (POAM) process that identifies, at a minimum, the risk, Corrective Action Plan, responsible official, and schedule for resolution. Any DR related POAM will be included in the Contractor’s overall POAM program and made available to OCC within seven (7) calendar days upon request.

5. General Information Security and Privacy Requirements

Authorization to Use, Store, or Share Sensitive Information

(a) Information collected, used, stored, maintained, or otherwise processed by the Contractor in the performance of this contract shall be accessed, transferred, stored or processed only within the sole jurisdiction of the United States Federal Government. The Contractor shall not host any portion of the information, data, information system, infrastructure, or environment in facilities outside the contiguous United States, Alaska, Hawaii, and other U.S. Territories.

(b) The Contractor's primary location and facilities and backup data centers that process Government data shall be located within the sole jurisdiction of the United States Federal Government.

(c) In addition, the maintenance and support operations of Contractor’s technology and information must take place, and originate from, within the United States.

(d) The Contractor shall comply and agree to at all times to protect the Government's information and data in accordance with the terms of this contract. The data that is processed, maintained, or stored by Contractor shall be protected against unauthorized access, disclosure or modification, theft, or destruction.

(e) Information made available to the Contractor by the Government for the performance or administration of this effort shall be used only for those purposes and shall not be used in any other way without the written agreement of the CO.

(f) The deliverables in this contract will be considered sensitive and shall not be shared with any other organization without prior approval from the OCC CO.

(g) The Contractor, and any sub-Contractors, shall not use any Personally Identifiable Information (PII), E-mail Groups, Lists, or contract information for any purpose other than those activities necessary to the performance of this contract.

(h) Written approval by the Chief Information Security Officer (CISO), or delegate, is required prior to the use or storage of OCC Sensitive Information or sharing of OCC Sensitive Information by the Contractor with any subcontractor, person, or entity other than OCC.

(i) The Contractor shall not remove Sensitive Information from approved OCC location(s), electronic device(s), or other container(s), without prior written approval of the OCC CISO, or designate.

(j) The Contractor agrees to assume responsibility for protecting the confidentiality of Government records associated with this contract, which are not public information. Each Contractor or employee of the Contractor to whom information may be made available or disclosed shall be notified in writing by the Contractor that such information may be disclosed only for a purpose and to the extent authorized herein.

(k) The Contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The Contractor shall also protect all Government data, equipment, etc. by treating the information as sensitive. All information about the systems, gathered or created under this contract shall be considered as Sensitive But Unclassified (SBU) information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If Contractor personnel must remove any information from the primary work area they shall protect it to the same extent they would their proprietary data and/or company trade secrets. The use of any information that is subject to the Privacy Act will be utilized in full accordance with all rules of conduct as applicable to Privacy Act Information.

(l) Sensitive information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The Contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected. When no longer required, this information, data, and/or equipment will be returned to Government control, destroyed, or held until otherwise directed. Destruction of items shall be accomplished by following NIST Special Publication 800-88, Guidelines for Media Sanitization.

6. Information Security Incidents

An Information Security Incident is an incident that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access of any Contractor or Government systems or information, including, but not limited to, Sensitive Information.

Information Security Incident Reporting Requirements

All Information Security Incidents, including those that potentially or actually cause the compromise of OCC information must be reported in accordance with the requirements below, even if it is believed the incident may be limited, small, or insignificant. OCC will determine when an incident requires additional focus and attention.

(a) Contractor employees must report all information security incidents to the OCC Cyber Defense Center (CDC) immediately (within 1 hour), after becoming aware of the incident, at: Computer.Security@occ.treas.gov, (202) 649-7930, regardless of day or time.

(b) When notifying the OCC CDC, copy the Contracting Officer if possible, or if reporting by phone or Contracting Officer’s email is not immediately available; contact the Contracting Officer immediately after reporting the incident to OCC CDC.

(c) If you have questions regarding these procedures, please contact the Contracting Officer.

(d) Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

(e) Contractor employees must also provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC; with the following text in the subject line of the email: “Supplementary Information/Report related to previously reported incident ## [insert number].”

Information Security Incident Response Requirements

(a) All determinations related to information security incidents, including response activities, notifications to affected individuals and/or Federal agencies, and related services (e.g., credit monitoring) will be made by authorized OCC officials at OCC’s discretion.

(b) The Contractor and Contractor employees must provide full access and cooperation for all activities determined by OCC to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of information security incidents.

(c) Incident response activities determined to be required by OCC may include but are not limited to, inspections; investigations; forensic reviews; data analyses and processing; and final determinations of responsibility for the incident and/or liability for any additional response activities.

(d) OCC, at its sole discretion, may obtain the assistance of Federal agencies and/or third party firms to aid in incident response activities, as needed.

(e) The Contractor shall be responsible for all costs and related resource allocations required for all subsequent incident response activities determined to be required by OCC, whether incurred by OCC, agents under contract or on assignment to OCC, or by third party firms.

7. Security Controls

(a) The Contractor shall, with the knowledge and concurrence of the Government system owner, be responsible for IT security for all non-government-owned systems processing OCC information in the fulfillment of contract requirements. This includes hardware, software, databases, networks, and telecommunications systems.

(b) Contractors will be required to ensure compliance with the security control requirements of the current version of NIST SP 800-53 or Federal Information Processing Standard (FIPS) 200 that are appropriate to the sensitivity and criticality of the data or system.

(c) Applications must undergo FISMA Compliant Security Assessment and Authorization (SA&A) prior to going into production and undergo Continuous Monitoring as described in the next section.

(d) The Contractor must follow the current version of the following NIST documents:

· NIST SP 800-37

· 800-34

· 800-18

· 800-30

· 800-60

· 800-53

· 800-53A

· Federal Information Processing Standard (FIPS) 199 and 200

(e) The Contractor must follow the current version of the following OCC documents:

· Associated OCC guides/templates

· OCC Privacy Impact Assessment (PIA)

(f) The Contractor will work with OCC to define a clearly demarcated security authorization boundary for the system supporting this contract.

(g) The Contractor will provide supporting documentation to OCC as necessary in support of the SA&A process.

(h) The Contractor shall provide access to the OCC, or their designee acting as their agent, when requested, in order to verify compliance with the requirements for an Information Technology security program.

(i) The OCC reserves the right to conduct on-site inspections. The Contractor shall make appropriate personnel available for interviews and provide all necessary documentation during this review.

FISMA Compliance

(a) At all times, the Contractor shall comply with FISMA and OMB Circular A-130 requirements to the extent applicable.

(b) The Contractor shall provide the solution as a managed service implemented within a non-OCC data center. The proposed hosting data center and IT network infrastructure must have a current ATO provided by a Federal Agency that is leveraging the data center to host production systems/applications. The Contractor must provide all hardware and software associated with the solution. Key requirements related to this implementation approach include:

· Software Design and Implementation: The Contractor shall be responsible for the design, testing, and implementation of all components of the solution within the Contractor data center, in accordance with OCC policies, standards, and procedures, to include:

· OCC IT Security Policies and Procedures for each NIST Special Publication 800-53 Control Family (Current Revision)

· OCC Secure Configuration Baselines for Operating Systems, Database Management Systems (DBMS), Web Application Platforms, and other platforms as defined by OCC

· OCC System Development Lifecycle Methodology requirements, templates, and tools

· OCC Configuration Management, Change Control, and Problem Tracking/Resolution procedures, templates, and tools

· The Contractor shall be responsible for provisioning all required hardware and environments (production, staging, test, and development) for the solution.

These documents will be made available upon contract award.

· Service/Solution-Specific Security Artifacts: The Contractor shall develop a System Security Plan (SSP) specific to the OCC services solution as part of the Security Assessment & Authorization (SA&A) package. The SSP shall (1) detail the control allocations, status, and implementation details of the organizational common controls, facility controls, and IT network infrastructure controls supporting the solution; and (2) detail the control allocations, status, and implementation details for all controls applicable/allocated to the solution at the operating system, DBMS, web application platform, and application level, other than those inherited directly from the organizational common controls, facility controls, and IT network infrastructure. In addition, the Contractor shall develop the following security artifacts specific to the OCC solution:

· FIPS 199 Impact Assessment (based on OCC-issued template)

· E-Authentication Risk Assessment (based on OCC-issued template)

· Privacy Impact Assessment (PIA) (based on OCC-issued template)

· Information System Contingency Plan (ISCP) (based on Contractor template or OCC-issued template)

· ISCP test results (based on Contractor template or OCC-issued template)

· Continuous Monitoring Plan (CMP) for the solution, to include Customer Responsibilities (based on Contractor template or OCC-issued template)

· Interconnection Security Agreements, Service Level Agreements, and Memoranda of Understanding.

These documents will be made available upon contract award.

· IT Security Control Assessments: The Contractor shall be responsible for performing an initial IT security control assessment of all applicable controls for each IT component associated with the requirements in Section 5, to include facility controls and IT network infrastructure controls, with the exception of the organizational common controls inherited from OCC. The Contractor shall also be responsible for performing annual or more frequent IT security control assessments of all applicable controls for each IT component associated with the solution, to include facility controls and IT network infrastructure controls, with the exception of any organizational common controls inherited from OCC. The assessments shall be performed by a certified Third-Party Assessment Organization (3PAO) or an qualified independent assessor that meets the qualifications and independence requirements and guidelines specified in NIST SP 800-37 and NIST SP 800-53 (Current Revision). As part of the SA&A package, the Contractor shall be responsible for documenting a Security Control Assessment (SCA) Plan and a Security Assessment Report (SAR) for each assessment, as well as a Plan of Action and Milestones (POAM) for each deficiency identified during the initial and annual/ongoing IT security control assessments. The POAMs shall be managed in accordance with (A) OCC POAM management procedures (available upon contract award); or (B) with POAM management procedures established by the Contractor for the purposes of this initiative, provided that the POAM management procedures and mechanisms are established in accordance with all relevant Federal requirements, as determined by a 3PAO assessment. The POAMs shall be provided to the OCC COR following each assessment, and made available to authorized OCC personnel within (7) calendar days upon request throughout the remediation process.

· OCC Component Design Specifications: Under this implementation option, the Contractor shall provide detailed technical architecture specifications and design artifacts for any client-site (i.e., OCC-hosted) IT components related to the use of the Contractor-hosted solution (VPN gateways/connections, etc.).

· Solution Authorization to Operate: The Contractor shall provide access to all information and documentation needed to support OCC’s determination of whether to authorize the solution for operations and the migration of production data to the solution. The determination of whether to issue an authorization to operate (ATO) will be made by OCC based on identified risks to OCC data/operations, based on the IT control deficiencies identified in assessments of the IT components associated with the solution and associated facility controls and IT network infrastructure controls. The Contractor shall be responsible for remediating, and having an independent party[footnoteRef:1] validate the remediation of, identified IT security control deficiencies, per the POAMs, and bringing the solution into an acceptable level of risk and compliance to enable OCC to issue an ATO for the solution.