CORHQ-24-R-0519 Updated 2.14.25.pdf

SOLICITATION/AWARD

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NO. 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. CONTACT INFORMATION 8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. N/A

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODE17a. CONTRACTOR/

OFFEROR

CODE

FACILITY

CODE

CODE

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

RFQ RFP

Price only

SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QTY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. N/A 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

29. AWARD OF CONTRACT: REF.

YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. FEDERAL DEPOSIT INSURANCE CORPORATION (SIGNATURE OF CO)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

FDIC 3700/55 (3-08)

10. SOCIO-ECONOMIC STATUS

NO

NAICS:

ETHNICITY:

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

OFFER

13a. SUB-CONTRACTING

PERMITTED/APPROVED

YES

SDB

MWOB

SERVICE-DISABLED VETERAN-

OWNED SMALL BUSINESS

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

YES NO

YES NO

27a. SOLICITATION INCLUDES ATTACHMENTS 27b. AWARD INCLUDES ATTACHMENTS

RFI RFP

Best Value

CORHQ-24-R-0519

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QTY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

40. PAID BY

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELPHONE NUMBER OF AUTHORZED GOVERNMENT REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

PARTIAL FINAL

37. CHECK NUMBER

38. S/R ACCOUNT NO. 39. S/R VOUCHER NUMBER

36. PAYMENT

COMPLETE PARTIAL FINAL

FDIC 3700/55 (3-08)

Section B - Supplies or Services and Prices/Costs

Attachments for this section start after this page.

Section B - Supplies or Services and Prices/Costs PAGE 3 OF 100

NONPUBLIC//FDIC BUSINESS#

Item # Goods Year 1 Year 2 Year 3 Year 4 Year 5 Year 6 0001 Cloud Migration Planning &

Execution (IAW Section 2 of SOW)

0002 Cloud Service Subscription and /or Licensing (IAW Section 2 of SOW)

0003 Post Migration - Managed Cloud Services and Admin Support (IAW Section 2 of SOW)

0004 PIMS Operation and Maintenance (IAW Section 2.2 of SOW)

0005 Optional Labor-Hour Support for customization and enhancements (IAW Section 2.3 of SOW)

See Below See Below See Below See Below See Below See Below

00051 Program/Project Manager $ $ $ $ $ $ 00052 System Architect $ $ $ $ $ $ 00053 Security Engineer $ $ $ $ $ $ 00054 Business Analyst $ $ $ $ $ $ 00055 $ $ $ $ $ $ 00056 $ $ $ $ $ $ 00057 $ $ $ $ $ $ 00058 $ $ $ $ $ $

Technical Point of Contact:

Company:

Telephone#:

Email Address:

Fixed Hourly Rate - Year 1 Fixed Hourly Rate -

Year 2 Fixed Hourly Rate -

Year 3 Fixed Hourly Rate -

Year 4 Fixed Hourly Rate - Year

PIMS Basic Ordering Agreement (BOA) Price Schedule

Fixed Hourly Rate - Year

Item # Labor Category

Section B - Supplies or Services and Prices/Costs PAGE 4 OF 100

Section C - Description/Specifications/Work Statement

Attachments for this section start after the clauses.

Clauses Incorporated By Reference

Clause # Title Date

No reference clauses were found for this section.

Full Text Clauses

7.3.2-21 - Description/Specifications/Work Statement - October 2008 The name/description of the goods or services being acquired is as follows:

Portfolio Investment Management System

The specifications for and the description of the work to be performed under this award are fully detailed in either a

Statement of Work (SOW) or a Statement of Objective coupled with a Performance Work Statement (PWS), which is included as an attachment in Section J of this award document.

7.3.2-34 - Duty to Deliver or Perform - July 2008 Contractor agrees to perform the services (the "Services") or provide the goods (the "Goods"), in accordance with the terms and conditions set forth herein and in any attachments to the contract.

Section C - Description/Specifications/Work Statement PAGE 5 OF 100

Statement of Work Portfolio Investment Management System (PIMS)

CONTROLLED//FDIC INTERNAL ONLY

Introduction

The FDIC is an independent agency created by the Congress to maintain stability and confidence in the nation’s financial system by insuring deposits, examining and supervising financial institutions, and managing receiverships. Within the FDIC, the mission of the Division of Finance (DOF) is to provide the FDIC with timely, accurate, and insightful accounting, budget, financial, risk management, travel, and relocation services that facilitate the accomplishment of FDIC’s mission essential functions:

a. Oversight of the corporation's safe and sound operation of insured depository institutions

b. Resolution of financially troubled and insolvent institutions

c. Honoring of the corporation's insurance obligation

d. Make large and complex financial institutions resolvable

e. Manage receiverships.

The FDIC requires a comprehensive cloud-based system as a replacement solution for its Portfolio Investment Management System (PIMS) (the “Solution”). PIMS is a key application designed to assist the DOF Treasury Operations Unit staff in managing cash and investments business processes, which includes tracking corporate and National Liquidation Fund (NLF) investment transactions, calculating earnings, generating cash receipts for interest and maturity payments, generating reports, and tracking and monitoring performance.

The PIMS application is accessed from users’ authorized vDesks. The PIMS thick client connects to a web application server running Windows Server 2019 R2 and IIS 8.5. The web application server then connects directly to a Microsoft SQL Server 2019 R2 database. All actions made via the PIMS application correspond to SQL statements that are sent to the SQL server, which also enforces access control. PIMS connects to this back-end database server by using a Microsoft ODBC connection, which performs authentication based on the credentials provided by the user. Access to PIMS requires network authentication to users’ vDesks and role-based authorization through Active Directory (AD) group membership. All PIMS users must be members of a specific user group, and a PIMS Security Administrator must add each user’s network ID to PIMS. Since the PIMS client is launched within the users’ vDesk environment, the client-server communication originates from the vDesk to the web application and then to the SQL server database.

The Solution shall provide the following high-level capabilities:

• Analytics

• Cash Management

• Dashboard

• Investment Transaction Management

• Pricing

• Reports

• System Integration

• System-Wide Functionality

• User Experience

• Utility

Section C - Description/Specifications/Work Statement PAGE 6 OF 100

CONTROLLED//FDIC INTERNAL ONLY

• Technical

Scope of Work

The Contractor shall provide a cloud-based, Commercial off the Shelf solution and professional services for system implementation, including application stand-up, configurations, data migration from legacy systems, application testing, user documentation, e.g., manuals, tip sheets, reporting, and systems integration with existing internal FDIC systems and external systems in accordance with FDIC policies and procedures, and training. The Contractor shall use FDIC’s agile methodology for systems implementation. The Contractor shall ensure the Solution is scalable and flexible enough to accommodate future user requirements, (e.g., new workflows, reports). The Contractor shall also provide hosting and operations, maintenance, and enhancements for the Solution.

2.1 Security Objectives

The SaaS (cloud-based) solution must meet the requisite security and privacy controls that are compliant with security requirements defined by applicable federal laws, regulations, policies, and standards (e.g., the Federal Information Security Management Act (FISMA), OMB Circular A-130, and FIPS Publication 200).

2.2 Hosting and Operations

System Security Assessment and Authorization Requirements

2.1.1 Authority to Operate

2.1.1.1 The Contractor shall not input, store, process, output, and/or transmit FDIC data within a Contractor IT system without an Authority to Operate (ATO) signed by the FDIC Authorizing Official (AO) granted via the System Security Authorization (SSA) process. The FDIC process for obtaining and maintaining an ATO is in accordance with NIST SP 800-37, Risk Management Framework for Information Systems and Organizations.

2.1.1.2 Contractor shall adhere to current FDIC policies, procedures, and guidance for the SSA process.

2.1.2 SSA Process

2.1.2.1 The Contractor shall complete the SSA Process. The SSA process shall proceed according to the NIST SP 800-37, Risk Management Framework for Information Systems and Organizations or any successor publication, including templates.

2.1.2.2 SSA and Authorization Process Documentation: SSA documentation shall be developed by the Contractor using the FDIC-provided security documentation templates. SSA documentation consists of the following: Security Categorization Worksheet, System Security Plan, Contingency Plan, Contingency Plan Test Results, Configuration Management Plan, Security Assessment Plan, Security Assessment Report, and Authorization to Operate Letter. Additional documents that may be required include a Plan(s) of Action and Milestones and Interconnection Security Agreement(s).

2.1.2.3 Independent Assessment: The Contractor shall have an independent third party perform an assessment of the FDIC-prescribed security and privacy controls as

Section C - Description/Specifications/Work Statement PAGE 7 OF 100 outlined in NIST SP 800-53 to determine the extent to which the selected controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting security and privacy requirements for the system and the FDIC. Should the independent assessment find deficiencies, the Contractor must follow the direction of the FDIC to create and track POA&Ms to be included in the final authorization package. FDIC has the unilateral right to determine if the results and mitigation strategy are acceptable. In the case of unacceptable results or mitigation strategy, or if the Contractor does not remediate control weaknesses in a timely manner as established in POA&Ms, FDIC may treat the failure as an event of default.

2.1.2.4 Support the Completion of the Privacy Compliance Documentation: As part of the SSA process, the Contractor may be required to support the FDIC in the completion of a Privacy Threshold Analysis (PTA). The requirement to complete a PTA is triggered by the creation, use, modification, upgrade, or disposition of a contractor IT system that will store, maintain and use PII. Upon review of the PTA, the OCISO Privacy Section determines whether a Privacy Impact Assessment (PIA) and/or Privacy Act System of Records Notice (SORN), or modifications thereto, are required. The Contractor shall provide all support necessary to assist the FDIC in completing the PIA in a timely manner and shall ensure that project management plans and schedules include time for the completion of the PTA, PIA, and SORN (to the extent required) as milestones.

Support in this context includes responding timely to requests for information from the FDIC about the use, access, storage, and maintenance of PII on the Contractor’s system, and providing timely review of relevant compliance documents for factual accuracy. Information on the FDIC’s privacy compliance process, including PTAs, PIAs, and SORNs, is accessible at www.fdic.gov/privacy.

2.1.2.5 Authorization to Operate: Upon completion of the SSA documentation and independent assessment, the Contractor shall submit a signed SSA package, validated by the independent third party, to the FDIC Oversight Manager (OM) for acceptance by the AO, or designee, at least thirty (30) days prior to the use of the system. The FDIC is the final authority on the compliance of the SSA package and may limit the number of resubmissions of a modified SSA package. Once the ATO has been granted by the FDIC AO, the Contracting Officer shall incorporate the ATO letter into the contract as a compliance document. The FDIC’s issuance of the ATO does not alleviate the Contractor’s responsibility to ensure the controls are implemented and operating effectively. The SSA package must include the following:

Deliverables (30 Days Prior to System Use)

Security and privacy plans

Security and privacy assessment reports

Plan of action and milestones

Supporting assessment evidence or other documentation, as required.

2.1.2.6 Continuous Monitoring/Ongoing Assessment: After an initial authorization, the Contractor shall have the security and privacy controls assessed on an ongoing basis in

Section C - Description/Specifications/Work Statement PAGE 8 OF 100 http://www.fdic.gov/privacy accordance with NIST SP 800-37 and based on the FDIC Control Assessment Frequency. Ongoing assessment of the control effectiveness is part of the continuous monitoring activities of the FDIC. Adherence to the terms and conditions specified by the AO as part of the authorization decision are also monitored. Ongoing control assessment continues as the information generated as part of continuous monitoring is correlated, analyzed, and reported to the OM for acceptance by the FDIC AO. The system needs to undergo a Security Impact Assessment whenever any changes/modifications are made to the system. Should the independent assessment find deficiencies, the Contractor must follow the direction of the FDIC to create and track POA&Ms to be included in the final authorization package. FDIC has the unilateral right to determine if the results and mitigation strategy are acceptable. In the case of unacceptable results or mitigation strategy, or if the Contractor does not remediate control weaknesses in a timely manner as established in POA&Ms, FDIC may treat the failure as an event of default.

2.2 Maintenance

The Contractor shall provide maintenance support services for the latest generally available version of Solution software and the two immediately preceding versions, as indicated by a difference in the numbering sequence in the software’s title. This maintenance support shall include routine, repetitive or otherwise necessary tasks and activities required to ensure the Solution runs in FDIC’s Production environment as described and intended in accordance with the applicable system documentation and FDIC business requirements. The maintenance and support shall meet or exceed all applicable Service Level Agreements and performance standards. All maintenance support shall be included in the Contractor’s firm-fixed price contract.

The Contractor shall provide the following services:

2.2.1 Maintain release concurrency (or as directed by FDIC).

2.2.2 Install approved system level (operating system, Database Management System) and application-level patches and fixes.

2.2.3 Conduct proactive performance tuning and archiving.

2.2.4 Conduct pre-production execution simulation.

2.2.5 Perform appropriate types of testing when resolving application defects.

2.2.6 Maintain in-scope existing interfaces and integration points to the Solution, including third-party software packages, distributed systems, and data conversions.

2.2.7 Adhere to Service Level Agreement (SLA) (see Appendix A).

2.2.8 Diagnose and resolve all Incidents and Defects, as defined in the SLA.

2.2.9 Manage all reported issues and accept issues reported by phone, internet, or via an Internet portal. Case numbers must be provided to every incident/defect reported by FDIC. Maintain and operate integration of FDIC systems interfaces.

2.2.10 Provide robust reporting with an integrated, ad hoc reporting capability for reporting to FDIC management.

Section C - Description/Specifications/Work Statement PAGE 9 OF 100

2.2.11 The contractor shall notify FDIC of any planned maintenance release that will include implementation of the prioritized list of defects.

2.2.12 Section 508 and security defects that are currently known or any new discovered defects must be addressed as firm-fixed maintenance items.

2.3 Enhancements

The Contractor shall provide enhancement services as identified by FDIC. The Contractor shall use FDIC’s agile methodology to implement enhancement releases. FDIC will utilize a configuration management tool, e.g., GitHub to maintain a product backlog which contains enhancement items that will be prioritized for the Contractor to implement.

2.3.1 The FDIC Oversight Manager (OM) will work with the designated FDIC TM to identify the release scope, funding and specific project deliverables in order to issue a release enhancement modification to the Contractor.

2.3.2 Enhancement items must adhere to the requirements in Section 3 below.

Requirements

Contractor shall provide all the resources with the necessary skills required to implement the following core Solution requirements, and support any new application enhancements items that FDIC determines are necessary during the contract period:

3.1 Business and Functional Requirements

The system business and functional requirements are organized into eleven categories:

Category Name Category Description

Analytics Capabilities within this category shall ensure the solution supports analyzing data to perform trend analysis, predictions, and projections; and other systematic data analysis for interpretation and discovery purposes.

Cash Management Capabilities within this category support activities such as reconciling the cash balances of the funds between the corporate accounting system and the investment system and purchasing overnight securities.

Dashboard Capabilities within this category shall ensure the solution provides information based on a user's role; allows data visualization with charts and graphs; allows key metrics to be monitored; and assists users in making informed decisions and performing daily tasks efficiently.

Investment Transaction Management

Capabilities within this category shall ensure the solution supports producing payment vouchers; buying, selling, and maturing securities; and viewing/editing transactions and securities held.

Pricing Capabilities within this category shall support the ability to obtain and review the price information for securities.

Section C - Description/Specifications/Work Statement PAGE 10 OF 100

Reports Capabilities within this category shall ensure the solution supports creating, customizing, running, scheduling, and delivering flexible canned and ad hoc reports.

System Integration Capabilities within this category shall support the data exchange between the solution and other internal systems and the external systems that provide necessary services.

System-Wide Functionality

Capabilities within this category shall support requirements that apply to the entire solution.

User Experience (UX) Capabilities within this category shall ensure the solution is intuitive and user friendly which includes logical navigation and convenient/comprehensive screens to complete activities.

Utility Capabilities within this category shall ensure the solution provides necessary tools for users to perform key tasks in an efficient manner.

Technical Requirements within this category shall ensure the solution supports technical requirements such as security, access control, availability, reliability, recoverability, etc. Note: These technical requirements are a subset of the Enterprise Non-Functional Requirements (NFRs).

Analytics

The system shall, but not limited to:

3.1.1 Provide users the ability to calculate and review projected (to be collected) coupons on the securities held over a selected period of time (e.g., daily, weekly, monthly, annual).

3.1.2 Provide users the ability to have pre-defined analytical reports. A report should show projected coupons over a selected time period.

3.1.3 Provide users the ability to perform historical data reporting, projection activities, and trend analysis.

3.1.4 Provide users the ability to calculate and review the rate of return on all securities held.

Cash Management

3.1.5 Provide users the ability to auto populate remaining cash from the FDIC's financial system. FDIC invests all the leftover cash at the end of the day. The system shall auto populate the details to buy securities without having to manually enter the information.

3.1.6 Provide users the ability to ability to review pre-populated remaining cash balances and buy overnight securities.

3.1.7 The following day the overnight investment transactions mature with interest before the data is sent to the FDIC’s financial system. Provide the ability to review, approve, and send maturities and interest directly to the financial system.

3.1.8 Provide users the ability to add and remove cash from all the portfolios. Adding is receiving funds and removing is withdrawing funds.

Section C - Description/Specifications/Work Statement PAGE 11 OF 100

Dashboard

3.1.9 Provide users the ability to review cash and investment balances from the dashboard.

3.1.10 Provide users the ability to run and review daily transactions through a dashboard based on user roles. The dashboard shall be tailored to provide information based on a user's role to assist in making informed decisions and performing daily tasks efficiently.

3.1.11 Provide users the capability with one-click-button from the dashboard to upload and review pricing data as needed (pending implementation of automated data exchange). Also, see System Integration for data import.

3.1.12 Provide users the ability to call out key details/metrics through a dashboard. The system shall:

3.1.12.1 Show maturities and coupons for the day.

3.1.12.2 Show current holdings.

3.1.12.3 Show cash balances.

3.1.12.4 Show recent transactions.

3.1.12.5 Show DIF Investments Status with the following details: DIF Total, Years to Maturity, Purchases YTD, Purchases in Last 30 Days, Maturities in Next 30 Days, Maturities Remaining This Year, Par Sold YTD, and Par Value Purchases Timeline.

3.1.12.6 Show Par Value of Maturities by Month, Par Value of Maturities by Year, and Maturities in Next 30 days with the following details: Maturity Date, Purchase Date, Type, Total Outflow, Real Yield at Cost, Years to Maturity at Purchase Date, Modified Duration at Purchase Date, and Par Remaining.

3.1.13 Provide users the ability to display messages/alerts of potential anomalies through a dashboard.

An example being if a security is not priced on a day - we currently only get a notice if a security has already matured on the pricing file but have to review the pricing report for unpriced securities.

3.1.14 Provide users the ability to access the most used functions through a dashboard.

Investment Transaction Management

3.1.15 Provide users the ability to calculate and review coupons collected (received) and post them to

NFE.

3.1.16 Provide users the ability to calculate gains and losses on securities held and post them to NFE.

3.1.17 Provide users the ability to buy multiple securities (e.g., overnight treasuries, treasury notes and bonds, discount notes, etc.) with fixed income for multiple portfolios (DIF, FRF, and NLF).

Currently, users are purchasing various securities via Fed Invest except TIPS, discount notes, and floating rate notes. Discount notes are purchased from a broker dealer.

3.1.18 Provide users the ability to create portfolio(s).

Section C - Description/Specifications/Work Statement PAGE 12 OF 100

3.1.19 Provide users the ability to ability to manually enter transactions if automation is not available.

If automation or integration is not available for a certain system, ability to manually enter the transactions will be crucial.

3.1.20 Provide users the ability to do block buys where we purchase the same security (e.g., overnight treasuries) for multiple portfolios (DIF and FRF) at the same time. Block buys are portfolio driven and purchased for multiple portfolios.

3.1.21 Provide users the ability to sell multiple securities (e.g., treasury notes and bonds, discount notes, etc.) with fixed income for multiple portfolios (DIF, FRF, and NLF). The ability to sell multiple securities (e.g., treasury notes and bonds, discount notes, etc.) with fixed income for multiple portfolios (DIF, FRF, and NLF).

3.1.22 Provide users the ability to edit securities held before sending the data to FDIC's financial system.

3.1.23 Provide users the ability to edit transactions (like buy transactions) before sending the data to FDIC's financial system.

3.1.24 Provide users the ability to view and edit security prices before sending the data to FDIC's financial system.

3.1.25 Provide users the ability to produce, review, approve, sign, email, and store Payment Vouchers (PV) for funding and investment related activities. PV feature should be able to: Create PV, Send PV for e-signature, and E-mail approved PV to related teams (this is only for internal use. It may go to different teams within the FDIC but not to anyone outside of FDIC).

3.1.26 Provide users the ability to search prior PVs.

3.1.27 Provide users the ability to flag the securities as called if the sale of the security is initiated by a third party through a call.

3.1.28 Provide users the ability to buy variable income treasury bonds. Variable income treasury bonds including TIPS require the system to be constantly updated as the changes occur in real-time.

Also, see System Integration for automatic data update.

3.1.29 Provide users the ability to buy securities that are not treasury notes/bonds or discount notes.

Flexibility to buy any type of bond without systems limitations to update changes in real time.

3.1.30 Provide users the ability to mature securities and determine coupon payments on the maturity date. Streamline (automate) process to mature securities and coupon payments. Also, see System Integration for posting data to financial system.

Pricing

3.1.31 Provide users the ability to review daily and historical pricing data of all securities held.

Reports

3.1.32 Provide users the ability to have pre-defined reports.

3.1.32.1 Reports such as Coupons received, Purchases made, Prices of all securities, Maturities, Calls, and Sales over a selected period of time.

Section C - Description/Specifications/Work Statement PAGE 13 OF 100

3.1.32.2 Accounting and inventory reports that shows the information for reconciling against the Bureau of Fiscal Service data

3.1.33 Provide users the ability to create ad hoc reports.

3.1.34 Provide users the ability to customize reports. A flexible reporting environment; selecting different data elements and criteria; drag-and-drop capabilities; save report criteria and run at a later date; ability to sort; and shall include a summary line, weighted averages, and totals.

3.1.35 Provide users the ability to export reports in formats such as XLS, PDF, CSV, DOC, and XML.

3.1.36 Provide users the ability to run/schedule multiple reports at once for export or email to one or more recipients.

3.1.37 Provide users the ability to email reports.

3.1.38 Provide users the ability to visualize key data points through charts and graphs in the solution.

3.1.39 Provide users the ability to drill down into the details of a report. View the details at a daily level to quickly identify any issues.

System Integration

3.1.40 Provide users the ability to integrate with Bloomberg to obtain financial information (e.g., real-time and historical price, trading news, etc.). FDIC is using Bloomberg to perform analysis on securities. It helps to review the data efficiently.

3.1.41 Provide users the ability to integrate with Hub Data to import updated pricing of securities at scheduled time or on ad hoc basis. Automate or run a module to import daily pricing data of all securities held from HubData. Ideally system should be able to automatically update pricing at scheduled time (preferably in the morning) or ability for users to update on ad-hoc basis.

3.1.42 Provide users the ability to integrate with FedInvest to obtain transaction details (buy or sell).

This integration will automatically update new system once transactions (purchasing or selling of securities) are complete.

3.1.43 Provide users the ability to integrate with enterprise data warehouse to exchange data. Make data available in an enterprise data warehouse for the business unit to be able to run different reports on an ad hoc basis.

3.1.44 Provide users the ability to integrate with systems/tools to import prices for securities provided by the broker dealers. Discount notes pricing comes from the trades through a broker at a discounted rate. FDIC team has to go to a different system to review prices NLF securities also have discount notes that are purchased at a discounted price from a broker e.g. $100 face value discount notes can be purchased at $90 or agreed price.

3.1.45 Provide users the ability to integrate with FDIC's financial system to exchange data such as the GL entries/transactions (e.g., maturities, collected coupons, gains& loses, etc.). Streamline (automate) the process to exchange data with FDIC's financial system.

3.1.46 Provide users the ability to integrate with external reporting/analytical tools such as Power Bl, Tableau, etc. and visualize the data, i.e. charts and graphs by integrating with a 3rd party solution such as Power Bl or Tableau.

Section C - Description/Specifications/Work Statement PAGE 14 OF 100

3.1.47 Provide uses the ability to integrate with service providers to update variable income securities as the changes occur in real-time.

System-Wide Functionality

3.1.48 Provide users the ability to perform data validation and display warning messages, e.g.

overnight securities can't be matured on a weekend, system should pick the next business day.

3.1.49 Provide users the ability to perform a search based on user entered/selected criteria. Team would like to have search feature with option to choose search criteria, e.g. user should be able to enter a date to see all the transactions for that date.

3.1.50 Provide users the ability to share data among treasury functions.

3.1.51 Provide users the ability to use FDIC specific corporate accounting GL codes for accounting transactions to generate GL entries. This requirement shall eliminate the need for PIMS GL as a separate module. Also, see System Integration for sending GL entries.

3.1.52 Provide users the ability for each record/transaction to have a unique identifier which is a combination of a transaction type (sales, purchases, call sales, etc.) and a distinctive number.

For example, purchases starts with 1, sales with 2, etc. The unique identifier should track each record throughout the life cycle of a transaction.

3.1.53 Provide users the ability to add unique description of each transaction. Customize the GL interface transaction descriptions to identify the securities relevant to each transaction (e.g., purchases, market adjustments, interest accruals) instead of generic ID numbers for each transaction.

3.1.54 Provide users the ability to display ad hoc messages at logon (FDIC system use banner).

3.1.55 Provide users the ability to determine and notify users of any potential anomalies. Example: If there is not a price for a security for a day- we currently only get a notice if there is a security that has already matured on the pricing file but would have to review the pricing report for unpriced securities.

User Experience

3.1.56 Provide users the ability to save work in progress and resume work/transactions at a later time.

If a user is in the middle of a transaction (like creating a security or doing a buy), the users should be able to save progress and resume at a later time by exiting the screen and continuing it later.

3.1.57 Provide users the ability to search and drill down on a transaction from a dashboard to view or edit its details. For example, a user should see a list of recent transactions and be able to view or edit any of them without having to go through the current search function.

3.1.58 Provide users the ability for users to configure their own dashboards based on their roles and needs. Functionality to copy and paste data within the system or from external platforms such as MS Word, MS Excel, etc.

3.1.59 Provide users the ability to copy and paste data.

Section C - Description/Specifications/Work Statement PAGE 15 OF 100

Utility

3.1.60 Provide users the ability to perform funding/investment related calculations and projections based on flexible user input. A calculator where users can input data in a desired field (e.g., interest rate, security cost, and/or maturity date) to calculate income. This request is just for a calculation and this would not impact real data/securities in the system.

3.1.61 Provide users the ability to compare daily maturities and coupons to Fed Invest through a dashboard. A button to compare Fed Invest maturities and coupons and then generate a receipt report.

3.1.62 Provide users the ability to see daily transactions and interest rates in a calendar view. Showing some transactions in a calendar view - for instance, being able to see the FRF overnight rates in a calendar view would be useful for running reports and reviewing data. A calendar view of the daily interest vs. having to go into each day to view.

3.2 General Requirements

Contractor shall, but not limited to:

3.2.1 Make latest commercially available version of the underlying COTS product under the FFP contract.

3.2.2 FDIC shall reserve the right to consume this latest version.

3.2.3 Provide robust reporting with an integrated, ad hoc reporting capability for reporting to FDIC management.

3.2.4 Maintain appropriate controls with respect to Legal Service Agreements (LSA) expenditure ceilings, budgets, invoicing and payments to outside counsel and other vendors processed through the system.

3.3 Technical Requirements

3.3.1 The Contractor must indicate the deployment models (Private, Community, Public or Hybrid cloud) the Solution supports. Solution must be FedRAMP-moderate Authorized or meet the requirements of NIST 800-53 approved revision.

3.3.2 The system shall meet FDIC's Access Control Policies, Procedures, and Standards and support reviewing all accounts on a periodic basis.

3.3.3 The system shall meet FDIC's Security Control Policies, Procedures, and Standards and facilitate periodic reviews of security events.

3.3.4 The system shall support single-sign-on or an additional authentication feature.

3.3.5 The system shall support automated user account management such as provisioning, de-provisioning, or updates; disablement of unused or inactive accounts; password management;

and notifications of account adds, deletes and expirations.

3.3.6 The system shall support automatically signing out users or lock the account after a predefined time period.

Section C - Description/Specifications/Work Statement PAGE 16 OF 100

3.3.7 The system shall support role based access and separation of duties between roles.

3.3.8 The system shall support audit records and logs of valid and invalid logon attempts; account provisioning/de-provisioning and modifications; session timeouts; system security settings modifications; etc.

3.3.9 The system shall support the ability to view audit records/reports of all user performed activities.

3.3.10 The system shall support the ability to transmit and receive data using latest interface technology standards and security.

3.3.11 The system shall support the ability to run reports and have dashboards that can be accessed using mobile devices.

3.3.12 The system shall support data migration from legacy applications to make current and historical data available.

3.3.13 The system shall allow provisioning, decommissioning, and configuration of the system's resources.

3.4 Data Migration Requirements

3.4.1 The vendor shall provide a simple, fast, secure and cost effective way to migrate largescale data transfers.

3.4.2 The vendor shall migrate all data from the PIMS system to the new System prior to system go-live.

3.5 Record Retention Requirements

3.5.1 The vendor shall comply with all applicable records management laws, regulations, as well as all FDIC records retention policies, including policies associated with the safeguarding of information covered by the Privacy Act of 1974 (5 U.S.C. 552a).

3.5.2 FDIC Information is subject to FDIC policies, Federal laws, including, but not exclusively, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended and the Privacy Act of 1974 (5 U.S.C. 552a), as amended, and must be managed and scheduled for disposition only as permitted by statute or FDIC policy.

3.5.3 The vendor shall maintain and manage all FDIC Information in accordance with Federal laws and FDIC policies. Electronically stored information (ESI) and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the information.

3.5.4 The vendor is responsible for preventing the alienation or unauthorized destruction of FDIC Information, including all forms of mutilation. FDIC Information may not be destroyed except in accordance with the provisions of the FDIC records retention policies and with the written concurrence of the FDIC.

Section C - Description/Specifications/Work Statement PAGE 17 OF 100

3.6 Disaster Recovery Requirements

3.6.1 The vendor shall provide a disaster recovery plan to the FDIC for review. At a minimum, the disaster recovery plan shall include the procedures for testing the plan.

3.6.2 The vendor shall provide the results of most recent testing of their disaster recovery plan.

3.7 Training Requirements

3.7.1 The vendor shall provide required product training sessions prior to system go-live.

3.7.2 The vendor shall provide a training plan. The plan shall include types of training offered, types of attendees by role, number of attendees and frequency of trainings.

3.7.3 The training shall provide training materials as needed for the training sessions.

3.7.4 The vendor shall provide individual (self-paced) online training/content for end users, administrators, and instructional system designers.

3.8 Environment Requirements

3.8.1 The vendor shall propose the type and number of environments available under the respective implementation model. At minimum, the vendor should consider providing these environments:

3.8.1.1 Development

3.8.1.2 Quality Assurance (QA)/Training Environment

3.8.1.3 Production (PROD) Environment

3.8.2 If the vendor proposes a different mix of environments, the vendor shall be responsible for delivering those environments.

3.9 Browser Requirements

3.9.1 The solution shall be browser agnostic and shall work with a variety of browsers, including mobile browsers and mobile devices.

3.10 Support Transition and Exit Strategy

3.10.1 Upon termination/conclusion of this contract, the Contractor must use best efforts to support the transition of data, documentation, configurations, cloud environments, licenses (if any), source code repositories, DevOps processes, and services for a follow-on service provider or the FDIC to continue identical services.

3.10.2 The Contractor must provide the ability for FDIC to export the FDIC Data for future use in a FDIC-approved format as determined at the end of the contract period. The Contractor must provide a list of non-proprietary formats available to FDIC to export data.

Section C - Description/Specifications/Work Statement PAGE 18 OF 100

3.11 Key Personnel

Program/Project Manager

Directs, manage, plan and administer Project activities of a division/business area; leads contingency planning and risk mitigation; develops, plans and schedules the development, introduction, communication and maintenance of a project; monitors progress to ensure project objectives are delivered on time and within budget, and business results are realized; communicate program performance to program sponsors and executive team; determine the impact of program Changes on the business case, and re-forecast value creation; identify areas for internal improvement and develop plans for implementation; comply with and enforce standard company policies and procedures.

BS/BA degree preferably in a technical discipline, or equivalent education.

• PMP (Project Management Professional) certification or equivalent preferred.

• 7+ years of project management, program management or IT management, including financial and schedule performance reporting.

• Minimum 5 years of experience managing cross-functional and end-to-end IT business processes.

• Experience in all phases of systems development from concept through installation and maintenance, a minimum of 5 years of experience in required technology.

• Master level proficiency in automated project management tools such as Microsoft Project.

• Advanced proficiency in analytical, organizational, project management, interpersonal and communication skills (verbal and written).

System Architect Translates complex business processes and strategy into technical solutions through requirements definition and design; responsible for end-to-end architectural integrity and the relationship with other projects within the context of a broader program; consults with business and technical leaders to identify and scope the business opportunities, outline potential value and ROI, and identify risks and constraints; documents overall strategic vision and creates architecture proposals based on identified solution gaps.

• Provide architectural advice, planning guidance, quality assurance, and guidance to the project team on project approach

BS/BA in Computer Science, Engineering, or an equivalent combination of education and/or experience.

• > 5 years of experience as a Solution Architect.

• Strong consultative skills at a cross functional level.

• Analysis level UML, activity diagrams, business use cases, business rules, and system level features.

• Broad based platform and technical exposure and complete software development lifecycle perspective.

• Good presentation & communication skills: ability to translate and clearly formulate technical issues.

• Strong project and team management skills.

Section C - Description/Specifications/Work Statement PAGE 19 OF 100 and solution; responsible for the overall solution architecture and design.

Security Engineer Defines system security requirements, documents security assessment and authorization and certification; understands the business priorities and corresponding assurance level is critical; leads highly complex IT security projects and initiatives;

completes a thorough risk assessment; identifies vulnerabilities within a network and system; configures systems to enhance existing security features.

BS/BA degree in Computer Science, Engineering, Technical Diploma or equivalent combination of education and/or experience.

• > 7 years of in information security, including experience with Internet technology and security issues.

• Security areas of knowledge include information security, desktop security, internet security, server systems security, database security, and platform-specific training in security setup, design and administration.

• Knowledge of information security standards, rules and regulations related to information security and data confidentiality and desktop, server, application, database, network security principles for risk identification and analysis.

• Strong analytical and problem-solving skills.

• Excellent communication (oral, written, presentation), interpersonal and consultative skills.

Business Analyst Provides group facilitation, interviewing, training, and provides additional forms of knowledge transfer; has thorough knowledge of the business analysis principles; investigate complex strategic business issues, researching and identifying inventive solutions; collaborates with executive stakeholders to elicit their business concerns and develop workable solutions;

completes all appropriate documentation required by developers, QA analysts, BS/BA in Accounting, Finance, Business Administration, Marketing, Information Systems Management, Computer Science or related field, or an equivalent combination of education and/or experience.

• > 5 years of work experience with progressively increasing responsibility.

• Advanced knowledge of technologies relevant to the engagement.

• Advanced knowledge of SDLC methodology and UML.

• Advanced proficiency in analytical, Section C - Description/Specifications/Work Statement PAGE 20 OF 100 deployment team, and operation support team that will maintain the Application."

project planning, negotiating, interpersonal, and communication skills (written and oral).

• Ability to Perform cost-benefit analysis, trending, forecasting, and financial analysis.

• Advanced proficiency using various Microsoft Office desktop products.

Contract Type, Period of Performance, Options

4.1 The contract type is a Firm-Fixed Price contract. However, enhancements shall be Time & Materials.

Performance Management

5.1 See Appendix A – Service Level Agreement.

Place of Performance

6.1 All work must be performed in the U.S. and by U.S. citizens. All proposed staff must be accepted by FDIC and must be cleared by a successful background investigation.

DELIVERABLES

The Contractor must deliver the following deliverables to the FDIC Oversight Manager (OM) and Technical Monitor (TM).

Deliverables Required Due Date

Initial Project Work Plan or Release Plan: Work breakdown structure (WBS) and project plan outlining the development/implementation activities for the engagement as outlined during the oral presentation and directed by FDIC.

• 5 business days after the task order issuance.

Status Report in a format acceptable to the FDIC TM • Bi-weekly

Section C - Description/Specifications/Work Statement PAGE 21 OF 100

FDIC-Specific Solution User Guide • 2 months prior to solution go-live.

Solution Training Sessions for the following training types:

• Train the Trainer Training to include training on the reporting module

• System Admin Training

• 1 month prior to solution go-live.

POA&Ms Reports • Monthly

Local Admin User Group Report • Monthly, by the 15th of the month

Service Level Performance Report • Monthly, by the 15th calendar day.

Format of report must be approved by OM

Project Work Plan (PWP) • Within 10 calendar days after the award of a Work Order

Application Design Document (ADD) • Updated within 10 calendar days after a material change to ADD

Integration Technical Design Document (TDD) • Update existing TDD to include all material changes delivered to date within 30 calendar days after contract award

• Updated within 10 calendar days after a material change to TDD

Schema of the Data Warehouse (DWH) depicting the relationship between tables within the DWH

• Within 30 calendar days after contract award

Security Scans - Credentialed vulnerability and system configuration compliance scans of FDIC-assigned servers, services, hardware, and software to ensure the system has the most appropriate security patches and complies with security configurations recommended by the US National Checklist Program, defined by the NIST SP 800-70

• Monthly

Audit Logs - A report of the FDIC assigned system audit log that includes specific users’ activities and system changes, including the local administrators’.

• Monthly

POA&Ms - POA&Ms Status report • Monthly

Section C - Description/Specifications/Work Statement PAGE 22 OF 100

POA&Ms Closure - POA&Ms closure evidence (must be provided by independent security assessment validator or as determined by the

FDIC)

• For every POA&Ms closure request

Annual Assessment - Independent Third Party Assessment based on NIST 800-53 control implementation requirements report.

• At least once annually

SSP - System Security and Privacy Plan • At least once annually

CP - Contingency Plan and Contingency plan test, Disaster recovery plan, Disaster recovery plan test

• At least once annually

Interconnection Security Agreement (ISA) • Within 30 calendar days after contract award (as applicable)

System Security Penetration Tests • Prior to a major version upgrade of the software is implemented in the production environment including applications, software, underlying operating system or database management system

ATO • As per the schedule

Section C - Description/Specifications/Work Statement PAGE 23 OF 100

Section E - Inspection and Acceptance

No attachments were added for this section.

7.6.4-01 - Inspection and Acceptance - July 2008

(a) All goods and services shall be subject to inspection and test by the FDIC Oversight Manager, to the extent practicable, at all times and places during the term of the award. All inspections by the FDIC shall be made in such a manner as not to unduly delay the work.

(b) The FDIC shall have 15 business days from the date of Contractor''s delivery to determine if such goods and services are in compliance with the requirements of the contract. If any services performed or goods delivered hereunder are not in conformity with the requirements of this Award, the FDIC shall have the right to require

Contractor to reperform the services or redeliver the goods in conformity with the requirements of the Award, at no additional increase in total contract amount.