Credit eLearning _RFQ _08.02.21.pdf

2031JW21Q00114

Credit Curriculum online eLearning library RFQ

PART I - SUPPLIES OR SERVICES AND PRICES/COSTS

1.0 General

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in subpart 12.6, using Part 13.5 procedures, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotes are being requested and a written solicitation will not be issued.

(ii) The solicitation number is 2031JW21Q00114 and the solicitation is issued as an request for quotation (RFQ).

(iii) A statement that the solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2021-05/3-10-2021.

(iv) This procurement is not set aside. The associated NAICS code is 611430 and small business standard is $12M.

(v) A list of line item number(s) and items, quantities, and units of measure.

Contract Line Item Number (CLIN)

Base Year: September 13, 2021 through September 12, 2022

CLIN Description QTY 0001 Credit eLearning subscription license 800 1001 Credit eLearning subscription license 800 2001 Credit eLearning subscription license 800 3001 Credit eLearning subscription license 800 4001 Credit eLearning subscription license 800

(vi) See Statement of Work (SOW) for a description of requirements for the credit eLearning subscription to be acquired.

(vii) Period of performance is anticipated to be 9/13/2021 – 9/12/2022 with four twelve-month options.

(viii) See Part IV for Instructions to Quoters (replacement of 52.212-1 provision).

(ix) See Part V for evaluation instructions.

(x) Quoters must include a completed copy of the provision at 52.212-3, Offeror Representations and Certifications-Commercial Items, with its quote.

(xi) Clause 52.212-4, Contract Terms and Conditions-Commercial Items, applies to this acquisition.

https://www.acquisition.gov/far/part-12#FAR_Subpart_12_6 https://www.acquisition.gov/far/part-52#FAR_52_212_3 https://www.acquisition.gov/far/part-52#FAR_52_212_4

(xii) Clause 52.212-5, Contract Terms and Conditions Required To Implement Statutes or Executive Orders-Commercial Items, applies to this acquisition. See Clause in attached document.

(xiii) See SOW for additional contract requirements or terms and conditions determined by the contracting officer to be necessary for this acquisition and consistent with customary commercial practices.

(xiv) Quotes are due via email to Marlon.Holland@occ.treas.gov and Karen.Oettinger@occ.treas.gov not later than August 13, 2021 at 3:00 pm eastern time. Late quotes will not be considered by the Government.

(xv) Questions are due via email to Marlon.Holland@occ.treas.gov and Karen.Oettinger@occ.treas.gov not later than August 06, 2021 at 3:00 pm eastern time.

(xvi) The name and email address of the individual to contact for information regarding the solicitation: Marlon Holland (Marlon.Holland@occ.treas.gov) https://www.acquisition.gov/far/part-52#FAR_52_212_5 mailto:Marlon.Holland@occ.treas.gov mailto:Karen.Oettinger@occ.treas.gov mailto:Marlon.Holland@occ.treas.gov mailto:Karen.Oettinger@occ.treas.gov

PART I - SUPPLIES OR SERVICES AND PRICES/COSTS

1.0 GENERAL

The Contractor shall furnish all technical, management, supervision, labor, materials, licensing, and any other support necessary to provide the services as described in the Statement of Work (SOW). The NAICS Code is 611430.

2.0 PRICING

This Purchase Order is Firm Fixed Price (FFP). Option periods will be exercised at the sole discretion of the Government consistent with FAR 52.217-9.

Contract Line Item Numbers (CLINs)

Base Year: September 13, 2021 through September 12, 2022

CLIN Description QTY Unit Price Extended Price 0001 Credit eLearning subscription license

Option Year 1: September 13, 2022 through September 12, 2023 CLIN Description QTY Unit Price Extended Price 1001 Credit eLearning subscription

Option Year 2: September 13, 2023 through September 12, 2024 CLIN Description QTY Unit Price Extended Price 2001 Credit eLearning subscription

Option 3: September 13, 2024 through September 12, 2025 CLIN Description QTY Unit Price Price 3001 Credit eLearning subscription

Option 4: September 13, 2025 through September 12, 2026 CLIN Description QTY Unit Price Price 4001 Credit eLearning subscription

TOTAL (to include option year periods): $________________

PART II – STATEMENT OF WORK

1.0 PURPOSE

The OCC requires access to an online training library consisting of eLearning courses to ensure agency examiners have access to up-to-date bank supervision-related training.

Required training must support competencies associated with commercial and consumer credit-related risks. An enterprise licensing structure of the online training tool should support up to 800 bank examiners annually, which range from entry level through commissioned examiners, as well as experienced hires. Training programs must be available on-demand, developed and updated to stay abreast with advances in technology, and available both in micro-learning (small, content-specific modules/lessons) and full competency/skill-set learning development. It is critical that the trainings’ focus is from the audit/examiner regulatory perspective.

2.0 BACKGROUND

The Office of the Comptroller of the Currency’s (OCC) mission is to ensure that the institutions that compose the federal banking system operate in a safe and sound manner, provide fair access to financial services, treat customers fairly, and comply with applicable laws and regulations.

The OCC charters, regulates, and supervises national banks and federal savings associations and licenses, regulates, and supervises federal branches and agencies of foreign banking organizations. The OCC oversees the organization and structure of the federal banking system and maintains a supervisory framework that encourages banks to responsibly innovate and adapt to meet the evolving financial needs of consumers, businesses, and communities nationwide. The agency issues regulations to implement federal banking laws.

It also uses a risk-based supervision process focused on evaluating banks’ risks, identifying material and emerging concerns, and requiring banks to take corrective action when warranted.

Continuing Education (CE) supports the OCC mission ensuring that appropriate training is provided for examiners to develop the necessary skills and knowledge to effectively supervise assigned financial institutions. CE designs and develops the majority of our courses internally leveraging multiple delivery modalities such as instructor-led, in-person, virtual (using tools such Adobe Connect), and on-demand eLearning and ensures alignment with the Competency Models as outlined in Attachment 1. When internal expertise or resources are not available, or requirement complexity warrants, CE contracts with industry experts to develop and deliver training to examiners. This is the case with the requirements outlined within for online eLearning support.

3.0 REQUIREMENTS

This section defines the OCC’s requirements for the online training tool and its suite of eLearning courses. The Contractor shall:

1. Provide unlimited access to the eLearning course library for up to 800 OCC licenses and 5

OCC administrators for each year the contract is in effect. At the discretion of OCC administrators, user licenses may be deactivated and reassigned to other users to meet specific OCC training needs, and users may be given access to any of the course titles and resources listed below. Additionally, the OCC will review the number of annual users prior to the start of each option year and may adjust the number for the upcoming option year to meet any emerging training requirements and ensure its examination workforce is equipped with the knowledge and analytical skills to do its job effectively.

a. eLearning Library resources:

i. Credit Coaching and Mentoring Guides for Each Course

ii. Job Aids & Reference Guides

iii. Collateral Evaluation

iv. Virtual labs

b. Critical subject areas:

i. Commercial Loans to Small Busines – Training should enable examiners to:

1. Identify and assess business, industry and management strengths and risk characteristics

2. Assess a business’s financial condition by identifying trends and evaluating the quality of historical cash flow

3. Identify the appropriate loan structure and support based on the true borrowing cause

ii. Commercial Real Estate Lending – Training should enable examiners to:

1. Evaluate commercial real estate lending, including project management, ownership, market, and property

2. Calculate and evaluate cash flow, existing and stabilized net operating income, debt service coverage, debt yield and maximum supportable loan amount

3. Determine the value of commercial real estate property as a secondary source of repayment

4. Identify the appropriate loan documentation needed for different types of real estate transactions

5. Recognize the steps necessary to properly monitor a construction loan

iii. Commercial Real Estate Loan Analysis – Training should enable examiners to:

1. Distinguish among different types of income-generating properties

2. Assess property-specific and external risks associated with lending against commercial properties

3. Evaluate the quality of the income a commercial property generates

4. Evaluate historical and projected property cash flow statements and assess a property’s ability to generate sufficient cash to repay debt as agreed

5. Understand sensitivity analyses to assess a property’s ability to continue to generate enough cash flow in less-than-ideal circumstances

6. Properly discuss the commercial real estate appraisals process

iv. Consumer Lending – Training should enable examiners to:

1. Identify the documentation needed to assess a consumer credit request

2. Evaluate a borrower’s credit history and repayment capacity

3. Understand how to verify a borrower’s income using tax returns and other sources of information

4. Select the best type of consumer credit for the request

5. Identify potential risks to repayment

6. Identify the appropriate collateral to secure the loan

7. Properly document various types of loans, including home equity, vehicle, boat, and savings-secured loans

v. Business Financial Statements Training should enable examiners to develop the core skills necessary to identify, assess and discuss a small business’s borrowing needs, and recommend appropriate credit solutions.

vi. Understanding Personal Cash Flow – Training should enable examiners to:

1. Assess personal financial statement components and identify assets that could serve as collateral

2. Understand how the balance sheet may be adjusted to portray the client’s liquidity, leverage, and net worth more accurately

3. Recognize cash, non-cash, and pass-through items on the personal tax return and K-1s

4. Improve credit quality and reduce risks in transactions with high-net-worth individuals and business owners

vii. Loan Documentation – Training should enable examiners to:

1. Understand what documents are required for various types of consumer, business and commercial real estate loans

2. Recognize the content, purpose, and effect of common loan documents, including promissory notes, borrowing resolutions, credit reports, proposal and commitment letters, and loan agreements

3. Recognize the concept of attaching and perfecting a security interest in collateral

4. Understand common defects in loan documentation

5. Evaluate the purpose and recognize the value of a lien search, title search and title insurance

viii. Minimizing & Managing Problem Loans – Training should enable examiners to:

1. Identify potential credit risks related to loan structuring, underwriting, and documentation

2. Understand what information is required to monitor borrower relationships for changes in risk

3. Evaluate changes in credit risk that require action and solve emerging credit problems

4. Recognize lending situations that entail legal risk or exposure to lender liability

ix. Red Flags and warning signs: Training should provide exercises and learning to build examiners confidence and accelerate speed to performance by applying newly acquired skills and knowledge.

x. Financial Accounting for Lenders

2. Add a set of users (batch import) for the OCC at the start of the base period of performance, add, and remove additional sets of users as needed for the life of the contract.

3. Provide on-demand user management mechanisms for OCC administrators to include:

a. Addition, modification, reassignment and deactivation of user licenses.

b. Spreadsheet template and import function to add a set of users.

c. Assignment of courses to users as required or optional.

d. Ability to determine permission based access to content (ability to hide courses from users).

e. Assignment of documents to users as needed, to include reference material for user access offline.

4. Provide course management mechanism to include the ability to:

a. Make a course available to a user without it being assigned.

i. Search for a course in a catalog.

ii. Select assessment pass score.

iii. Select assessment format, including a non-Flash format. (All assessments need to be provided in a text only, non-flash format to meet Section 508 compliance requirements.)

b. Request new content.

c. Make courses available via mobile training (preference)

5. Provide course assignment tracking and communication mechanism to include reminder and past due emails.

6. Provide monthly reporting (such as .csv file) due the first of each month that includes:

a. User email address

b. Course name

c. Completion date and time

d. Score (if applicable)

7. Provide on-demand reporting mechanism to include:

a. Course completions and incompletions by course name and by user.

b. Corresponding industry certifications and availability of Continuing Professional

Education (CPEs), where applicable

c. Course usage rates by course name and by user, including time spent in any given course.

d. Assessment reports, including item analysis reports by test question and by user.

e. Export or download function in multiple formats, including .csv.

f. Course content updates, including a detailed description of the updates that are made, for the life of the contract.

g. Notifications to the OCC of the deployment date and nature (regulatory or maintenance) of course updates, version number and modification date of course updates.

h. Transcripts, including answer keys for pre-assessments, knowledge checks, and post-assessments, for all course updates within five working days.

i. Map OCC competencies to courses/modules

8. At the start of the base period of performance and prior to deployment of any major upgrades to the contractor’s LMS, the contractor shall provide:

a. Administrator training and reference documentation on the LMS to OCC administrators.

b. Access instructions and quick reference documentation to support users.

9. Provide ongoing technical support and maintenance to OCC administrators and users, as well as a dedicated customer support team, including contact information, to OCC administrators for the life of the contract. Technical support shall be available during normal business hours (7:00am to 5:30pm Eastern Time), Monday through Friday.

10. The contractor shall work with the OCC to establish and maintain a data reporting bridge between the contractor’s LMS and OCC’s LMS. The contractor shall be responsible for coding the script for the data reporting bridge. The contractor shall work with the OCC to develop a mutually agreed upon timeline for the completion of the data reporting bridge.

4.0 HOURS OF AVAILABILITY

Users shall be able to access the contractor’s LMS 24 hours a day, 7 days a week with the exception of routine outages for scheduled maintenance. Advance notice of routine outages shall be provided the Contracting Officer’s Representative (COR). Notice of non-routine outages shall be provided to the COR within two (2) hours of an identified outage. Technical or system downtime issues shall be resolved within 12 hours of notification. Updates and revisions of content when Significant regulatory changes incorporated into content within the quarter identified.

5.0 PERIOD OF PERFORMANCE

The base period of performance shall be for a period of one-year and four 12-month option periods.

Base Period: September 13, 2021 through September 12, 2022 Option 1: September 13, 2022 through September 12, 2023 Option 2: September 13, 2023 through September 12, 2024

Option 3: September 13, 2024 through September 12, 2025 Option 4: September 13, 2025 through September 12, 2026

6.0 INFORMATION AND COMMUNICATION TECHNOLOGY ACCESIBILITY

REQUIREMENTS

6.1 Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) by the Workforce Investment Act of 1998 (P.L. requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities.

Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities. As such, the following requirements apply to this solicitation:

6.1.1 Products, platforms and services delivered as part of this work statement that are IT, or contain ICT, must conform to the Revised 508 Standards, which are located at 36 C.F.R. § 1194.1 & Apps. A, C & D, and available at https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines

6.1.2 E102 / 702.10 – Web Content Accessibility Guidelines (WCAG) success criteria level A & AA are incorporated as a requirement. The referenced WCAG criteria is available at http://www.w3.org/TR/WCAG20/

6.1.3 E202 – No General Exceptions Authorized by OCC

6.2 The following items are identified as containing ICT:

6.2.1 Web-based intranet and internet information and applications

6.2.2 Information, documentation, and support

6.3 Applicable Functional Performance Criteria: All functional performance criteria apply when using an alternative design or technology that achieves substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4- 6 of the Revised 508 Standards, or when Chapters 4-6 do not address one or more functions of ICT.

6.4 Applicable requirements for software and Web products:

6.4.1 E207 – WCAG Level A & AA Success Criteria

6.4.2 E302 – Functional Performance Criteria

6.4.3 E502 – Interoperability with Assistive Technology

6.4.4 E503 – Application

6.4.5 E501 – Web-based applications, independent of platform services

6.5 Applicable requirements for electronic documents and/or support services:

6.5.1 E205 – WCAG Level A & AA Success Criteria

6.5.2 E302 – Functional Performance Criteria

6.5.3 E602 – Support Documentation

6.5.4 E603 – Support Services

https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.access-board.gov%2Fguidelines-and-standards%2Fcommunications-and-it%2Fabout-the-ict-refresh%2Ffinal-rule%2Ftext-of-the-standards-and-guidelines&data=02%7C01%7CSusan.OBrien%40occ.treas.gov%7C57ec31d2d17c479fdbf808d76d258caa%7Cfd30c7091bb849f19c7edd8840c989d0%7C0%7C0%7C637097880354836254&sdata=7JnwLP%2B6fbjpueFFj8jBQftTv5w3dE9NXJ2AwTTNC8Q%3D&reserved=0 https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.access-board.gov%2Fguidelines-and-standards%2Fcommunications-and-it%2Fabout-the-ict-refresh%2Ffinal-rule%2Ftext-of-the-standards-and-guidelines&data=02%7C01%7CSusan.OBrien%40occ.treas.gov%7C57ec31d2d17c479fdbf808d76d258caa%7Cfd30c7091bb849f19c7edd8840c989d0%7C0%7C0%7C637097880354836254&sdata=7JnwLP%2B6fbjpueFFj8jBQftTv5w3dE9NXJ2AwTTNC8Q%3D&reserved=0 https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.access-board.gov%2Fguidelines-and-standards%2Fcommunications-and-it%2Fabout-the-ict-refresh%2Ffinal-rule%2Ftext-of-the-standards-and-guidelines&data=02%7C01%7CSusan.OBrien%40occ.treas.gov%7C57ec31d2d17c479fdbf808d76d258caa%7Cfd30c7091bb849f19c7edd8840c989d0%7C0%7C0%7C637097880354836254&sdata=7JnwLP%2B6fbjpueFFj8jBQftTv5w3dE9NXJ2AwTTNC8Q%3D&reserved=0 https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.w3.org%2FTR%2FWCAG20%2F&data=02%7C01%7CSusan.OBrien%40occ.treas.gov%7C57ec31d2d17c479fdbf808d76d258caa%7Cfd30c7091bb849f19c7edd8840c989d0%7C0%7C0%7C637097880354846251&sdata=F90EWonF%2FMda%2Bkzn8LLuXgoeQPPwO3o9D2lmn5ZNAmA%3D&reserved=0

7.0 INVOICING

The Contractor shall invoice in accordance with industry standards for the yearly license subscription. The Contractor shall submit payment requests electronically using the Invoice Processing Platform (IPP).

8.0 SECURITY AND PRIVACY REQUIREMENTS

A. Compliance with Applicable Laws, Regulations, and Standards

Secure User-to-Cloud Communications Standards. All user-to-cloud service communications (e.g., via internet) must be encrypted with the latest industry standard browser protocol.

B. General Requirements

Location. Information collected, used, stored, maintained, or otherwise processed by the contractor in the performance of this contract shall be accessed, transferred, stored or processed only within the United States. In addition, the maintenance and support operations of the contractor's technology and information must take place, and originate from, within the United States.

The contractor shall not host any portion of the information, information system, infrastructure, or environment in facilities outside the contiguous United States, Alaska, Hawaii, and other U.S. Territories.

Authorization to Use, Store, or Share Sensitive Information. The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all government data, equipment, etc. by treating the information as sensitive. All information gathered or created under this contract shall be considered as Controlled but Unclassified (CUI) information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets.

Confidentiality. The contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

Deliverables. The deliverables in this contract will be considered sensitive and shall not be shared with any other organization without prior approval from the OCC CO.

C. Security and Privacy Authorization

Authorization Boundary. The contractor shall provide a diagram specific for the OCC, that clearly demarcates the information system authorization boundary and depicts all of its connections and components, including the means for monitoring and controlling communications at the external boundary and at key internal boundaries within the system. The contractor shall address all components and managed interfaces of the information system authorized for operation (e.g., routers, firewalls). The diagram must include a predominant border drawn around all system components and services included in the authorization boundary.

If there are OCC-specific components (e.g., components developed or customized for the OCC, OCC-hosted components, etc.) and/or other components supporting this solution that are not in the scope of the contractor's existing security documentation, then identify those components in the diagram as well, as part of a separate OCC-specific boundary since those are unique to OCC and shall be part of the OCC-specific security authorization. The diagram must be easy to read and understand. Formal names of components as they are known at the service provider organization in functional specifications, configuration guides, other documents and live configurations shall be named on the diagram and described. The contractor shall provide a key for symbols used.

External Service Provider Compliance & Monitoring Background. The FISMA and OMB policies require that federal agencies using external service providers to process, store, or transmit federal information or operate information systems on behalf of the federal government, assure that such systems meet the information security protections commensurate with the information and system sensitivity. Federal agencies are responsible and accountable for the information security risk incurred by the use of information system services provided by external providers.

Such risk is addressed by incorporating the Risk Management Framework (RMF)1 and security requirements for external information systems and services as part of the terms and conditions of the contracts with external providers. Federal agencies can also require external providers to provide appropriate evidence to demonstrate that they have complied with protecting federal information. Prior to the implementation of the contractor's system or services, the OCC ensures compliance with the RMF by issuing an Authorization to Operate (ATO) or Authorization to Use (ATU), based on its review and analysis of the external provider's security documentation (described in detail in the next section) and assessment of customer (OCC's) security responsibilities.

NIST Special Publication 800-37, as amended, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy.

Non-Federal External Service Provider Security Documentation. Non-federal organizations with primarily non-federal customers have limitations with respect to complying with all federal requirements. As a result, the OCC obtains assurance through other industry standard security reviews, including Statement on Standards for Attestation Engagements (SSAE) No. 18.

a. Statement on Standards for Attestation Engagements (SSAE) No. 18 Requirements. The contractor shall provide the OCC with an SSAE 18 System and Organization Controls (SOC) 2 Type 2 Report on an annual basis for services provided.

b. The preferred coverage period for the report is July 1 through June 30 with a bridge letter covering the three months to September 30.

c. For any gaps in the fiscal year coverage period (October 1 - September 30), the OCC will work with the contractor to complete the internal controls assessment by relying on the work performed by the contractor's competent and objective internal audit function per Statement on Auditing Standards No. 128, Using the Work of Internal Auditors.

d. The submission of the results of the SSAE 18 SOC 2 Type 2 Report shall be as instructed per the "Security and Privacy Vendor Deliverables" section.

e. If SOC 2 Type 2 reports are not available within the last three years, the contractor shall inform the OCC to determine if there is a suitable alternative with similar level of information and detail.

f. If any portion of standard security objectives (e.g., contingency planning controls, etc.) were not in the scope of the independent auditors testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2 report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

OCC Security Authorization to Use. The determination of whether to issue an OCC security authorization will be made by the OCC based on the identified risks to the OCC's data and operations. These risks include: (1) deficiencies noted in the contractor's most recent SOC 2 Type 2 Report, (2) the gaps identified in the IT security and privacy control assessments performed specific to OCC customer responsibility implementations as designated in the CRM.

D. Configuration Management

Security Configuration Settings. The contractor shall establish and enforce security configuration settings for information technology products employed in the Credit eLearning System.

Security Updates and Patches. The contractor shall ensure that the Credit eLearning System is properly maintained and monitored, to include immediate response to critical security patches, routine maintenance windows to allow for system updates, and compliance with the defined configuration management and change control processes.

All patches and system updates shall be properly tested in a development environment before being implemented in the production environment.

Least Functionality. The contractor shall restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services for information technology products employed in the Credit eLearning System.

E. Continuous Monitoring

Compliance Reviews and Audits. The contractor shall permit and support compliance reviews and audits under applicable laws to allow the OCC to meet legal and compliance obligations and shall implement processes that allow visibility into the privacy and security controls employed and their effectiveness. The contractor shall provide the OCC or authorized designated officials with information requested by auditors in a timely manner, consistent with the respective auditor's deadline, in support of security compliance reviews and various annual audits, e.g., FISMA, Financial Statement Audit, A-123, etc.

In addition, the contractor shall provide the OCC or authorized designated officials logical and physical access to the contractor's facilities, installations, technical capabilities, operations, records, and databases pertinent to this contract within seven (7) calendar days upon request for these purposes.

Annual SOC 2 Type 2 Reviews. As mentioned in Section C. "Security and Privacy Authorization," under SSAE 18 requirements, the contractor shall provide the annual SSAE 18 SOC 2 Type 2 report to the OCC for review in support of continuous monitoring activities. If any portion of standard security objectives (e.g., contingency planning controls, etc.) were not in the scope of the independent auditor's testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2 report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

F. Data Protection

Data Encryption. Where encryption is required, as specified by the OCC, the contractor shall ensure that encryption is established and maintained for data at rest and in transit for the duration of the contract. The encryption employed shall be equivalent to those approved in Federal Information Processing Standards (FIPS) Publication 140.

Need to Know. Sensitive information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected.

Such measures include controls listed in NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, as amended, in the following areas: Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity.

Data Separation. Unless otherwise directed by the OCC and/or controls are implemented to ensure adequate separation, any storage of data shall be contained within the resources allocated by the contractor to support the OCC and may not be on systems that are shared with other commercial or government clients.

General Use of Personally Identifiable Information (PII). The contractor shall not use any PII, including low-sensitivity PII (e.g., E-mail Groups and Lists), for any purpose other than those activities necessary to the performance of this contract.

Use of Contractor Equipment. Use of contractor-owned laptops or other equipment (e.g., media storage devices, servers, etc.) to process, transmit, or store OCC information or to access the OCC network or other OCC information resources without OCC's formal authorization is prohibited. This does not include the use of non-OCC laptops or PCs to use OCC-approved virtual desktop infrastructure to remotely access the OCC network.

G. Incident Response

Notification. The contractor must report all information security incidents that potentially or actually cause the compromise of OCC information, even if the contractor believes the security incident may be limited, small, or insignificant with respect to OCC data or systems. The OCC will determine when the contractor's reported security incident requires additional focus and attention.

Within one hour from the time the contractor validates that an information security incident has occurred, the contractor must report the security incident information to the OCC Cyber Defense Center (CDC): Computer.Security@occ.treas.gov, (202) 649-7930, regardless of day or time.

The contractor must provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC with the following text in the subject line of the email: “Supplementary Information/Report related to previously reported incident # [insert number].”

Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

When notifying the OCC CDC, copy the Contracting Officer if possible or, if reporting by phone or Contracting Officer's email is not immediately available, contact the Contracting Officer immediately after reporting the incident to the OCC CDC.

Information, System and Tool Availability. The contractor shall make available any information, systems and tools necessary for the OCC to respond to incidents in a manner consistent with NIST SP 800-61, as amended. In the case of a reported security incident, the contractor shall provide the OCC with access to the contractor's system and/or facilities within 72 hours of the OCC's request.

H. Information Ownership

Government Access. The government will retain unrestricted rights to government data.

The OCC retains ownership of any user created/loaded data and deliverables (e.g., documents, applications, custom code, diagrams, workflows, data sets, etc.) hosted on contractor's equipment, systems, infrastructure, etc., as well as maintains the right to request full copies of these at any time.

Removal of OCC Data. The contractor acknowledges the OCC's exclusive right of ownership of the information and is required to transfer, return, and/or delete all agency data collected, processed, stored or maintained by the contractor on behalf of OCC upon termination of services, and shall provide written certification and supporting documentation attesting to the transfer, return and/or deletion of agency information or data generated, collected, processed, maintained, or stored by the contractor and any subcontractors, per instructions the "Security and Privacy Vendor Deliverables" section.

Documents and Deliverables. The preliminary and final OCC-specific deliverables and all associated working papers and other material deemed relevant by the agency that have been generated in the performance of this contract, are the property of the U.S.

Government. The contractor shall not release any information without the written consent of the Contracting Officer. All work papers, preliminary and final deliverables must be submitted to the COR at the conclusion of the contract in an acceptable and usable format, which may include the original format.

eDiscovery. The contractor must ensure data preservation requirements (i.e., halt destruction and maintain data the contractor may not otherwise have to maintain) related to litigation holds are met. The contractor shall also ensure that metadata associated with litigation holds are preserved. Metadata is electronically-stored information that describes the history, tracking, or management of an electronic document. It is created automatically when a user creates, modifies, accesses, or takes other actions with respect to an electronic document.

The contractor shall provide immediate access to all government data and government-related data impacting government data for review or scan, or conduct of a forensic evaluation, and physical access to any contractor facility with government data.

I. System Access

Government Right to Terminate Access. The OCC, at its discretion, may suspend or terminate the access to any systems and/or facilities when an information security incident or other electronic access violation, use or misuse issue gives cause for such action. The suspension or termination may last until such time as OCC determines that the situation has been corrected or no longer exists.

The system shall implement multi-factor authentication for remote users.

J. Training Requirements N/A

K. Supply Chain Risk Management

Background. In accordance with Federal requirements, the OCC requires supply chain entities to implement necessary security safeguards to: (i) reduce the likelihood of unauthorized modifications at each stage in the supply chain; and (ii) protect information systems and information system components, prior to taking delivery of such systems/components. This control also applies to information system services.

Supply Chain Safeguards. The contractor will:

a. Implement security and privacy controls for systems, facilities, and external connections to systems as necessary to ensure compliance with the laws, regulations, standards, and requirements specified in Sections C. Security and Privacy Authorization, F. Data Protection, and I. System Access.

b. Implement personnel screening processes to ensure suitability in accordance with relevant standards and requirements.

c. Use of tamper-evident packaging during shipping/warehousing.

d. Avoid the purchase of custom configurations to reduce the risk of acquiring information systems, components, or products that have been corrupted via supply chain actions targeted at specific organizations.

e. Vet the processes and security practices of subordinate suppliers, critical information system components, and services.

f. Employ a diverse set of suppliers to limit the potential harm from any given supplier in the supply chain.

g. Implement contract language regarding the prohibition of tainted or counterfeit components.

h. Restrict purchases from specific suppliers or countries per requirements issued by the U.S. Department of Homeland Security (DHS) and/or Federal Acquisition Security Council, as these requirements pertain to the management of supply chain risk for Federal Agencies.

i. Use trusted/controlled distribution, delivery and warehousing options to reduce supply chain risk.

11. SECURITY AND PRIVACY VENDOR DELIVERABLES

The specific contents and template for each deliverable will be agreed upon with the COR after contract award.

Authorization Boundary Section Deliverable Frequency Due

Date C. Security and Privacy Authorization.

Authorization Boundary

OCC-specific Demarcated Security Authorization Boundary for the solution

Initially, and as changes occur

Initial:Within 30 Days of Award

Non-Federal ESP Security Documentation

Section Deliverable Frequency Due Date

C. Security and Privacy Authorization.

SSAE 18

Requirements;

E. Continuous Monitoring.

Annual SOC 2 Type 2 Reviews

Statement on Standards for Attestation Engagements (SSAE) 18 SOC Type II report. The preferred coverage period for the report is July 1 through June 30 with a bridge letter covering the three months to September 30.

Initially and Annually

Initial: Within 30 Days of Award Annual: NLT May 1

Removal of Data

Section Deliverable Frequency Due Date

H. Information Ownership.

Removal of OCC Data F. Data Protection.

Contractor Equipment];

Certification of OCC Data Removal from Contractor’s (including any subcontractors), Possession, Equipment, and/or Environment.

Data removal instructions include transfer of information to another party per specific instructions from the CO; return of information, deliverables, etc., to the CO; and deletion of OCC data from contractor equipment (e.g., laptops and other contractor-owned equipment previously approved by the OCC for this use) using NIST SP 800-88, Guidelines for Media Sanitization, as amended.

Once NLT 15 days after termination/expiration of contract

PART III - OTHER CONTRACTUAL TERMS AND CONDITIONS

Federal Acquisition Regulation Clauses

FAR 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

www.acquisition.gov

(End of Clause)

FAR

Clause

Title Date

52.202-1 Definitions JUN 2020

52.204-13 SYSTEM FOR AWARD MANAGEMENT MAINTENANCE OCT 2018

52.204-18 COMMERCIAL AND GOVERNMENT ENTITY CODE

MAINTENANCE

AUG 2020

52.204-19 INCORPORATION BY REFERENCE OF REPRESENTATIONS

AND CERTIFICATIONS

DEC 2014

52.204-26 COVERED TELECOMMUICATIONS EQUIPMENT OR

SERVICES-REPRESENTATION

OCT 2020

52.212-4 CONTRACT TERMS AND CONDITIONS -- COMMERCIAL

ITEMS

OCT 2018

52.232-40 PROVIDING ACCELERATED PAYMENTS TO SMALL

BUSINESS SUBCONTRACTORS

DEC 2013

(End of Table)

FAR 52.204 -21 BASIC SAFEGUARDING OF COVERED CONTRACTOR

INFORMATION SYSTEMS (JUN 2016)

(a) Definitions. As used in this clause-- “Covered contractor information system” means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

“Federal contract information” means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public Web sites) or simple transactional information, such as necessary to process payments.

“Information” means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on National Security Systems Instruction (CNSSI) 4009).

http://www.acquisition.gov/

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (44 U.S.C.

3502).

“Safeguarding” means measures or controls that are prescribed to protect information systems.

(b) Safeguarding requirements and procedures.

(1) The Contractor shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls:

(i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

(ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

(iii) Verify and control/limit connections to and use of external information systems.

(iv) Control information posted or processed on publicly accessible information systems.

(v) Identify information system users, processes acting on behalf of users, or devices.

(vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

(vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

(viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

(x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

(xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

(xii) Identify, report, and correct information and information system flaws in a timely manner.

(xiii) Provide protection from malicious code at appropriate locations within organizational information systems.

(xiv) Update malicious code protection mechanisms when new releases are available.

(xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

(2) Other requirements. This clause does not relieve the Contractor of any other specific safeguarding requirements specified by Federal agencies and departments relating to covered contractor information systems generally or other Federal safeguarding requirements for controlled unclassified information (CUI) as established by Executive Order 13556.

(c) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial items, other than commercially available off-the-shelf items), in which the subcontractor may have Federal contract information residing in or transiting through its information system.

FAR 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT

STATUTES OR EXECUTIVE ORDERS-COMMERCIAL ITEMS (JAN 2021)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Jul 2018) (Section 1634 of Pub.

L. 115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Aug 2020) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(5) 52.233-3, Protest After Award (Aug 1996) (31 U.S.C. 3553).

(6) 52.233-4, Applicable Law for Breach of Contract Claim (Oct 2004) (Public Laws 108-77 and

108-78 ( 19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting

Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

[Contracting Officer check as appropriate.] __ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (June 2020), with

Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

__ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Jun 2020) (41 U.S.C. 3509)).

__ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (Jun 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

_X_ (4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (Jun 2020) (Pub. L. 109-282) ( 31 U.S.C. 6101 note).

__ (5) [Reserved].

__ (6) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-117, section

743 of Div. C).

__ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Oct

2016) (Pub. L. 111-117, section 743 of Div. C).

_X_ (8) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors

Debarred, Suspended, or Proposed for Debarment. (Jun 2020) (31 U.S.C. 6101 note).

_X_ (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters

(Oct 2018) (41 U.S.C. 2313).

__ (10) [Reserved].

__ (11)(i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Mar 2020)

(15 U.S.C. 657a).

__ (ii) Alternate I (Mar 2020) of 52.219-3.

https://www.acquisition.gov/far/52.203-19#FAR_52_203_19 https://www.acquisition.gov/far/52.204-23#FAR_52_204_23 https://www.acquisition.gov/far/52.204-25#FAR_52_204_25 https://www.acquisition.gov/far/52.209-10#FAR_52_209_10 https://www.acquisition.gov/far/52.233-3#FAR_52_233_3 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.233-4#FAR_52_233_4 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.203-6#FAR_52_203_6 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.203-13#FAR_52_203_13 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3…