Draft Fiduciary Liability Insurance SOW.pdf

Fiduciary Liability Insurance Statement of Work

1 | P a g e

2.1 BACKGROUND

The Office of the Comptroller of the Currency (OCC), established in 1863, is a non-appropriated federal financial regulatory bureau of the U.S. Department of the Treasury. The

OCC is responsible for regulating and supervising the national banking system and federal savings associations. The OCC ensures that national banks and federal savings associations operate in a safe and sound manner, provide fair access to financial services, treat customers fairly, and comply with applicable laws and regulations.

The agency provides high-quality, fair, and balanced supervision to its chartered banks. The

OCC also helps banks be leaders in safe and sound community development financing and making financial services accessible to underserved communities and consumers. Michael J.

Hsu became Acting Comptroller of the Currency on May 10, 2021.

Agency 401(k) Retirement Savings Plan

In addition to the government’s Thrift Savings Plan (TSP), which is a federal retirement savings plan, the OCC also offers all eligible employees another benefit to financially prepare for retirement – the Agency 401(k) Plans: the OCC 401(k) Plan and the Office of Thrift

Supervision (OTS) 401(k) Plan. The OCC 401(k) Plan and the OTS 401(k) Plan are Defined

Contribution retirement savings plans, sponsored by the OCC.

OCC 401(k) Plan

The OCC 401(k) Plan covers all OCC employees hired under its authority since Plan inception in 2000. In addition, the OCC 401(k) Plan enrolls OCC employees who transferred to the

Consumer Financial Protection Bureau (CFPB) under the Dodd-Frank Wall Street Reform and

Consumer Protection Act (Dodd-Frank).

OTS 401(k) Plan

The OTS 401(k) Plan enrolls legacy employees of the Office of Thrift Supervision who retained benefits under the provisions of the Dodd-Frank financial reform legislation. Dodd-

Frank reorganized the financial regulatory system, eliminating the Office of Thrift Supervision, assigning new responsibilities to existing agencies like the Federal Deposit Insurance

Corporation (FDIC), and creating new agencies like the CFPB.

Dodd-Frank also created the Office of Financial Research (OFR). In 2013, OFR employees were added to the OTS 401(k) Plan using an OCC and OFR Interagency Agreement.

Employees of the Office of Financial Research (OFR) participate in the OTS 401(k) Plan.

PART II – STATEMENT OF WORK

2 | P a g e

Third-party record keeper

Charles Schwab, Inc is the third-party record keeper for the OCC and OTS 401(k) Plans. Please see the “Government Furnished Information” section for the number of OCC and OTS 401(k)

Plan assets and plan participants (active and separated)

Enrollment

Since January 20, 2008, all eligible employees are automatically enrolled in the Plans at 1% of adjusted based pay. The default fund for auto-enrollment is the age-appropriate fund from the

Vanguard Institutional Target Retirement family of funds.

Every effort should be made to start contributions for new employees during the first pay period of hire. However, enrollments completed within the first 45 days of hire will be considered timely.

All employees who were hired prior to January 20, 2008, if eligible, may begin to contribute to the OCC 401(K) Plan at any time. All auto-enrolled employees are eligible to increase, decrease, or stop their contributions after entering on duty.

Employees who wish to opt out of contributing to the Plan may enter a 0% or $0 election on the

Schwab site at any time. Employees who wish to opt out of contributing to the Plan may also request a refund of employee contributions made under the auto-enrollment provisions during their first 45 days of hire. Any OCC provided matching contributions associated with refunded contributions will be forfeited to the Plan.

OCC and OTS 401(k) Funds

The OCC and OTS 401(k) Fund options are the same for both plans. The 401(k) Plans investment options include the following categories:

• Vanguard Target Date Retirement Fund

• Plan-Selected Funds: Fixed Income, Stable Value, Money Market, International Equity, Domestic Equity (Small, Mid and Large Cap), Real Estate and Emerging Markets

• Charles Schwab Personal Choice Retirement Account (PCRA)

Please note, Charles Schwab and the OCC is restricted from providing advice on PCRA.

Personal Choice Retirement Account (PCRA)

Please note, the Personal Choice Retirement Account PCRA is a brokerage account self-managed that was designed to complement the Agency retirement plan core investments, by having access to thousands of additional investment choices.

3 | P a g e

401(k) Oversight Committee

The 401(k) Oversight Committee: acts in the best interest of Plan participants, interprets matters which would establish or change the Plans’ policies, establishes an Investment and Governance

Subcommittee. In addition, the 401(k) Oversight Committee:

• reviews investments

• Makes investment decisions consistent with program objectives as found in the

Investment Policy Statement.

• Periodically reviews the Plans’ Documents to take the necessary actions, as appropriate.

• Ensures plan participants are provided the following:

o Sufficient information to make informed investment decisions.

o Opportunities to make investment elections as often as appropriate for the investment fund.

o Choice of a broad range of investment options from across the risk spectrum.

o Communications regarding policy changes

The Investment and Governance Subcommittee

The Investment and Governance Subcommittee members, comprised of OCC National Bank

Examiners - Asset Management, research and analyze plan lineups, designating watch list, replacement or improving share class, and, relative data is posted on the OCC’s intranet

(“OCCNet”), to meet fiduciary responsibility.

The Investment and Governance Subcommittee, in conjunction with the 401(k) Oversight

Committee, is responsible for the oversight of the OCC 401(k) Retirement Savings Plan and

OTS 401(k) Retirement Savings Plan.

The Investment and Governance Subcommittee recommends a menu of fund investment options that meet program objectives, monitors the ongoing performance of fund investment options and makes recommendations regarding replacement options, if appropriate. In addition, the 401(k)

Investment Sub-Committee:

• Reviews the Investment Policy Statement periodically and recommends changes to the

Statement as needed to reflect the needs of the Plans

• Evaluates potential additions and modifications of the Plan rules and benefits, and presents recommendations to the Oversight Committee

The Plans Operations Advisory Group

The Plans Operations Advisory Group is responsible for monitoring the daily administration of the Plans, identifying operational risks associated with the 401(k) plans and maintaining a system of internal controls to eliminate or mitigate them. The Plans Operations Advisory Group is responsible for ensuring that plan participants have the information they need to make informed decisions regarding their contributions and investment choices.

4 | P a g e

In conjunction with the sub-committee, we are responsible for immediately communicating any risks or issues associated with the plans up the supervisory chain, and for briefing OCC leadership on the state of the 401(k) plans at least annually.

Audit and Compliance

The Agency 401(k) Plans are audited by an independent accounting firm annually. The firm provides us with an opinion regarding the disclosures in our financial statements. The 401(k) team is responsible for facilitating the audit process. Charles Schwab also tests the OCC and

OTS 401(k) Plans annually, to identify and correct any violations of the IRS contribution limits.

Charles Schwab requires much of the same data used in the financial audit.

2.2 SCOPE

The objective of engaging the Contractor is to provide 401(k) fiduciary liability insurance and

Errors & Omissions coverage. The fiduciary liability insurance coverage shall protect the OCC and its employees from claims of legal liability arising from the sponsorship and administration of the Agency 401(k) Plan.

The OCC requires fiduciary liability insurance coverage, specifically, the services of a specialty lines insurance broker that is both qualified and experienced in the arena of providing fiduciary liability. The term “experienced and qualified” refers to necessary industry expertise in fiduciary liability insurance.

In addition, the OCC requires a thorough assessment and comparison analysis of both the quality of competitive fiduciary liability insurance coverage and the premiums, on behalf of the OCC.

The OCC also requires consulting services from a specialist lines insurance broker. The consulting services shall provide expert training and consultative sessions to 401(k) Committee members.

In addition, throughout the period of performance, the specialist lines insurance broker must respond to inquiries from OCC, within 5 business days. The OCC is understanding of the need to adjust the deadline, if the requested is not available.

The coverage shall be for the period June 10, 2025, through June 9, 2026.

2.3 TASKS

The Contractor shall:

1. Deliver to the OCC point of contact one final copy of each insurance policy.

2. Consulting Services - The specialist lines insurance broker shall provide consulting services to the OCC and expert Fiduciary Liability Insurance training sessions to 401(k) Sub-

5 | P a g e

Committee members. The specialist lines insurance broker shall:

a. On an ad-hoc basis, in the event OCC has fiduciary liability insurance policy questions, provide direct access and facilitate meetings between the OCC and insurance carrier(s).

b. Participate (virtually) in OCC’s 401(k) Sub-Committee meetings on at least a quarterly basis during the duration of the period of performance. Please note, the OCC will collaborate with the specialty lines insurance broker to determine the meeting agenda talking points, to include but not limited to the items listed in item “d” noted below.

c. Conduct quarterly Fiduciary Liability Insurance consultative and training sessions, covering topics to include but not limited to:

• Role of fiduciary overview

• Trends in litigation and coverage options (cybersecurity, etc.) in industry.

• Best practices to reduce plan risk profile and mitigate lawsuits.

• Evaluation and recommendation on OCC existing coverage.

2.4 SOLICITATION TASKS

THE CONTRACTOR AT A MINIMUM SHALL PERFORM AND PROVIDE A WRITTEN

ASSESSMENT WITH ITS QUOTE THAT INCLUDES BUT IS NOT LIMITED TO:

1. Review the terms of the current OCC fiduciary liability insurance policies and provide all existing coverage identified at a minimum.

2. Solicit five or more quotes for fiduciary liability insurance and errors and omission coverage, from qualified insurance companies with capital in excess of $1 billion.

3. Provide fiduciary liability and Errors & Omissions coverage. If errors and omissions coverage is not available, the Contractor must provide a detailed written explanation.

Errors and omissions protect the OCC against claims for negligence, mistakes, faulty advice, or failure to provide promised results.

4. Identify insurance companies capable of providing a range of fiduciary liability coverage options from at least $10 million to $25 million, including an option to extend the coverage for one additional year prior to expiration. If an option to extend the coverage for one additional year prior to expiration is not available, the Contractor must provide a detailed written explanation. The primary (base) fiduciary liability insurance coverage amounts quoted shall be at least $10 million.

Coverage recommendations greater than $25 million, may be quoted at the discretion of each insurance company under assessment.

The Contractor’s assessment may include possible ladder arrangements (i.e., $10 million, $15 million, $25 million, etc.) to spread the risk among multiple insurance companies.

6 | P a g e

5. Assess each insurance companies’ expertise in fiduciary liability insurance and coverage options, these options must consider multiple deductible, coverage, and premium options.

a. A comparison of strengths and weaknesses of the different fiduciary liability insurance coverage offered.

b. A comparison of the costs of coverage; and

c. An analysis of the terms and amount of coverage that would be most beneficial to the OCC from a cost and technical standpoint.

6. Assess each insurance companies SOC-1, AM Best ratings, and an analysis of each insurance companies’ financial strength and creditworthiness.

7. Clearly state and explain any coverage exclusions.

8. Provide full draft insurance policies with the quote and a detailed explanation of all related costs.

9. Provide a complete breakdown of all fees charged by the Contractor, including service fees, assessment fees, etc. All fees must be itemized and specifically detail the manner, in which they were derived, including the discrete activities performed, the amount of time allocated to each activity, and the hourly charge assessed for performing each activity.

10. The Contractor shall respond in writing or verbally as requested by the government to all questions concerning its quote. Responses shall be provided by the Contractor within 5 business days of submission of the questions by the OCC, unless the OCC grants additional time. The Contractor shall also participate in virtual meetings as requested by the OCC to clarify any questions related to its quote.

11. Provide the fiduciary liability insurance policy coverage of at least $10 million as designated by the OCC at time of award.

2.5 GOVERNMENT FURNISHED INFORMATION

The following information is provided to assist with underwriting an insurance policy:

• As a governmental plan, the Employee Retirement Income Security Act does not apply to the OCC and OTS 401(k) Plans.

• OCC and OTS 401(k) Plans total assets as of November 7, 2024 were $1.52 billion (OCC -

1,130,417,008.24; OTS - 390,975,231.22)

• As of November 7, 2024, the OCC 401(k) Plan has 4,961 participants (active and separated).

7 | P a g e

• As of November 7, 2024, the OTS 401(k) Plan has 818 participants (active and separated).

The OCC 401k Plan Financial Statements and Supplemental Information (Attachment 1) and

OTS 401k Plan Financial Statements and Supplemental Information (Attachment 2) are attached.

2.6 COMPLIANCE WITH APPLICABLE LAWS, REGULATIONS, AND STANDARDS

2.6.1 Secure User-to-Cloud Communications Standards.

All user-to-cloud service communications (e.g., via internet) must be encrypted with the latest industry standard browser protocol.

2.6.2 General Requirements

2.6.2.1 Location. Information collected, used, stored, maintained, or otherwise processed by the contractor in the performance of this contract shall be accessed, transferred, stored, or processed only within the United States. In addition, the maintenance and support operations of the contractor's technology and information must take place, and originate from, within the

United States.

The contractor shall not host any portion of the information, information system, infrastructure, or environment in facilities outside the contiguous

United States, Alaska, Hawaii, and other U.S. Territories.

2.6.2.2 Authorization to Use, Store, or Share Sensitive Information. The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all government data, equipment, etc. by treating the information as sensitive. All information gathered or created under this contract shall be considered as Controlled but Unclassified (CUI) information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets.

2.6.2.3 Confidentiality. The contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

2.6.2.4 Deliverables. The deliverables in this contract will be considered sensitive and shall not be shared with any other organization without prior approval from the OCC CO.

2.6.2.5 Security and Privacy Authorization

8 | P a g e

Authorization Boundary. The contractor shall provide a diagram specific for the OCC, that clearly demarcates the information system authorization boundary and depicts all of its connections and components, including the means for monitoring and controlling communications at the external boundary and at key internal boundaries within the system. The contractor shall address all components and managed interfaces of the information system authorized for operation (e.g., routers, firewalls). The diagram must include a predominant border drawn around all system components and services included in the authorization boundary.

If there are OCC-specific components (e.g., components developed or customized for the OCC, OCC-hosted components, etc.) and/or other components supporting this solution that are not in the scope of the contractor's existing security documentation, then identify those components in the diagram as well, as part of a separate OCC-specific boundary since those are unique to OCC and shall be part of the OCC-specific security authorization. The diagram must be easy to read and understand. Formal names of components as they are known at the service provider organization in functional specifications, configuration guides, other documents and live configurations shall be named on the diagram and described. The contractor shall provide a key for symbols used.

External Service Provider Compliance & Monitoring Background. The

FISMA and OMB policies require that federal agencies using external service providers to process, store, or transmit federal information or operate information systems on behalf of the federal government, assure that such systems meet the information security protections commensurate with the information and system sensitivity. Federal agencies are responsible and accountable for the information security risk incurred by the use of information system services provided by external providers.

Such risk is addressed by incorporating the Risk Management Framework

(RMF)1 and security requirements for external information systems and services as part of the terms and conditions of the contracts with external providers. Federal agencies can also require external providers to provide appropriate evidence to demonstrate that they have complied with protecting federal information. Prior to the implementation of the contractor's system or services, the OCC ensures compliance with the RMF by issuing an

Authorization to Operate (ATO) or Authorization to Use (ATU), based on its review and analysis of the external provider's security documentation

(described in detail in the next section) and assessment of customer (OCC's) security responsibilities.

1NIST Special Publication 800-37, as amended, Risk Management

Framework for Information Systems and Organizations: A System Life Cycle

Approach for Security and Privacy.

9 | P a g e

Non-Federal External Service Provider Security Documentation. Non-federal organizations with primarily non-federal customers have limitations with respect to complying with all federal requirements. As a result, the OCC obtains assurance through other industry standard security reviews, including

Statement on Standards for Attestation Engagements (SSAE) No. 18.

a. Statement on Standards for Attestation Engagements (SSAE) No. 18

Requirements. The contractor shall provide the OCC with an SSAE 18 System and Organization Controls (SOC) 2 Type 2 Report on an annual basis for services provided.

b. The preferred coverage period for the report is July 1 through June 30 with a bridge letter covering the three months to September 30.

c. For any gaps in the fiscal year coverage period (October 1 - September

30), the OCC will work with the contractor to complete the internal controls assessment by relying on the work performed by the contractor's competent and objective internal audit function per Statement on Auditing Standards No.

128, Using the Work of Internal Auditors.

d. The submission of the results of the SSAE 18 SOC 2 Type 2 Report shall be as instructed per the "Security and Privacy Vendor Deliverables" section.

e. If SOC 2 Type 2 reports are not available within the last three years, the contractor shall inform the OCC to determine if there is a suitable alternative with similar level of information and detail.

f. If any portion of standard security objectives (e.g., contingency planning controls, etc.) were not in the scope of the independent auditors testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2 report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

OCC Security Authorization to Use. The determination of whether to issue an

OCC security authorization will be made by the OCC based on the identified risks to the OCC's data and operations. These risks include: (1) deficiencies noted in the contractor's most recent SOC 2 Type 2 Report, (2) the gaps identified in the IT security and privacy control assessments performed specific to OCC customer responsibility implementations as designated in the

CRM.

2.6.2.6 Configuration Management

Security Configuration Settings. The contractor shall establish and enforce security configuration settings for information technology products employed in the [insert acquisition/solution name].

10 | P a g e

Security Updates and Patches. The contractor shall ensure that the [insert acquisition/solution name] is properly maintained and monitored, to include immediate response to critical security patches, routine maintenance windows to allow for system updates, and compliance with the defined configuration management and change control processes. All patches and system updates shall be properly tested in a development environment before being implemented in the production environment.

Least Functionality. The contractor shall restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services for information technology products employed in the [insert acquisition/solution name].

2.6.2.7 Continuous Monitoring

Compliance Reviews and Audits. The contractor shall permit and support compliance reviews and audits under applicable laws to allow the OCC to meet legal and compliance obligations and shall implement processes that allow visibility into the privacy and security controls employed and their effectiveness. The contractor shall provide the OCC or authorized designated officials with information requested by auditors in a timely manner, consistent with the respective auditor's deadline, in support of security compliance reviews and various annual audits, e.g., FISMA, Financial Statement Audit, A-123, etc.

In addition, the contractor shall provide the OCC or authorized designated officials logical and physical access to the contractor's facilities, installations, technical capabilities, operations, records, and databases pertinent to this contract within seven (7) calendar days upon request for these purposes.

Annual SOC 2 Type 2 Reviews. As mentioned in Section C. "Security and

Privacy Authorization," under SSAE 18 requirements, the contractor shall provide the annual SSAE 18 SOC 2 Type 2 report to the OCC for review in support of continuous monitoring activities. If any portion of standard security objectives (e.g., contingency planning controls, etc.) were not in the scope of the independent auditor's testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2 report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

2.6.2.8 Data Protection

11 | P a g e

Data Encryption. Where encryption is required, as specified by the OCC, the contractor shall ensure that encryption is established and maintained for data at rest and in transit for the duration of the contract. The encryption employed shall be equivalent to those approved in Federal Information Processing

Standards (FIPS) Publication 140.

Need to Know. Sensitive information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected.

Such measures include controls listed in NIST SP 800-171, Protecting

Controlled Unclassified Information in Nonfederal Systems and

Organizations, as amended, in the following areas: Access Control, Awareness and Training, Audit and Accountability, Configuration

Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk

Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity.

Data Separation. Unless otherwise directed by the OCC and/or controls are implemented to ensure adequate separation, any storage of data shall be contained within the resources allocated by the contractor to support the OCC and may not be on systems that are shared with other commercial or government clients.

General Use of Personally Identifiable Information (PII). The contractor shall not use any PII, including low-sensitivity PII (e.g., E-mail Groups and Lists), for any purpose other than those activities necessary to the performance of this contract.

Use of Contractor Equipment. Use of contractor-owned laptops or other equipment (e.g., media storage devices, servers, etc.) to process, transmit, or store OCC information or to access the OCC network or other OCC information resources without OCC's formal authorization is prohibited. This does not include the use of non-OCC laptops or PCs to use OCC-approved virtual desktop infrastructure to remotely access the OCC network.

2.6.2.9 Incident Response

Notification. The contractor must report all information security incidents that potentially or actually cause the compromise of OCC information, even if the contractor believes the security incident may be limited, small, or insignificant

12 | P a g e with respect to OCC data or systems. The OCC will determine when the contractor's reported security incident requires additional focus and attention.

Within one hour from the time the contractor validates that an information security incident has occurred, the contractor must report the security incident information to the OCC Cyber Defense Center (CDC):

Computer.Security@occ.treas.gov, (202) 649-7930, regardless of day or time.

The contractor must provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC with the following text in the subject line of the email: “Supplementary Information/Report related to previously reported incident # [insert number].”

Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

When notifying the OCC CDC, copy the Contracting Officer if possible or, if reporting by phone or Contracting Officer's email is not immediately available, contact the Contracting Officer immediately after reporting the incident to the OCC CDC.

Information, System and Tool Availability. The contractor shall make available any information, systems and tools necessary for the OCC to respond to incidents in a manner consistent with NIST SP 800-61, as amended. In the case of a reported security incident, the contractor shall provide the OCC with access to the contractor's system and/or facilities within

72 hours of the OCC's request.

2.6.2.10 Information Ownership

Government Access. The government will retain unrestricted rights to government data. The OCC retains ownership of any user created/loaded data and deliverables (e.g., documents, applications, custom code, diagrams, workflows, data sets, etc.) hosted on contractor's equipment, systems, infrastructure, etc., as well as maintains the right to request full copies of these at any time.

Removal of OCC Data. The contractor acknowledges the OCC's exclusive right of ownership of the information and is required to transfer, return, and/or delete all agency data collected, processed, stored or maintained by the contractor on behalf of OCC upon termination of services, and shall provide written certification and supporting documentation attesting to the transfer, return and/or deletion of agency information or data generated, collected, processed, maintained, or stored by the contractor and any subcontractors, per instructions the "Security and Privacy Vendor Deliverables" section.

Documents and Deliverables. The preliminary and final OCC-specific deliverables and all associated working papers and other material deemed relevant by the agency that have been generated in the performance of this contract, are the property of the U.S. Government. The contractor shall not release any information without the written consent of the Contracting

13 | P a g e

Officer. All work papers, preliminary and final deliverables must be submitted to the COR at the conclusion of the contract in an acceptable and usable format, which may include the original format.

eDiscovery. The contractor must ensure data preservation requirements (i.e., halt destruction and maintain data the contractor may not otherwise have to maintain) related to litigation holds are met. The contractor shall also ensure that metadata associated with litigation holds are preserved. Metadata is electronically-stored information that describes the history, tracking, or management of an electronic document. It is created automatically when a user creates, modifies, accesses, or takes other actions with respect to an electronic document.

The contractor shall provide immediate access to all government data and government-related data impacting government data for review or scan, or conduct of a forensic evaluation, and physical access to any contractor facility with government data.

2.6.2.11 System Access

Government Right to Terminate Access. The OCC, at its discretion, may suspend or terminate the access to any systems and/or facilities when an information security incident or other electronic access violation, use or misuse issue gives cause for such action. The suspension or termination may last until such time as OCC determines that the situation has been corrected or no longer exists.

The system shall implement multi-factor authentication for remote users.

2.6.2.12 Training Requirements: None

2.6.2.13 Supply Chain Risk Management

Background. In accordance with Federal requirements, the OCC requires supply chain entities to implement necessary security safeguards to: (i) reduce the likelihood of unauthorized modifications at each stage in the supply chain; and (ii) protect information systems and information system components, prior to taking delivery of such systems/components. This control also applies to information system services.

Supply Chain Safeguards. The contractor will:

a. Implement security and privacy controls for systems, facilities, and external connections to systems as necessary to ensure compliance with the laws, regulations, standards, and requirements specified in Sections C.

Security and Privacy Authorization, F. Data Protection, and I. System

Access.

b. Implement personnel screening processes to ensure suitability in accordance with relevant standards and requirements.

c. Use of tamper-evident packaging during shipping/warehousing.

14 | P a g e

d. Avoid the purchase of custom configurations to reduce the risk of acquiring information systems, components, or products that have been corrupted via supply chain actions targeted at specific organizations.

e. Vet the processes and security practices of subordinate suppliers, critical information system components, and services.

f. Employ a diverse set of suppliers to limit the potential harm from any given supplier in the supply chain.

g. Implement contract language regarding the prohibition of tainted or counterfeit components.

h. Restrict purchases from specific suppliers or countries per requirements issued by the U.S. Department of Homeland Security (DHS) and/or Federal

Acquisition Security Council, as these requirements pertain to the management of supply chain risk for Federal Agencies.

i. Use trusted/controlled distribution, delivery and warehousing options to reduce supply chain risk.

2.6.2.14 Security and Privacy Vendor Deliverables

Removal of Data Deliverables

Section Deliverable Frequency Due Date

2.5.2.10 Information

Ownership. Removal of

OCC Data

2.5.2.8 Data Protection.

Contractor Equipment

Certification of OCC Data Removal from Contractor’s

(including any subcontractors), Possession, Equipment, and/or Environment. Data removal instructions include transfer of information to another party per specific instructions from the CO; return of information, deliverables, etc., to the CO; and deletion of OCC data from contractor equipment (e.g., laptops and other contractor-owned equipment previously approved by the OCC for this use) using NIST SP 800-88, Guidelines for Media

Sanitization, as amended.

Once NLT 15 days after termination/expiration of contract

Authorization Boundary Deliverables

C. Security and

Privacy

Authorization.

Authorization

Boundary

OCC-specific Demarcated Security Authorization

Boundary for the solution

Initially, and as changes occur

Initial: Within 30

Days of Award

Non-Federal External Service Provider (ESP) Security Documentation Deliverables

15 | P a g e

C. Security and Privacy

Authorization. SSAE

18 Requirements;

E. Continuous

Monitoring. Annual

SOC 2 Type 2 Reviews

Statement on Standards for Attestation

Engagements (SSAE) 18 SOC Type II report.

The Contractor may substitute the National Institute of Standards and Technology (NIST) 800-171 report for the SSAE 18 SOC Type II Report. The preferred coverage period for the report is July 1 through June

30 with a bridge letter covering the three months to

September 30.

Initially and

Annually

Initial: Within 30 Days of Award

Annual: NLT May 1

2.7 PAYMENTS

The Government will use both forfeiture funds and OCC funds to pay for 401(k) plan related expenses incurred under this contract. The Contractor shall follow the below process for the submission of invoices:

(1) The OTS 401(k) Plan insurance coverage will be paid using OCC funds. The Contractor shall use the Invoice Processing Platform as instructed by the Department of Treasury

Acquisition Regulation (DTAR) Clause 1052.232-7003 Electronic Submission of Payment

Requests to submit an invoice for payment. OCC funds will be used to process the OTS

401(k) Plan insurance coverage payment.

(2) The OCC 401(k) Plan insurance coverage will be paid using forfeiture funds. To be paid, the Contractor shall submit a W-9 Request for Taxpayer Identification Number and

Certification Form and an invoice to the Office of the Comptroller of the Currency (OCC)

Point of Contact (POC). POC contact information may be found in OCC Clause 1052.242-

8001. The Contractor shall identify a payment method for receipt of payment, i.e., check payment or Automated Clearing House (ACH) wire transfer, and the recordkeeper shall disperse payment at the discretion of the contractor.