Credit Reporting Services SOW - for RFI.docx

Statement of Work

For

DHS-wide Tri-Merged Employment Credit Reports and Related Services

April 15, 2025 Department of Homeland Security

SOW

CHANGE CONTROL LOG

Statement of Work (SOW) Tri-Merged Employment Credit Reports and Related Services

1. BACKGROUND

DHS components require support with background investigation checks necessary to determine an individual’s suitability/fitness and national security eligibility for access to DHS facilities and information. In order to meet background investigative requirements, the government has a need for individual public records (PR) checks; social security number (SSN) verifications; and web-based tri-merged employment credit reports from Equifax, Experian and Transunion.

This SOW identifies the scope and outlines the activities to provide web-based tri-merged employment credit reports from Equifax, Experian and Transunion.

The collection, use, storage, and dissemination of information provided by the Government to the contractor to facilitate the performance of work, as well as information collected by the Contractor as part of any investigation performed under any calls placed pursuant to this Blanket Purchase Agreement (BPA), are governed by the Privacy Act of 1974.

Employment credit reports and the specified related services are a mission critical piece in the investigative product and must be reported accurately and timely to determine whether an individual is suitable for employment within DHS and is required in order for DHS to meet National Investigative Standards.

2. SCOPE

This SOW encompasses the electronic delivery of tri-merged credit reports and “related services”. Related services include: SSN verification and public records checks. Credit reports shall be in accordance with the Fair Credit Reporting Act (FCRA), Executive Order 12968, Executive Order on Access to Classified Information, and suitability requirements set forth in 5 C.F.R. 731. This requirement incorporates the referenced deliverables above, internet search technology, training, program management support and compliance with all DHS IT system and privacy requirements, including safeguarding of sensitive information.

3. PLACE OF PERFORMANCE

Contractor employees shall perform work at the contractor’s normal place of employment. Interaction with any DHS component shall take place via web portals, email, and phone, except for training, which shall be conducted at the designated facility of the requesting DHS component.

4. PERIOD OF PERFORMANCE

The period of performance for the BPA shall be for one (1) Base Year and four (4) Option Years. Calls against this BPA shall specify their own periods of performance.

5. APPLICABLE DOCUMENTS

DHS and its components have been delegated the authority to conduct suitability (public trust), national security background investigations and reinvestigations, and Continuous Evaluations (CEs) under Executive Order 12968 as amended, and 5 CFR 731.

As part of the investigative process, the person who is the subject of an investigation signs and dates a FCRA disclosure form which authorizes release of information that specifically gives DHS or its components the authority to extract information from the credit bureaus and financial/lending institutions.

Other applicable documents are:

· Department of Homeland Security (DHS) Handbook for Safeguarding Sensitive Personally Identifiable Information, December 4, 2017;

· DHS Sensitive Systems Policy 4300A;

· National Institute of Standards and Technology 800-53 Guidelines;

· Privacy Act of 1974 5 U.S.C. § 552a;

· DHS Component Specific Handbooks;

· CBP Handbook 1400-05D

6. SPECIFIC TASKS/ DELIVERABLE

The contractor shall provide services for the following tasks and resultant deliverables to include, but not limited to:

6.1 Tri-merged Employment Credit Reports: The tri-merge report shall be easily readable and user friendly and combine data in one report from the three (3) credit bureaus, Experian, Equifax and Transunion, without duplicate data.

6.1.1 The report must contain the initial search identifiers and begin with Application Information and must contain the following:

· Subject’s Name

· Subject’s email address

· Subject's address (street, city, state, zip code). This includes addresses in all 50 states plus the U.S. Virgin Islands and Puerto Rico.

· Subject's Social Security number (last four digits)

· Subject’s Date of Birth

6.1.2 The report must contain a Credit Summary that consists of the following:

· Number of tradelines

· Number of Currently Satisfactory accounts

· Number of Currently Delinquent accounts

· Number of Collections/Charge off accounts

· Number of accounts 30 days late

· Number of accounts 60 days late

· Number of accounts 90 days late

· Date of newest account

· Date of oldest account

· Number of inquiries

· Number of Public Records

6.1.3 The report will also include a Financial Summary that consists of the following information regarding Real Estate accounts, Installment, Revolving and others:

· Number of account types (i.e., mortgage, installment, open, revolving, other…)

· Total Payment amount

· Total balance

· Total Amount past due

· Percentage of utilization

6.1.4 The report must include a Personal Information Comparison that consists of any possible alias used by or associated with the Subject.

6.1.5 The report must include an Address Comparison that consists of any addresses used by or associated with the Subject.

6.1.6 The report will also include a Credit History that consists of the following credit types; Mortgage accounts, Education accounts, Installment, Revolving and others:

· Creditor Name

· Date the information was reported to the creditor bureau

· Date the account opened

· Last activity date

· High credit limit

· Balance owed

· Amount past due

· Payment terms (amount/frequency)

· Type of creditor (real estate mortgage, auto, credit card, etc.)

· Historical times past due (30, 60, 90+ days)

· Present Account Status

· Contain an Equal Credit Opportunity Act (ECOA) Column – with legend indicating individual’s ownership status of the account: Borrower, Co- borrower, Shared, Joint, Undesignated, or an Authorized User.

6.1.7 The report will be provided as fixed rate that is inclusive of all state fees.

6.2 Supplemental Public Records (PR) Checks: The Contractor shall provide a separate public record check to supplement the public records captured in the Tri-Merged Credit Report.

6.2.1 PR checks will be placed at end of the Tri-Merged Credit Report and retrievable as a single document.

6.2.2 PR checks will be ordered only as a supplement to a Tri-Merged Credit Report and will not be ordered as a separate product.

6.2.3 These PR check will identify whether the Subject has any of the applicable public records listed below:

· Bankruptcy

· Repossessions

· Foreclosures

· Any federal or state tax liens

· Judgements

6.3 SSN Verifications: The Contractor shall provide SSN verifications that cross-check against the subject’s SSN, name and date of birth and will provide a death indicator if results indicate the Subject is deceased.

6.3.1 SSN Verifications are direct verifications from the Social Security Administration (SSA) and require a completed SSA-89 form from the subject.

6.3.2 SSN Verification checks will be made available for order on an individual basis and will not be provided as part of the Tri-Merged Credit Report.

7. TRAINING

Training shall be provided to all Government employees and/or Government contract staff requiring access, prior to the start of performance on each call.

7.1 The contractor shall provide the following items as part of the training program:

7.1.1 Formal Training Plan/Schedule that encompasses what would be covered in the initial training session along with a training brochure clearly illustrating and explaining all entries contained in the credit report provided to the DHS component. The initial training can be conducted “on-site” or via a video teleconference that utilizes screen sharing.

7.1.2 A “Quick Reference Card.”

7.1.3 An instruction manual that details all information provided within the credit report. A copy of the manual shall be provided with the offeror’s proposal and will be evaluated during source selection. The manual shall serve as a guideline to interpreting the credit report. The contractor shall provide updates to the manual within five (5) business days as changes occur

8. TRANSITION PLAN

The contractor shall provide a transition plan to show the transition procedures from the current provider of this service as well as the plan for transitioning out at the end of the BPA period. “Transitioning in” shall cover, but is not limited to, items such as implementation of processes to request reports, training, IT compliance and testing.

9. INTERFACE

The Contractor shall comply with the government’s system interface requirements detailed below.

9.1 Secure Application Method

The contractor shall provide DHS personnel with a secure method to access an application that allows for both manual and automated request for credit reports. In either form of request, the Government will not be charged for any erroneous credit reports provided (e.g., blank reports) that are a direct result of the contractor’s error.

9.1.1 For both manual and automated requests, the contractor system shall be able to ‘check’ whether a credit report was run on a subject within the past ninety (90) days and only generate a new report if outside that time frame. If a report on the same subject is requested by the Government within the ninety (90) day time frame, a copy of the prior report shall be provided, without charge, as opposed to being processed as a fresh inquiry.

9.1.2 The Order/retrieval of reports and data will be over the internet via a Hyper Text Transfer Protocol Secure (HTTPS)/Secure Socket Layer (SSL) protocol interface. The contractor shall be responsible for maintaining the secure application. The contractor shall supply DHS Components with usernames and passwords as needed to access the application.

9.1.3 If at any time the application cannot be accessed, the contractor will provide the requested product in electronic PDF format to the Government via email. At minimum, the PDF must be password protected with a complex password as defined by the Government’s OCIO standards.

a) The Password must contain the following:

· Twelve (12) characters including uppercase, lowercase, number, and special character

· No SPII (such as social security numbers) shall be used as the password.

· The password may not be included in the delivery materials and must be provided in a separate email.

9.2 Extensible Markup Language (XML) Messages

DHS Components may make requests for an individual's credit history through the use of Extensible Markup Language (XML) messages that follow the Simple Object Access Protocol (SOAP) standard via the internet.

9.2.1 Responses to these requests will be provided as electronic files in both a Portable Document Format (PDF) and an XML format.

9.2.2 Certain unanticipated advances in technology and processing innovations underway may significantly impact the manner in which work is performed and, at any time during the entire life of the BPA and calls. DHS components may negotiate the adjustments as necessary. For example, the current format may be changed with advancements in product enhancements, credit format and delivery methods.

10. POST AWARD CONFERENCE (KICK OFF MEETING)

The Government will conduct a Post Award conference within fourteen (14) calendar days after contract award. The purpose of the Post Award Conference is to aid both Government and Contractor personnel to achieve a clear and mutual understanding of all contract, management, and technical requirements and to identify and resolve potential problems.

During this meeting, the Contractor shall provide points of contact (POCs) to include: primary, alternate and help desk support. POC information shall include name, phone number and email address. The Government will provide points of contact for each DHS component as well as roles and email address.

The Contractor will take minutes during this meeting and submit a draft to the Government within seven

(7) calendar days. A final version of the minutes will be due within seven (7) calendar days of Government Review.

The Post Award Conference will be via Video Conference.

image1.jpeg