Final_SOW_5_8_14.docx

U.S. Commission of Civil Rights

Financial Statement Audit (FSA) and Federal Information Security Management Act of 2002 Evaluation (FISMA) Statement of Work

Contents

1. OBJECTIVE AND BACKGROUND

The objective of this statement of work is to obtain: 1) an independent audit of the annual financial statements for the U.S. Commission on Civil Rights (“Commissioner”) as required by the Accountability of Tax Dollars (ATD) Act of 2002 (Public Law 107-289)) and the Government Management Reform Act (GMRA) of 1994 (Public Law 103-356), and 2) an independent evaluation of Commission’s information security program and practices related to the financial and non-financial related systems in accordance with the Federal Information Security Management Act (FISMA) of 2002, Public Law 107-347. Please note: The contractor shall refer to the most recent version of all applicable laws, regulations, accounting and auditing guidance as well as information security management guidance as referenced throughout the Statement of Work.

1.1 Entity to be Audited

1.1.1 Background and Mission

Created in 1957 as an independent federal agency, the mission of the U.S. Commission on Civil Rights is to:

The Commission has several offices and units within its headquarters, as well as six regional offices. The day-to-day operations of its headquarters and the regional officers is managed by the staff director.

1.1.2 Staff Director

The staff director serves as the administrative head of the Commission. The staff director oversees the overall operation and management of the Commission.

1.1.3 Office of Management

The Office of Management (OM) supports all of the agency’s strategic goals and objectives by ensuring that human and financial capital are available, and administrative support is in place to achieve the agency’s mission. The Office of Management (OM) provides administrative support to all other Commission offices. Several divisions fall within this office: the Budget and Finance Division, the Human Resources Division, and the Administrative Services and Clearinghouse Division.

1.1.4 Budget and Finance Division (BFD)

The Budget and Finance Division is responsible for budget preparation, formulation, justification, and execution. This division is also responsible for overseeing and coordinating the work of the agency’s external accounting services provider, certifying the availability of funds to support agency non-salary related financial transactions, creating and monitoring agency internal controls, and generally overseeing all aspects of agency financial management.

1.1.5 Administrative Services and Clearinghouse Division

The Administrative Services and Clearinghouse Division (ASCD) is responsible for information technology, procurement and acquisition, copying, printing, mail and distribution services, and the Rankin National Civil Rights Library. ASCD staff is responsible for the Commission’s information security program.

1.1.6 Systems and Service Providers

The Commission relies on Service Organizations to perform key financial management functions. General Services Administration (GSA) provides an integrated core accounting and financial management system in which they record the financial transactions of the Commission. The system is Pegasys Financial Management System. GSA obtains an annual Statement on Standards for Attestation Engagements (SSAE) No. 16, Reporting on Controls at a Service Organization for Pegasys. The National Finance Center of the United States Department of Agriculture provides Payroll Services for the Commission. NFC obtains an annual Statement on Standards for Attestation Engagements (SSAE) No. 16, Reporting on Controls at a Service Organization.

1.1.7 Financial Statements

GSA prepares the Commission’s financial statements, including balance sheet, and statements of net costs, statements of changes in net position, and statements of Budgetary Resources. The financial data comes directly from the chart of accounts.

1.1.8 Prior Financial Statement Audits

The Commission obtained a full audit for FY 2013 and received an unqualified opinion on all of its financial statements. The Commission’s Performance and Accountability reports are available on the commission’s website (www.usccr.gov) under the section titled “Recent Congressional Reports and Testimony”.

1.2 Audit and Evaluation Background

1.2.1 Financial Statement Audit

The financial statement audit is required by the Accountability of Tax Dollars (ATD) Act of 2002 (Public Law 107-289)) and the Government Management Reform Act (GMRA) of 1994 (Public Law 103-356), and will assist Commission management in assessing the effectiveness of internal controls and compliance with applicable laws and regulations.

1.2.2 Federal Information Security Management Act (FISMA) Evaluation The E-Government Act (Public Law 107-347) was signed into law on 17 December 2002. Title III of this Act, “Information Security” (also known as the “Federal Information Security Management Act of 2002”) provides a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support Federal operations and assets. FISMA requires each Federal agency to develop and manage an agency information security program and to facilitate preparation of an annual FISMA status report. FISMA also requires an annual independent evaluation of the information security program and practices of each agency.

In FY 2010, the Director, OMB, delegated operational responsibilities to the Department of Homeland Security (DHS) for providing annual FISMA guidance to Federal agencies; however, the Director, OMB, retains oversight responsibility for annual reporting to Congress on FISMA compliance. Under FISMA guidance, the Commission is a Micro-Agency.

1.2.3 IT Systems and Services

USCCR utilizes a range of IT products and services both shared federal services and commercial products to support its mission, business services, collaborative work and IT foundation and security using GSA and DHS certified vendors including but not limited to the following IT assets:

· Firewalls

· Routers

· IPS

· VOIP (June 2014)

· Networx

· Servers

· Desktops

· Mobile

· Two Factor Login

· IT Policies and Procedures

· Cloud Based Web services (Collaboration, Video Conferencing, Email, Archive, Travel)

· Websites

· Databases (Statistical and Publication)

2. REQUIREMENTS

2.1 Financial Statement Audit (FSA)

The Contractor shall conduct an audit of Commission’s annual financial statements. The audit shall be performed in accordance with generally accepted government auditing standards (GAGAS), as specified in the most current version of the Government Accountability Office’s (GAO) Government Auditing Standards, and the provisions of OMB Bulletin No. 14-02, Audit Requirements for Federal Financial Statements, as amended. In conducting the audit, the methodology used should be consistent with the most current version of the GAO/President’s Council on Integrity and Efficiency (PCIE) Financial Audit Manual (FAM). At a minimum, the Contractor shall provide documentation, prior to beginning the work, which demonstrates how the Contractor’s approach addresses the elements of the FAM.

With respect to Required Supplementary Information (RSI) and Required Supplementary Stewardship Information (RSSI), the Contractor shall assess whether the information and its presentation is materially consistent with the information in the basic statements. In performing this assessment the contractor shall perform procedures consistent with AU § 558, Required Supplementary Information.

With respect to internal controls, the Contractor shall obtain an understanding of the components of internal control and assess the level of control risk relevant to the assertions embodied in the classes of transactions, account balances, and disclosure component of the financial statements. Such controls include relevant information technology (IT) general and application controls and controls relating to intra-entity and intra-governmental transactions and balances.

To assess the effectiveness of the IT control environment, the Contractor shall, at a minimum, perform procedures over the following GAO Federal Information System Controls Audit Manual (FISCAM) general control areas:

With respect to compliance with applicable laws and regulations, the Contractor shall perform tests of compliance with laws and regulations, including laws governing the use of budget authority laws, regulations, and government-wide policies identified by OMB, and any other laws and regulations that could have a direct and material effect on the basic statements.

2.1.1 Planning

The Contractor shall plan the audit work consistent with the FAM Section 200. The Contractor shall develop ways to obtain the evidence necessary to report on Commission’s financial statements, internal controls, and compliance with laws and regulations. The Contractor shall receive approval from the Contracting Officer’s Representative (COR) prior to the implementation of any changes to the scope of the audit. The Contractor shall conduct an entrance conference with key Commission officials for the financial statement audit. The entrance conference shall occur prior to the commencement of work. The Contractor shall coordinate with the COR to schedule these meetings.

(Deliverables 001 and 002 as described in Section 5)

2.1.2 Testing

The Contractor shall complete the following in accordance with FAM Sections 300 and 400:

Audit procedures shall encompass tests of internal controls, tests of detail transactions and balances (substantive testing), and tests of compliance of laws and regulations. As necessary and based on testing performed, the Contractor shall develop findings and recommendations, as described in the FAM Section 580 and generally accepted government-auditing standards.

(Deliverables 003, 004 and 005 as described in Section 5)

2.1.3 Reporting

The Contractor shall complete audit procedures, evaluate results and conclusions reached, and report results to the COR and Commission management consistent with the FAM Section 500. The Contractor shall conduct an exit conference with key Commission officials for the financial statement audit. The exit conference shall occur upon completion of the audit. The Contractor shall coordinate with the COR to schedule these meetings. The Contractor shall conduct a lessons learned meeting with the appropriate Commission management representatives and the COR to discuss and document the processes that were effective and those that could be improved during the subsequent year’s contract performance.

(Deliverables 006 and 007 as described in Section 5)

2.2 Federal Information Security Management Act (FISMA) Evaluation The Contractor shall develop an evaluation program that shall include the objectives of each program and steps that will be taken to accomplish the objectives, including the nature, timing and extent of evaluation procedures. The evaluation program shall conform to applicable OMB/DHS guidance. The evaluation program shall encompass the Program Areas referenced in SOW Section 2.2. The Contractor shall conduct an entrance conference with key Commission officials for the FISMA evaluation. The entrance conference shall occur prior to the commencement of work. The Contractor shall coordinate with the Alternate Contracting Officer’s Representative (ACOR) to schedule these meetings.

(Deliverable 008 as described in Section 5) The evaluation shall consider the current applicable federal laws and guidance for Federal agencies and specifically FISMA Micro Agency Reporting Metrics for the current fiscal year to include:

· Federal Information Security Management Act of 2002 (FISMA)

· Office of Management and Budget (OMB) Circular A-130, Appendix III, Security of Federal Automated Information Resources

· Government Accountability Office, Federal Information System Control Audit Manual (FISCAM)

· Homeland Security Presidential Directive #7, Critical Infrastructure Identification, Prioritization, and Protection

· FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems

· FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems

· NIST Special Publication 800-18, Revision 1, Guide for Developing Security Plans for Federal Information Systems

· NIST Special Publication 800-53, Recommended Security Controls for Federal Information Systems

Note: Links for the FY 2014 FISMA Micro Agency Reporting Metrics are listed below. Commission not responsible for links’ location or status:

http://www.dhs.gov/sites/default/files/publications/FY14%20IG%20Annual%20FISMA%20Metrics_0.pdf http://www.dhs.gov/sites/default/files/publications/FY14%20Micros%20Annual%20FISMA%20Metrics_0.pdf http://www.dhs.gov/sites/default/files/publications/FY14%20SAOP%20Annual%20FISMA%20Metrics_0.pdf.

2.2.1 Evaluation of USCCR’s Information Security Posture

The Contractor shall conduct an evaluation of Commission’s compliance with FISMA and related OMB, DHS, and OIG requirements, which includes the following Overall Security Management and Program Areas of information security management:

Overall Security Management:

· Development of Detailed IT Policies and Procedures

· A Comprehensive Risk Management Process

· A Comprehensive Certification and Accreditation Process

· Effective Oversight of Contractors and Contractor Systems

· An Agency-Wide Privacy Program

· Effective Configuration Management Policies and Procedures Program Areas:

The FISMA evaluation shall be conducted in accordance with the Council of Inspectors General on Integrity and Efficiency (CIGIE) Quality Standards for Inspections and Evaluations issued January 2012, and subsequent revisions, with the general standards of GAO’s Government Auditing Standards, and with applicable annual instructions from OMB/DHS. The Contractor shall consult with the ACOR in the selection of systems to be reviewed. Results of the evaluation shall be documented in a report in accordance with FISMA and applicable reporting guidance. The report shall include responses to the questionnaire provided by OMB/DHS as part of the FISMA instructions. Findings disclosed in the report shall include recommendations for corrective action.

2.2.2 Planning

The Contractor shall conduct an entrance conference with key Commission officials for the FISMA evaluation. The entrance conference shall occur prior to the commencement of work. The Contractor shall coordinate with the ACOR to schedule these meetings.

2.2.3 FISMA Evaluation

The Contractor shall perform evaluation procedures according to 2.2, 2.2.1 and 2.2.2. The Contractor shall document results of testing and conclusions reached in accordance with FISMA, CIGIE Quality Standards on Inspection and Evaluation, and applicable annual instructions from OMB, DHS, and OIG. The report shall include responses to the questionnaire provided by OMB/DHS as part of the FISMA instructions. The Contractor shall develop findings that describe the condition, cause, criteria, effect and recommendation based on testing performed.

(Deliverable 009 as described in Section 5)

2.2.4 Reporting

The Contractor shall develop a draft FISMA evaluation report that includes the results of evaluation procedures and complies with applicable OMB/DHS guidance. This report is subject to ACOR approval prior to finalizing the form and content. The report shall include a section that describes findings identified during performance of FISMA evaluation procedures, including recommendations for management. The Contractor shall conduct an exit conference with key Commission officials for the FISMA evaluation. The exit conference shall occur upon completion of the evaluation. The Contractor shall coordinate with the ACOR to schedule these meetings. The Contractor shall conduct a lessons learned meeting with the appropriate Commission management representatives and ACOR to discuss and document the processes that were effective and those that could be improved during the subsequent year’s contract performance.

The Commission is a micro-agency and must file reports via Cyberscope utilizing the metrics for micro-agencies. The draft reports for Cyberscope should consist of three separate reports: one utilizing the IG Metrics, one utilizing the CIO metrics and one utilizing the Privacy metrics.

(Deliverable 010 as described in Section 5)

2.2.5 Conduct Network Scan

The Contractor shall complete a Network Scan.

(Deliverable 011 as described in Section 5)

2.3 Program Management

2.3.1 Quality Control

The Contractor shall maintain a system of quality control that is designed to provide reasonable assurance that the FSA or FISMA evaluation is conducted in accordance with applicable professional standards as well as legal and regulatory requirements. The system of quality control shall encompass firm and individual independence, internal quality control over documentation and document retention, and monitoring of compliance with continuing professional educational and applicable licensure requirements.

2.3.2 Contractor Personnel

The Contractor shall ensure that the contract is staffed to meet the contract requirements. All Contractor personnel shall comply with the requirements described in sections 2.3.2.1 through 2.3.2.4. Changes to key personnel shall be approved by the CO and COR in advance. The Contractor must identify in the technical proposal the key personnel and senior level management and above assigned to the contract, as well as the total number of personnel assigned to the audit, the position of each person and the expected number of work hours of each. At a minimum, the key personnel are the audit manager, supervisory senior auditor, senior auditor, IT Manager, IT supervisor senior auditor, and IT senior auditor. Changes to key personnel from the technical proposal shall be approved by the CO and COR in advance. All proposed personnel must currently hold the same or higher position in the firm as the person they are replacing.

2.3.2.1 Staff Clearance

During the period of performance for this contract the contractor is responsible for ensuring all contractor personnel assigned to this contract will have a background investigation. The contractor will certify that all personnel assigned to the contract have met this requirement to perform their role and to access agency information and information systems belonging to or being used on behalf of USCCR.

2.3.2.2 Minimum Contractor Staff Qualifications by Category Category Partner/Principal The minimum experience requirements in this category include: a) being a Partner or Principal in the Contractor’s organization, b) having a minimum of 10 years of audit experience, of which at least five (5) years relate to Federal government audits, c) having a bachelor degree and d) being an active Certified Public Accountant (CPA) in good standing with the American Institute of Certified Public Accountants (AICPA) and State Boards.

Audit Senior Manager The minimum experience requirements in this category include: a) being an Audit Senior Manager in the Contractor’s organization, b) having a minimum of eight (8) years of audit experience, of which at least four (4) relate to Federal government audits, c) having a bachelor degree and d) being an active CPA in good standing with the AICPA and State Boards.

Audit Manager The minimum experience requirements in this category include: a) being an Audit Manager in the Contractor’s organization, b) having a minimum of six (6) years of audit experience, of which at least three (3) relate to Federal government audits, c) having a bachelor degree and d) being an active CPA in good standing with the AICPA and State Boards.

Supervisory Senior Auditor The minimum experience requirements in this category include: a) being a Senior Auditor in the Contractor’s organization, b) having a minimum of four (4) years of audit experience, of which at least three (3) years relate to Federal government audits, and c) having a bachelor degree that includes 24 semester hours in accounting.

Senior Auditor The minimum experience requirements in this category include: a) being a Senior Auditor in the Contractor’s organization, b) having a minimum of three (3) years of audit experience, and c) having a bachelor degree that includes 24 semester hours in accounting.

IT Partner/Principal The minimum experience requirements in this category include: a) being a Partner or Principal in the Contractor’s organization, b) having a minimum of 10 years of IT experience, of which at least five (5) relate to the Federal IT environment, c) having a bachelor degree and d) being a Certified Information Systems Auditor (CISA) or Certified Information Systems Security Professional (CISSP).

IT Manager The minimum experience requirements in this category include: a) being an IT Manager in the Contractor’s organization, b) having a minimum of six (6) years of IT audit experience, of which at least three (3) relate to the Federal IT environment, c) having a bachelor degree and d) being a CISA or CISSP.

IT Supervisory Senior Auditor The minimum experience requirements in this category include: a) being an IT Senior Auditor in the Contractor’s organization, b) having a minimum of four (4) years of IT audit experience, of which at least three (3) relate to the Federal IT environment, and c) having a bachelor degree.

IT Senior Auditor The minimum experience requirements in this category include: a) being an IT Senior Auditor in the Contractor’s organization, b) having a minimum of three (3) years of IT audit experience, and c) having a bachelor degree.

IT Staff Auditor The minimum experience requirements in this category include: a) being an IT Staff Auditor in the Contractor’s organization, b) having a bachelor degree, and c) having a minimum of one (1) year of IT audit experience.

2.3.2.3 Independence

All Contractor personnel performing on the contract shall comply with independence requirements as defined by Government Auditing Standards (GAS). The contractor personnel shall submit a signed “Statement of Independence and GAO CPE Compliance” form as included in Section J of the contract, on an annual basis at the time of contract/ option year award.

The Contractor Firm shall submit a memorandum of independence and quality control as well as the most recent peer review report and PCAOB inspection report.

(Deliverables 012 and 013 as described in Section 5)

2.3.2.4 Professional Competence

All Contractor personnel shall comply with professional competence requirements as defined by Government Auditing Standards, to include Continuing Professional Education (CPE) requirements.

(Deliverable 013 as described in Section 5)

2.3.2.5 Confidentiality and Non-Disclosure

All Contractor personnel shall sign and adhere to Commission’s non-disclosure agreements to protect sensitive and proprietary government information. The contractor personnel shall submit a signed “Non-Disclosure Agreement” form as included in Appendix C.

(Deliverable 014 as described in Section 5)

2.3.3 Monthly Progress

The Contractor shall submit monthly progress reports. The submission of monthly reports shall continue until such time that the final labor hours incurred through the end of the audit have been reported. The Contractor shall provide a monthly status update of the financial statement audit and the FISMA evaluation. The monthly progress reports should be attached to any monthly invoice request for payment and must match the work and labor being billed on the invoice.

(Deliverables 015 as described in Section 5)

2.3.4 Technical Status Updates

The Contractor shall conduct regular meetings between the Contractor, Commission management, and the COR to discuss the technical status of the financial statement audit or FISMA evaluation, as applicable. Financial statement audit status meetings should include discussion of IT issues related to the audit, unless the issues are deemed highly technical in nature and require a separate IT status meeting.

Technical status meetings provide Commission’s management and the COR with sufficient insight into the Contractor’s progress on the financial statement audit or FISMA evaluation, as applicable, to enable the Commission’s management to fully understand emerging issues, the Contractor’s plans of action, and management’s ongoing responsibilities with respect to the financial statement audit or FISMA evaluation. Technical status meetings shall only include topics pertinent to Commission management. The CO, COR and/or Contractor may convene separate meetings to discuss any other issues or questions as they arise.

(Deliverable 016 as described in Section 5)

3. AUDIT AND EVALUATION DOCUMENTATION

3.1 General Requirements for Financial Statement Audit Documentation The Contractor shall prepare audit documentation (workpapers) in accordance with Government Auditing Standards. The workpapers should be developed in sufficient detail to provide a clear understanding of the work performed, audit evidence obtained and its source, and to support conclusions reached in accordance with the documentation requirements included in the GAO/PCIE FAM and AICPA Standards. The Contractor shall plan and organize audit documentation, and clearly link it to the audit objectives, audit plan, and reports, as applicable. The Contractor shall also ensure that the workpapers contain the audit completion checklist FAM 1003. All documentation and workpapers shall contain the proper security classification markings at all times.

3.2 General Requirements for FISMA Evaluation Documentation

The Contractor shall prepare evaluation documentation (workpapers) in accordance with CIGIE’s Quality Standards for Inspections and Evaluations. The workpapers should be developed in sufficient detail to provide a clear understanding of the work performed, evidence obtained, and its source, and to support conclusions reached. The Contractor shall plan and organize documentation, and clearly link it to the evaluation objectives, evaluation plan, and reports, as applicable. All documentation and workpapers shall contain the proper security classification markings at all times.

3.3 Access to and Retention of Documentation

The Contractor shall protect all documentation from unauthorized access and apply the appropriate physical safeguarding measures at all times. Only Contractor staff with a justified need shall have access to documentation.

The COR shall have ongoing access to the Contractor personnel and documentation during regular business hours as described in the contract. Upon completion of the audit/evaluation, all documentation determined to be relevant to the conclusions of the audit/evaluation shall become the property of the Commission and shall not be disclosed outside of the Commission unless directed by statutory or other regulatory requirements, to include the Contractor’s internal quality control/inspection process or peer review process. In such cases, only personnel who have a justified need shall be considered for the granting of access to the workpapers. Any disclosure shall be in accordance with Section 2.3.2.4 Confidentiality and Non-Disclosure Agreements (Appendix C), upon approval of the CO. The retention period for workpapers supporting the audit and evaluation reports shall be for a period no longer than eight years from the date of the audit and evaluation reports.

4. PERIOD OF PERFORMANCE AND PLACE OF PERFORMANCE

4.1 Period of Performance

The period of performance for this task shall be from the date of award through December 15, 2014, with two 30-day extensions, if needed and four option years.

4.2 Place of Performance

4.2.1 Location

The Contractor shall perform all work under this contract at the Commission’s headquarters in Washington, DC and other sites as required and approved by the Contracting Officer Representative– All tasks. No travel is authorized under this contract and no travel fees or charges will be paid or reimbursed to the contractor.

4.2.2 Government Furnished Property

The Commission will provide work areas, telephones, desks, chairs, copiers, fax machines and WIFI access. The Contractor must provide office supplies, personal computers, and calculators.

5. Deliverables The contractor shall provide the following deliverables:

For additional detail on deliverables, see Appendix A – Deliverable Descriptions.