Draft PWS_Financial Statments Audits.docx

DEPARTMENT OF THE TREASURY

PERFORMANCE WORK STATEMENT

9/19/2022 DEPARTMENT OF THE TREASURY ANNUAL FINANCIAL STATEMENT AUDITS, ATTESTATION EXAMINATIONS, AND FISMA AUDITS

TABLE OF CONTENTS

PAGE NO.

PART 1. GENERAL INFORMATION

1.A. Labor Categories This contract shall be considered a fixed-price contract with travel paid consistent with Federal Travel Regulations. The following categories of labor will be applicable to all work contained in this contract. The requirement for continuing education and training in the past two years as required below relates to the two year period prior to the release date of this contract. Personnel in all labor categories below, except for (4) Staff Auditor, (10) IS/IT Staff Auditor, and (13) Junior Computer Consultant, are considered key personnel.

1) Partner/Principal The Partner/Principal is required to be a Certified Public Accountant (CPA) and licensed by the appropriate state licensing authority and be in good standing with the AICPA, State Board, etc. The minimum education requirements include: (a) a bachelor’s degree in accounting or business, and (b) 80 hours of continuing professional education (CPE) in the past two years that meets the government’s CPE requirements, with at least 24 of the 80 hours of continuing education and training in subjects directly related to government auditing, the government environment, or the specific or unique environment in which the audited entity operates. The minimum experience requirements in this category include: (a) being a partner or principal in the Contractor’s or subcontractor’s organization, and (b) having a minimum of seven years general audit[footnoteRef:1] experience and three years Federal government financial audit experience. The partner/principal is responsible for the work performed, i.e., overall project management and final report review. [1: The term “audit” used throughout this contract refers to financial audits, attestation engagements, and performance audits conducted in accordance with GAGAS as applicable.]

2) Audit Manager The Audit Manager is required to be a CPA and licensed by the appropriate state licensing authority. The minimum education requirements include: (a) a bachelor’s degree in accounting or business, and (b) 80 hours of CPE in the past two years that meets the government’s CPE requirements, with at least 24 of the 80 hours of continuing education and training in subjects directly related to government auditing, the government environment, or the specific or unique environment in which the audited entity operates. The minimum experience requirements include: (a) having a minimum of five years general audit experience; and (b) two years Federal government financial audit experience at a supervisory level. The responsibilities in this category include: (1) reviewing audit documentation, financial statements and reports; (2) conducting discussions with clients about the results of the work performed; (3) directing senior and staff auditors; (4) reviewing and approving work plans and programs; (5) ensuring that assignments are carried out within the budgeted time and within delivery commitments; (6) reviewing audit documentation and financial statements and related reports for accuracy and completeness; and (7) following the progress of the engagement and helping resolve accounting, auditing, and reporting problems as they arise. The Audit Manager is regularly assigned to other audit engagements in a managerial capacity.

3) Senior Auditor The minimum education requirements include: (a) a bachelor’s degree in accounting or business, and (b) 80 hours of CPE in the past two years that meets the government’s CPE requirements, with at least 24 of the 80 hours of continuing education and training in subjects directly related to government auditing, the government environment, or the specific or unique environment in which the audited entity operates. The minimum experience requirements include: (a) being a senior in the Contractor’s or subcontractor’s organization, (b) having a minimum of three years general audit experience, and (c) one year of Federal government financial audit experience. The responsibilities in this category include: (1) independently performing a major segment of an audit; (2) directing the work of staff auditors; (3) instructing them in the work to be performed; and (4) reviewing the work done and directing revisions, if necessary. The Senior Auditor makes decisions on all but the most unusual accounting, auditing, and reporting matters and is regularly assigned to other audit engagements in the capacity of senior auditor.

4) Staff Auditor The minimum education requirements include: (a) a bachelor’s degree in accounting or business and (b) 80 hours of continuing education and training in the past two years that meets the government’s CPE requirements, with at least 24 of the 80 hours of continuing education and training in subjects directly related to government auditing, the government environment, or the specific or unique environment in which the audited entity operates. The responsibilities in this category include performing specific audit steps under the supervision of a senior auditor. All activities of the staff auditor are supervised.

5) Audit Specific Specialist(s) The minimum experience requirements include: (a) having thorough knowledge and formal training in the required specific specialty, (b) a high level of experience in applying the specific specialty, and (c) recognized standing in the applicable field. The responsibilities in this category include providing auditors with professional expertise in such areas as health, safety, law, investigations, actuarial science, mining, engineering, appraising, mathematics, statistics, economics, writing, or other specialties that may be needed to plan, develop, and present technical assistance and training, expanded scope audits, economy and efficiency audits, program results audits, full scope audits, financial and compliance audits, indirect cost audits, and other types of audit services (e.g., audit coordination, audit orientation, pre-award surveys, pricing reviews, quality control reviews, evaluations, etc.) This category includes all specific specialties needed to complete assigned tasks that are not covered by the other labor categories in this contract.

6) Statistician This person must be a member in good standing of a recognized professional statistical association as well as have a minimum of six years of current, significant sampling experience in a government audit or program evaluation environment. Demonstrated experience preferably includes the knowledge and ability to design samples that meet Government Auditing Standards and the GAO/CIGIE Financial Audit Manual (FAM) sampling requirements as well as applicable AICPA sampling auditing standards.

Information Systems/Information Technology (IS/IT) skill classifications The IS/IT audit or evaluation classifications include individuals with specialized IS/IT technical knowledge, skills, and abilities who may not be Certified Public Accountants, but who have responsibilities and a level of experience similar to, and who function at a level comparable to partners, managers, senior auditors, or staff auditors. For the purposes of labor classifications, IS/IT auditors who perform routine general application control reviews as well as those who use computer assisted audit techniques are not considered in these classifications, but rather are considered in the accounting, auditing, and related skills classifications as described above.

7) IS/IT Audit Partner (or equivalent title) The minimum education requirements include: (a) a bachelor’s degree or advanced degree(s) in an appropriate technical field, and (b) 80 hours of CPE in the past two years that meets the government’s CPE requirements, with at least 24 of the 80 hours of continuing education and training in subjects directly related to government auditing, the government environment, or the specific or unique environment in which the audited entity operates1. The IS/IT audit partner must be a Certified Information Systems Auditor (CISA) or be a CPA with equivalent experience such as performing general control evaluations of large systems, network security reviews, and extensive review of applications, and must also be actively pursuing the CISA certification. At least ten years technical experience is required, including all of the following areas: 1) IS audit process; 2) IT governance; 3) systems and infrastructure lifecycle management; 4) IT service delivery and support; 5) protection of information assets; and 6) business continuity and disaster recovery. Employee does not necessarily have a proprietary interest in the firm. This person has final authority in the conduct of engagements and full responsibility for the work performed.

8) IS/IT Audit Manager (or equivalent title) The minimum education requirements include: (a) a bachelor’s degree or advanced degree(s) in an appropriate technical field, and (b) 80 hours of CPE in the past two years that meets the government’s CPE requirements, with at least 24 of the 80 hours of continuing education and training in subjects directly related to government auditing, the government environment, or the specific or unique environment in which the audited entity operates1. The IS/IT audit manager must be a Certified Information Systems Auditor (CISA), a Certified Information System Security Professional (CISSP),or be a CPA with equivalent experience such as performing general control evaluations of large system, network security reviews, and extensive review of applications, and must also be actively pursuing the CISA certification. At least five years technical experience is required, including all of the following areas: 1) IS audit process; 2) IT governance; 3) systems and infrastructure lifecycle management; 4) IT service delivery and support; 5) protection of information assets; and 6) business continuity and disaster recovery.

The IS/IT manager is responsible for complex engagements, or the technical aspects of complex engagements, and may oversee two or more engagements simultaneously. He/she has demonstrated ability to assume full responsibility for directing engagements and special assignments. This individual reviews audit documentation and related reports for accuracy and completeness, and conducts discussions with clients about the results of the work performed; directs audit Seniors and Staff; reviews and approves work plans and programs; ensures that assignments are carried out within the budgeted time and within delivery commitments. The IS/IT manager follows the progress of the engagement and helps resolve technical issues as they arise and is regularly assigned to other engagements in a managerial technical capacity.

9) IS/IT Audit Senior (or equivalent title) The minimum education requirements include: (a) a bachelor’s degree in an appropriate technical field, and (b) 80 hours of CPE in the past two years that meets the government’s CPE requirements, with at least 24 of the 80 hours of continuing education and training in subjects directly related to government auditing, the government environment, or the specific or unique environment in which the audited entity operates1. Also, required is at least two years of experience in IS/IT auditing. The IS/IT audit senior performs most assignments with a minimum of supervision; directs the work of staff auditors, instructing them in the work to be performed, reviews the work done and directs revisions, if necessary; and makes decisions on all but the most unusual matters. This person is regularly assigned to other engagements in the capacity of an IS/IT senior auditor.

10) IS/IT Staff Auditor (or equivalent title) The minimum education requirements include a bachelor’s degree in an appropriate technical field and 80 hours of continuing education and training in the past two years that meets the government’s CPE requirements, with at least 24 of the 80 hours of continuing education and training in subjects directly related to government auditing, the government environment, or the specific or unique environment in which the audited entity operates3. There are no minimum experience requirements. This person performs specific procedures under the guidance of a senior auditor. All activities of the IS/IT staff auditor are supervised.

11) IS/IT System Software Specialist The IS/IT System Software Specialist must have at least five years of experience working with systems software in a variety of different environments, including reviews of or installation and implementation of systems software. Experience should include operating systems and access control software, and the ability to read assembler code and related macros as part of the systems software installation and maintenance function. Specialist should have the ability to evaluate installation and implementation of systems software for potential information security exposures.

12) Senior Computer Consultant The Senior Computer Consultant must have at least ten years of experience in computer consulting services, including such areas as system design, hardware and software evaluations, systems management, and systems implementation methods.

13) Junior Computer Consultant The Junior Computer Consultant must have at least five years of experience in computer consulting services, including such areas as systems design, hardware and software evaluations, systems management, and system implementation methods.

As the Contractor adds staff (at any level), or promotes staff, a resume of each individual must be submitted to the Contracting Officer’s Representative (COR) for approval. Each resume shall include a description of the Contractor’s intended use of the individual performing work (e.g., partner, manager, etc.), provide sufficient information that documents that that the individual meets the qualification requirements contained in this Section and includes specific qualifications, include the following: experience in conducting financial statement audits in accordance with applicable audit requirements/guidance; experience in conducting Federal, State, Local, and/or private sector financial statement audits; total years of general audit experience and years of relevant experience (e.g., Federal); CPA, CISA, CISSP, CIA, CGAP, and other relevant certifications and credentials; date, school name, and type of education, (e.g., degree and major); and a detailed listing of continuing professional education (CPE) courses, which include the following: CPE program sponsor name, course title, course field of study, date completed, type of instructional/delivery method used, amount of CPE credit recommended, and amount of CPE credit in subjects directly related to government auditing, the government environment, or the specific or unique environment in which the audited entity operates. For instructor CPE credit, the CPA claiming CPE credits should comply with respective state board requirements.

1.B. Suitability Clearances In order to perform work on the contract, all Contractor personnel must have a completed and favorably adjudicated background investigation or a security clearance, which is required by Treasury Security Manual – TD P 15-71, Chapter II, Section 2, Investigative Requirements for Federal Employees, Contractors, Subcontractors, Experts, Consultants and Paid/Unpaid Interns (Attachment 9). Therefore, Contractor personnel performing work under this contract are subject to a background investigation, whether or not the position requires a security clearance, to determine their suitability and fitness for OIG work and the investigation must be favorably adjudicated. The minimum requirements and standards to properly determine the required background investigation is based on the sensitivity and risk level commensurate with public trust responsibilities and the potential adverse impact upon National Security that the Contractor could effect; however, the minimum background investigation will be a Tier 2. The level to which such Contractors, subcontractors, experts, consultants, and paid/unpaid interns are investigated shall be comparable to that required for Federal employees who occupy the same positions and who have the same position sensitivity designation. Such standards require Contractor’s personnel to execute appropriate security forms though the Electronic Questionnaires for Investigations Processing (e-QIP) system (a web-based automated system that allows the user to electronically enter, update and transmit their personal investigative data over a secure internet connection to a requesting agency) prescribed by the Treasury/auditee personnel security component. Background investigations to include a search of records of the Federal Bureau of Investigation, including a fingerprint-based search[footnoteRef:2], and any other appropriate biometric or database searches not precluded by law. A credit check (search of the records of commercial credit reporting agencies) will be done by the National Background Investigations Bureau (see Part 2 for additional bureau-specific requirements). The cost and performance of a favorably adjudicated Tier 2 federal background investigation is the responsibility of the OIG; however, the cost and performance of Tier 3 background, re-investigations, and clearances are the responsibility of the contractor and must be handled via the Defense Counterintelligence and Security Agency (DCSA), not the OIG. If a Contractor employee has been the subject of a valid background investigation by another Federal investigative agency, the OIG may accept certification from the agency if it meets OIG requirements. During each period of performance or as the Contractor adds staff (at any level), the Contractor, on Company letterhead, will send the OIG Personnel Security Officer the individual’s full name, date and place of birth, citizenship, social security number, date of last background investigation, type of background investigation or clearance level, and date clearance granted in order to verify that all personnel working under this contract possess the minimum federal background investigation. Once the OIG Personnel Security Officer receives this information, he (or she) will verify whether or not the person has a completed and favorably adjudicated background investigation or a security clearance. The form that initiates a background investigation is the Contractor Processing Request Form and OF-306 (Attachment 11). [2: Executive Order 13467, as amended, requires that all Federal employees, military members, or contractors be fingerprinted.]

Standards are established for investigations to determine eligibility for logical and physical access, suitability for Government employment, eligibility for access to classified information, eligibility to hold a sensitive position, and fitness to perform work or on behalf of the Government as a Contractor employee. These standards are consistent with Executive Order 13467, Reforming Processes Related to Suitability for Government Employment, Fitness for Contractor Employees, and Eligibility for Access to Classified National Security Information, amended by Executive Order 13764, Amending the Civil Service Rules, Executive Order 13488, and Executive Order 13467 To Modernize the Executive Branch-Wide Governance Structure and Processes for Security Clearances, Suitability and Fitness for Employment, and Credentialing, and Related Matters.

In accordance with the Treasury Security Manual (TD P 15-71, Chapter II, Section 2, Paragraph 5a and b Citizenship Requirements) (see Attachment 9) "Federal employees, Contractors, subcontractors, experts, consultants, and paid/unpaid interns hired for work within the United States or its territories and possessions and who require access to DO/bureau-owned or controlled facilities, IT systems or security items or products, shall either be U.S. citizens or have lawful permanent resident alien status (green card holders). DO/bureaus shall adhere to the following standard when allowing Federal employees, Contractors, subcontractors, experts, consultants, and paid/unpaid interns access to DO/bureau-owned or -controlled facilities, IT systems, or security items or products. (1) Low Risk = U.S. Citizen or lawful Permanent Resident Alien. (2) Moderate Risk = U.S. Citizen or lawful Permanent Resident Alien with at least three or more years of U.S. residency from the date of legal entry to the U.S. (3) High Risk = U.S. Citizen." There will be no exceptions to this policy. There is no waiver policy regarding non-citizens without lawful permanent resident status. [Citizenship requirements are contained in TD P 15-71, Chapter II, Section 2, Paragraph 5.] Sensitivity and Risk Level and Clearance Level are contained in PART 2 If there are questions concerning the suitability of a Contractor employee during the pre-screening process or once the background investigation is completed, notification and an opportunity to respond will be provided to the contract employee. If the contract employee is found unsuitable, the Contractor employee will be promptly removed from his/her duties under the contract and a replacement will be requested.

In the absence of a written waiver by Contractor personnel, the provisions of the Privacy Act of 1974 (5 U.S.C. 552a) may preclude discussion of the details of background investigation(s) and/or COR action with the Contractor.

1.C. Audit Documentation The Contractor will develop complete and accurate audit documentation in sufficient detail to provide a clear understanding of the work performed (including the nature, timing, extent, and results of audit procedures performed), audit evidence obtained, and its source, and support conclusions reached in accordance with documentation requirements included in GAO/CIGIE FAM and AICPA Standards. After the tasks are completed, the Contractor will provide OIG with copies of any requested audit documentation (including electronic files, notes and other workpapers) that were created in performing this contract. Audit documentation shall be retained and safeguarded for a minimum of 6 years by the Contractor at no additional cost. Written authorization must be obtained from the OIG prior to destruction of any audit documentation.

For each audit finding, the Contractor will prepare and submit to the COR Notice(s) of Findings and Recommendations (NFR) that will show the condition, criteria, cause and effect (in accordance with Government Auditing Standards, Standards for Financial Audits, Findings), and recommendations for corrective action. The NFR should also show the source of information, be cross-referenced to the pertinent supporting documentation, and to the applicable sections of required reports. The NFR is used to notify the audited organization in writing of potential internal control deficiencies or instances of noncompliance and to obtain their written concurrence or non-concurrence with the facts or conditions found or the applicable criteria. A process control record is to be maintained by the Contractor over all NFRs issued, approvals obtained and their disposition. The Contractor should also refer to related NFRs for the same audit subject or functional area as well as prepare a NFR summary, where several NFRs are being used to support either a significant deficiency or material weakness.

The COR or OIG representatives (the audit manager and director responsible for the task engagement) will have access to the Contractor’s audit documentation during and subsequent to the completion of the audit. Based upon the results of this review, the Contractor may be required to perform corrective or additional work within the engagement scope, which will be performed at the Contractor’s expense.

At the request of the OIG or his/her representative, the Contractor will provide, within three working days of request, a copy of any requested audit documentation (including electronic files, notes and other workpapers) created in performing the audit. Accordingly, during and subsequent to the course of the audit, the Contractor’s audit reports and audit documentation will be subject to access and review by the OIG and the Government Accountability Office (GAO) or other interested parties, as authorized by the OIG.

In the event the auditor is required by law, rule, regulation or Legal Demand in a proceeding or investigation to which the auditor is not a named party or respondent, to produce documents or personnel as witnesses or for interviews, or otherwise to make information relating to the service under the contract available to a third party not the OIG or the Government Accountability Office, the Department of the Treasury and COR agrees to discuss, in good faith, reimbursement of the auditor for its professional time at its then current standard hourly rates, and expenses, including reasonable attorneys’ fees and expenses, incurred in producing documents or personnel or providing information pursuant to such requests requirements which, should the parties mutually agree upon reimbursement and upon a sum certain for such reimbursement, will be reflected in a contract modification, consistent with applicable law and subject to the availability of appropriated funds. Please note that the contractor must understand that these types of meetings are ONLY discussions and NOT negotiations. The Contracting Officer is the ONLY person who can negotiate on behalf of the government. Negotiations conducted by any other individual will result in an Unauthorized Commitment which must be ratified by the Office of the Procurement Executive (OPE) or their designee.

1.D. Quality Assurance Plan The quality assurance method is included in the deliverable schedule. When conducting the inspection, the COR will review the deliverables in accordance with applicable standards and guidance including the GAO/CIGIE FAM and audit and information technology checklists.

1.E. Confidentiality of Data and Conflict of Interest Due to the sensitivity and confidentiality of much of the data handled by the Treasury, the Contractor will maintain confidentiality of all documents, data, and other information supplied to it by Treasury, in accordance with all applicable Federal guidelines and regulations. The Contractor agrees, in the performance of this contract, to keep all information obtained or otherwise reviewed as a result of this contract in the strictest of confidence. The Contractor acquires no possessory and no proprietary interests in such information. The Contractor agrees not to disclose any confidential information concerning the work under this contract to any persons or entities unless prior written approval is obtained from the Contracting Officer. The OIG acknowledges that Contractor must comply with professional standards, including Rule 1.700, Confidential Information of the AICPA Code of Professional Conduct. Furthermore, the OIG acknowledges that Contractor may be required to provide information in one or more of the following circumstances related to the Contractor's performance under this contract: (a) review of Contractor’s professional practice under AICPA or state CPA society or Board of Accountancy authorization; or, (b) Contractor initiating a complaint with or responding to any inquiry made by, the professional ethics division or trial board of the AICPA or a duly constituted investigative or disciplinary body of a state CPA society or Board of Accountancy. The Contractor agrees not to publish, reproduce, or otherwise divulge such information in whole or in part, in any manner or form, at any time, during or following contract performance, nor to authorize or permit others to do so. The Contractor agrees to take such reasonable measures as are necessary to restrict access to such information to those employees of the Contractor needing such information to perform the work provided in this contract, on a “need to know” basis. The Contractor agrees to immediately notify the Contracting Officer, COR, and Bureau Task Monitor in the event that he or she determines or has reason to suspect a breach of any of these requirements or restrictions, and to provide written notification as soon as possible.

Confidentiality is essential to satisfactory performance. The Contractor will prevent any person other than the Contractor’s team members (or other person for whom access is necessary for the completion of the contract) from seeing or having access to information in the possession or under the control of the Contractor. The Contractor will prevent any person from disclosing the contents or description of documents, data, or information to any person not authorized under this contract by the Treasury to have access to such documents or information. The Contractor will prevent removal of any documents, data, or information from the Contractor’s premises without authorization by appropriate Treasury officials. All stored Treasury information shall be protected with NIST or NSA approved encryption when taken outside of the Treasury-controlled spaces.

1) Each Contractor employee performing work under this contract shall sign and submit a Conditional Access to Sensitive Information Non-Disclosure Agreement (Attachment 2) that complies with the Department of the Treasury Security Manual (TD P 15-71), which identifies what is required of the Contractor with respect to non-disclosure of certain information and the penalties associated with noncompliance with those requirements. The Contractor shall provide the signed Non-Disclosure Agreements to the COR within five working days prior to commencing work. No Contractor employee shall begin work under this contract until the COR has accepted his/her Non-Disclosure Agreement (also see Part 2 for additional bureau-specific confidentiality requirements). The Contractor agrees to include similar requirements in any subcontracts which it may enter into regarding or supporting work under this contract. The Contractor will report to the COR any breach of confidence by any person as soon as the breach is known.

2) The Contractor performing work under this contract shall sign a Declaration of Independence and Conflict of Interest Statement (Attachment 3), which identifies what is required of the Contractor with respect to conflict of interest concerns and the penalties associated with noncompliance with those requirements. The Contractor shall provide the signed declaration to the Contracting Officer with the proposal, and in each succeeding option period to the OIG. The Contractor agrees to include similar requirements in any subcontracts which it may enter into regarding or supporting work under this contract.

3) The Contractor shall disclose in its proposal the identity of all contracts, ongoing and completed during the past three years, with any Treasury bureau or component, and in each succeeding option period to the OIG. The Contractor shall provide the Contracting Officer, with a copy to the OIG, with additional information concerning the work performed under specific contracts to the extent the Contracting Officer needs such additional information to make a determination of conflict of interest.

4) The Contractor shall notify the Contracting Officer in writing, with a copy to the OIG, if at any time during the performance of work under this contract, the Contractor begins the process of entering into an order with any Treasury bureau or component. The Contracting Officer will then issue a written determination as to whether the new order poses a conflict of interest. If the Contracting Officer determines that a conflict of interest exists, the Contractor shall defer the new work for the Treasury bureau or component.

5) Each Contractor employee performing work under this contract with access to Treasury or DO information or systems are subject to the Treasury Information Technology Security Program [Treasury Directive Publication 85-01, Volume I, Unclassified (Security Manual), and shall take an annual IT security awareness training course[footnoteRef:3] and annual privacy awareness training that fulfills Federal Information Security Modernization Act of 2014 (FISMA) requirements and provide the OIG (or designated representative) with verification of completion of training. [3: The annual security refresher training for Tier 3 will be handled by DCSA; not the OIG;]

If the Contractor is deemed not independent or not objective with respect to the Auditee, the Contractor will not be eligible for this contract. The government will determine whether the firm is independent for the purpose of performing an audit of financial statements or an attestation of the federal entity.

6) The following data protection requirements apply to all audit or evaluation work done in performance of this contract.

a) Email transmission or receipt of sensitive documents or sensitive information[footnoteRef:4] [4: Although most Treasury information uses the Sensitive But Unclassified (sensitive) markings, sensitive information under this definition may include items marked For Official Use Only, Critical Infrastructure Sensitive, Limited Official Use, Controlled Unclassified Information, Sensitive, and other designations indicating a document requires special care due to the sensitive nature of its contents. ]

(1) Contractor must use the OIG furnished email account for all correspondences pertaining or containing sensitive documents or sensitive information.

(2) Prior to initiating field work, Contractor must issue a single notification in writing to the Treasury or bureau points-of-contact assigned to the engagement that any requested sensitive documents or sensitive information from the auditee be sent to the OIG furnished email account (unless a secure bureau SharePoint site is used).

(3) Contractor must not forward any sensitive information from the government furnished email account to Contractor or non-Treasury email accounts.

b) Contractor’s retention or processing of sensitive documents or sensitive information on OIG’ equipment or network

(1) OIG issued encrypted thumb drives[footnoteRef:5] [5: Almost all bureau documentation is stored on SharePoint, so it’s unlikely that OIG thumb drives will be issued. ]

(a) Contractor must only use the OIG issued encrypted thumb drive(s) in support of the work specified in this contract and in accordance with OIG’s policy for the use of OIG IT resources (Attachment 10).

(b) Contractor must only use the OIG issued encrypted thumb drives to transfer Treasury data between OIG issued encrypted laptop(s) and Treasury owned equipment [i.e., from the bureaus’ systems to the OIG issued encrypted laptop(s)].

(c) Contractor may not use the OIG issued encrypted thumb drive(s) on non-Treasury owned equipment.

(2) Contractor must store OIG issued encrypted thumb drive(s) when not in use at a minimum, in a file cabinet, desk drawer, overhead storage bin, credenza, or similar locked compartment in a room or area with physical access control measures affording adequate protection and preventing unauthorized access by the public, visitors, or other persons without a need-to-know. Examples include, but are not limited to, a key-locked room, or restricted access work area controlled by a cipher lock or card reader.

(3) OIG issued encrypted laptop(s)

(a) Contractor must use OIG issued encrypted laptop(s) to process all sensitive documents or sensitive information in support of this contract

(b) Contractor must only use the OIG issued encrypted laptop(s) in support of the contract and in accordance with OIG’s policy for the use of OIG IT resources (Attachment 10).

(c) Contractor may not connect OIG issued encrypted laptop(s) to any non-Treasury network. Connection to Treasury networks will be based on a bona fide need and written approval from the appropriate Bureau IT government managers must be obtained prior to any connections.

(d) Contractor must store OIG issued encrypted laptop(s) when not in use at a minimum, in a file cabinet, desk drawer, overhead storage bin, credenza, or similar locked compartment in a room or area with physical access control measures affording adequate protection and preventing unauthorized access by the public, visitors, or other persons without a need-to-know. Examples include, but are not limited to, a key-locked room, or restricted access work area controlled by a cipher lock or card reader.

(4) OIG’s network and data storage

(a) Contractor must store all sensitive documents or sensitive information on OIG’s network (SharePoint).

(b) Contractor must only use the OIG’s network in support of the work specified in this contract and in accordance with OIG’s policy.

(5) OIG Remote Access

(a) Availability of remote access will be allowed only with the approval of the COR and the Director for Information Technology based on a demonstrated need to perform work related to this contract.

(b) Contractor must only access and use OIG’s network and resources via VPN account furnished by OIG in support of this contract and in accordance with OIG policy (Attachment 10).

c) Contractor will not retain any sensitive documents or sensitive information on Contractor equipment, network, or offices.

(1) Contractor will not store any Treasury provided material marked sensitive or other sensitive information on Contractor’s equipment, network, or offices. Any such items will be stored and retained under the OIG data retention policy.

(2) Contractor will retain work papers, analysis, annotations (which includes notes based on their review of sensitive or sensitive data), and meeting minutes on Contractor laptops and the Contractor network, in order to support conclusions made in the audit or evaluation reports.

d) Contractor’s processing of non-sensitive Treasury data or non-sensitive information

(1) Contractor may process non-sensitive documents or non-sensitive information on Contractor’s network or computer equipment in performance of this contract.

(2) If the sensitivity of the information is not clearly evident, the Contractor must consult OIG as to what qualifies data or information to be sensitive.

(3) Contractor may use or process non-sensitive documents or non-sensitive information on OIG’s encrypted laptop(s), encrypted thumb drive(s) in support of work specified in this contract and in accordance with OIG’s policy (Attachment 10).

e) Workpapers containing sensitive documents or sensitive information

(1) Sensitive documents or sensitive information that Contractor determines, in its sole discretion, to retain in its work papers shall be stored and retained by OIG. OIG shall notify Contractor in writing of the address at which such work papers are stored and retained and shall notify Contractor, in writing, before any change in the location of the facility at which such work papers are stored and retained. During the term of this contract, Contractor shall have unencumbered access to its work papers containing sensitive documents or sensitive information that are stored and retained by OIG. After the term of the contract, at the request of the Contractor, the OIG will provide, within three working days of Contractor's request, access to any requested work papers containing sensitive documents or sensitive information that are stored and retained by the OIG.

(2) Notwithstanding any other provision of this contract, OIG shall not destroy Contractor's work papers before seven years after the date upon which the Treasury Audit contract is completed, unless it receives written notification from Contractor authorizing such destruction. This period may be extended only upon written notification to the OIG by the Contractor.

(3) OIG agrees to notify Contractor in advance of any access other than by OIG to Contractor’s work papers stored and retained by OIG. OIG further agrees to maintain Contractor’s work papers in a mutually agreeable manner so that Contractor reasonably can determine whether Contractor’s work papers have been accessed by anyone other than OIG without prior advance notification to Contractor.

1.F. Use and Ownership of Computer Software The Contractor will use and conform to computer software products that are compatible to those used by the COR, (we currently use Microsoft Office products and Adobe Acrobat Pro DC; we also have a network license for IDEA). Software products that the OIG does not have a license for can only be used by the contractor if written approval is provided by the COR.

The Contractor may establish claim or copyright all computer software programs, computer data bases, and documents thereof, developed to facilitate, support, or perform under the contract, financial statement compilations, systems development monitoring, database analysis, data collection or the assessment of the reliability of computer processed data. However, the Contractor grants to the Government, a fully paid, nonexclusive, irrevocable worldwide license for all such computer software products to reproduce, prepare derivative works, and perform publicly and display publicly, by or on behalf of the Government.

1.G. Technical Information System Requirements

1) The Contractor agrees to ensure that all electronic files and media used to store or transmit data to the COR and Bureau Task Monitor, are free of computer viruses.

2) All draft and final reports, including attachments, schedules and agency comments, and all other audit deliverables must also be submitted to the COR and Bureau Task Monitor on virus-free media or via email using the OIG’s standard word processing format which is Microsoft Word and or Adobe Acrobat (also see Part 2 Task Requirement Descriptions).

3) Contractors must have access to Internet E-mail and have the ability to send and receive deliverables and E-mail messages via Internet.

4) The Contractor agrees to allow the OIG to post the final audit reports (including related financial statements) on the OIG web site as an attachment to its transmittal and/or other Department/Bureau reports.

1.H. Elimination of Barriers in Information Technology In 1986, Congress amended the Rehabilitation Act of 1973 [Rehabilitation Act Amendments of 1986, Title VI, SEC. 603 (a)], by adding Section 508, Electronic Equipment Accessibility. In 1998, Congress amended the Rehabilitation Act of 1973 (Rehabilitation Act Amendments of 1998, Title IV, P.L. 105-220) by amending Section 508, Electronic and Information Technology, that requires Federal agencies to make their electronic and information technology accessible to people with disabilities. Inaccessible technology interferes with an individual’s ability to obtain and use information quickly and easily. Section 508 was enacted to eliminate barriers in information technology, to make available new opportunities for people with disabilities, and to encourage development of technologies that will help achieve these goals. Accordingly, Section 508 is to be complied with, when applicable (also see Part 2 Task Requirement Descriptions).

1.I. Government Furnished Property The OIG will furnish laptops[footnoteRef:6] and thumb drives with appropriate encryption for Contractor to meet the data protection requirements established in section 1.E.6. Contractor must agree to protect OIG equipment in accordance with OIG Policy Directive 715-04, Acceptable Use of Information Technology Resources (Attachment 10) and sign Appendix A - PD 715-04 Acknowledgement Form contained therein. In addition, to use OIG laptops, Contractor must apply for an OIG PIV Card by completing a Contractor Suitability Processing Request Form TD.15-03.10 (2017.05.05), which requires the submission of Optional Form 306, Declaration for Federal Employment (Attachment 11). The Contractor will be responsible for any costs incurred by the OIG to replace or repair lost or damaged property. The government will provide the Contractor work areas limited to desks, chairs, and data. The Contractor shall provide all other equipment, including computers for all work not covered in section 1.E.6 and supplies.