Draft PWS_SSAE 18_DoD E-ICAM.docx

PERFORMANCE WORK STATEMENT (PWS)

As of 30 July 2024

1. Contracting Officer’s Representative (COR).

a. Primary COR. See DITCO Additional Text G1 - Points of Contact

b. Alternate COR. See DITCO Additional Text G1 - Points of Contact

c. Property Administrator See DITCO Additional Text G1 - Points of Contact

2. Contract or Task Order Title. Auditing Support Services for a Statement on Standards for Attestation Engagements Number 18 (SSAE 18) Examination Report for DISA’s Department of Defense (DoD) Enterprise Identity, Credential, and Access Management (E-ICAM) solution.

3. Background. The Chief Financial Officer’s Act of 1990 (P.L. 101-576), as amended, requires agencies to prepare and have audited financial statements. The American Institute of Certified Public Accountants (AICPA) provides guidance, using a Statement on Standards for Attestation Engagements No. 18 Report, for independent auditors to examine service organizations’ control objectives and control activities to provide information to their customers and their customers’ financial statement auditors about controls that may be relevant to their customers’ financial reporting information system. Consistent with AICPA requirements, the Office of Management and Budget Bulletin No. 14-02, Section 6 “Using a Service Organization,” as amended, requires Chief Financial Officers to ensure compliance with this requirement.

To meet its audit responsibility to user entities, DoD E-ICAM Program Management Office (PMO) shall contract with an Independent Public Accounting (IPA) firm to report on DoD E-ICAM solution in accordance with SSAE 18 guidance. SSAE 18 is an attestation standard regarding service organization, promulgated by the AICPA, and adopted into Generally Accepted Government Auditing Standards (GAGAS). AICPA AT-C320 SSAE 18’s new Sections 105, 205, and 320, standard intent is to reduce the number of auditors viewing the processes within a service organization. Within DoD, DoD E-ICAM is designated as the Department’s primary service organization with respect to enable the right individual to access the right resource, at the right time, for the right reason. The DoD E-ICAM solution deployed within the Microsoft Azure Cloud environments and it is accessible via the Non-secure Internet Protocol Router Network (NIPRNet).

DoD E-ICAM Hub Site: https://dod365.sharepoint-mil.us/sites/DISA-ICAM

Users outside of DoD365-J tenants can access the DoD E-ICAM Hub Site by setting up guest access to the DEOS DOD365-J Hub by requesting access at this link – https://myaccess.microsoft.us/%40dod365.onmicrosoft.us#/access-packages/767a6faf-3bfc-4f2a-b1c7-f86fa9309883

Note: Access package link above is only available for non-DoD365-J users and requires users to have a DoD assigned email address.

SSAE18 allows the Component auditor to use the work of a service organization’s auditor (the service auditor) if the service auditor audited the processes that the Component uses. This enables the Component auditor to reduce the amount of time spent evaluating the internal controls of the service organization. The Component auditor would still have to develop the appropriate tests of the Component’s transactions that processed by the service organization. This attestation will provide for the broad general controls review over the entire DoD E-ICAM environment that will be used by the Component auditors in their reviews of key DoD financial management systems, as well as other DoD business systems.

A SSAE 18 examination is performed when a service organization provides transaction processing or other data processing services to financial applications. A SSAE 18 engagement is designed to provide the DoD E-ICAM financial application customers and their auditors with information about the service organization’s internal control environment. The SSAE 18 attestation engagement is a detailed examination of a service organization’s description of its system applicable to the services that it provides to its customers. SSAE 18 defines a service organization’s system as the policies and procedures designed, implemented, and documented by management to provide user entities with the services addressed by the service auditor’s report. SSAE 18 is applicable to controls that are likely to be relevant to a customer’s internal control over financial reporting.

DoD E-ICAM Inheritable Controls site:

https://dod365.sharepoint-mil.us/sites/DISA-ICAM/SitePages/DoD-E-ICAM-Inheritable-Controls.aspx?csf=1&web=1&e=mEJXVo

The Service Organization Controls (SOC) 1 reports will include a description of the organization controls, as well as detailed testing of those controls. The SSAE 18 report on service organization controls that are relevant to user entities’ internal controls over financial reporting.

4. Objectives: Perform a SSAE 18 examination, following all AICPA and GAGAS standards and mandates, for DoD E-ICAM to provide the appropriate reports and deliverables associated with the audit.

5. Scope. A SOC 1, Type II report shall be required. The report will examine general and application controls applicable to DoD E-ICAM solution. For SOC 1 report, the contractor shall provide in writing a list of exceptions noted and recommendations for improvement. The exceptions noted shall by in the Office of the Under Secretary of Defense (OUSD)-mandated format per Attachment 1.

In performing the SSAE 18 examination, the contractor shall report upon its examination of DoD E-ICAM description of its system applicable to the platform hosting, administration services, that DoD E-ICAM provides to its user entities.

In addition, the contractor’s examination will also report on the suitability of the design of controls to achieve the related control objectives stated in the description and on the operating effectiveness of those controls. A report on management’s description of its system and the suitability of the design and operating effectiveness of controls is referred to as a SSAE 18 Type II report.

The contractor’s examination shall include procedures to obtain reasonable assurance, in all material respects and based on suitable criteria, as to whether:

· Management’s description of its system fairly presents the system that was designed and implemented throughout the specified period. The controls related to the control objectives stated in the aforementioned description were suitably designed throughout the specified period; and the controls selected by the contractor for testing operated effectively to provide reasonable assurance that the control objectives stated in management’s description of its system were achieved throughout the specified period.

· The specified period for the SSAE 18 examination will be October 01 through June 30 for the contract’s option years.

· The specified period for the SSAE 18 examination will be March 01, 2025 through August 30, 2025 for the contract’s base year. This is based on the estimated contract award date of February 28, 2025.

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 15% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to FAR 52.217-8.

6. Performance Requirements.

a. The contractor shall perform the SSAE 18 examinations in accordance with standards established by the AICPA and GAGAS. The contractor shall use the Government Accountability Office (GAO) Federal Information System Controls Audit Manual, the GAO Financial Audit Manual (FAM), and SSAE 18 to develop the methodology and detailed attestation steps for the SSAE 18 examination.

The contractor shall test nine (9) months of data for the SSAE 18 examination for the contract’s option years.

The contractor shall test six (6) months of data for the SSAE 18 examination for the contract’s base year. This is based on the estimated contract award date of 28 February 2025.

b. In support of SSAE 18 examination, the contractor shall perform general control tests, as well as tests to determine whether a selection of operating environment are configured in accordance with applicable DoD E-ICAM requirements at the in-scope DoD E-ICAM locations. For the purpose of this PWS, ‘operating environments’ are meant to reference Microsoft Azure Cloud East, Microsoft Azure Cloud South, and Microsoft Azure Cloud West.

For the controls testing supporting the SSAE 18 examination, the contractor shall select item samples in consideration of FAM 450, ‘‘Sampling Control Tests.”

c. In support of the contractor’s selection of operating environments subject to general control and Security Technical Implementation Guides (STIG)/Security Requirement Guides (SRG) compliance testing, DoD E-ICAM Program Management Office (PMO) will provide the contractor a complete listing of financial applications and information about the operating environments and devices used to host the applications at the in-scope DoD E-ICAM locations no later than 30-days after the contract award/option is exercised. The application listing will be prepared to indicate financial application owners (i.e., DoD E-ICAM customers) who are preparing to and/or performing financial statement audits.

d. In support of the contractor’s planning and testing phase activities, DoD E-ICAM PMO will provide the contractor a calendar of available/unavailable site visit dates (“blackout calendar”) for all DISA in scope locations within fourteen (14) calendar days after the contract award/ option is exercised. The blackout calendar will reflect all available/unavailable site visit dates from November through June following the date the contract award/option is exercised. In support of the contractor’s planning and testing phase activities, DoD E-ICAM PMO will provide items requested on the Document Request List (DRL) within three (3) weeks of initial request. Items requested in support of the planning phase shall be provided no later than three (3) weeks from initial request. Items requested in support of the testing phase shall be provided no later than three (3) weeks from initial request.

e. The contractor shall select a sample of operating environments from the listing discussed above. The sample size will be based on a number of factors, including the total number of operating environments, and which operating environments are used to host financial applications subject to financial statement audits and financial statement audit readiness activities. As a result, platform specific sample sizes could vary based on the type of platform. The contractor will perform testing on automated and manual Category I findings identified from the results of the System Readiness Reviews to determine each selected operating environment’s compliance with STIGs/SRGs and Security Checklists. The results of the compliance testing procedures described in this paragraph will not be used to project across the entire universe of DoD E-ICAM managed platforms.

f. In its role as the independent public auditor responsible for conducting the SSAE 18 examination in accordance with relevant AICPA standards and GAGAS, the contractor shall have final authority and approval rights regarding the following aspects of the SSAE 18 examination:

· Strategic and tactical decisions associated with the planning the SSAE 18 examinations including the form and content of SSAE 18 attestation audit plans and detailed test plans.

· Decisions associated with the conduct of SSAE 18 examinations audit test procedures, including the selection testing approaches, evaluations of the sufficiency of evidence, evaluations of exceptions, weaknesses, and instances of potential non- compliance.

· Development of conclusions; and form and content of contractor prepared audit documentation.

· Conclusions and the opinions included in the SOC 1 Report

· The form and content of the SOC 1 Report, with the exception of content provided by DoD E-ICAM PMO.

6.1 Task 1 -Planning Phase: The following deliverables shall be completed during the planning phase:

6.1.1 Subtask 1 - SSAE 18 ATTESTATION PLAN FOR DoD E-ICAM. The contractor shall make available to the Contracting Officer Representative (COR) a draft attestation plan no later than 30 days following the date the contract award/option is exercised and a final attestation plan no later than 60 days following the date the contract award/option is exercised. The attestation plan must identify the proposed approach and time schedule for the evaluations and reporting phases including milestones and due dates (planning, sampling, testing, and/or reporting). The contractor shall develop an attestation plan to evaluate the fairness of the presentation of management’s description of the service organization’s system, and the suitability of the design and operating effectiveness of controls to achieve management’s control objectives included in the description throughout the specified period. The attestation plan must also include the assessment approach, scope, methodology, nature and type of testing, qualitative measurement standards, and reporting requirements that achieve the assessment objectives in a cost effective and timely manner. The COR is responsible for reviewing the attestation plan. The COR will provide recommendations/requests back to the contractor within seven (7) business days after receipt of the draft and final attestation plans. The contractor shall consider and provide responses to the COR’s recommendations/requests and make available a final revised document to the COR, if necessary, before the contractor proceeds into the testing phase.

6.1.2 Subtask 2 - SSAE 18 TEST PLAN FOR DoD E-ICAM. The contractor shall make available to the COR a draft SSAE 18 test plan no later than 30 days following the date the contract award/option is exercised and a final test plan no later than 60 days following the date the contract award/option is exercised. The SSAE 18 test plan will also include the sampling methodology to be used during the testing phase. As required by GAO-12-331G, ‘‘Government Auditing Standards” (commonly known as “the Yellow Book”), which sets forth GAGAS, the contractor shall, when possible and with the approval of the COR, rely on the work of others that falls within the scope and objectives of this task order. The SSAE 18 test plan must include sufficient procedures to provide a basis for reliance on the work of others. The SSAE 18 test plan shall also include test procedures to assist the user auditors in determining the extent that the internal controls can be relied upon, as well as the general sampling approach. Testing procedures will include DoD E-ICAM controls over network and system security as well as procedures to assess fairness of presentation, suitability of design and operating effectiveness for each control description. The COR is responsible for reviewing the SSAE 18 test plan. The COR will provide recommendations back to the contractor within seven (7) business days after receipt of the contractor’s draft SSAE 18 test plan. The SSAE 18 test plan must be documented, kept current, and made available to the COR. The contractor shall not begin the testing phase until the COR has reviewed and approved the final SSAE 18 attestation and test plans.

6.1.3 Subtask 3 - KICKOFF AND ENTRANCE CONFERENCE. The contractor shall hold a kick- off meeting with the COR and DoD E-ICAM personnel within fourteen (14) business days following the date the contract award/option is exercised. The kickoff meeting will provide the contractor an opportunity to discuss contractual requirements and security requirements with the COR. The entrance conference will provide the opportunity to discuss requirements for the SSAE 18 examinations, and to plan site visits. The contractor shall submit an agenda for the kickoff/entrance conference to the COR for review and the issuance of recommendations/requests at least seven (7) business days prior to the kickoff/entrance conference. Within seven (7) business days after the kickoff meeting and the entrance conference, the contractor shall provide the COR with the meeting minutes and the list of attendees.

6.1.4 Subtask 4 – PLANNING SUMMARY WORKPAPERS. The contractor shall make available to the COR a summary work paper of the overall results of procedures performed and preliminary observations reached during the planning phase of SSAE 18 examinations. The summary work papers shall be cross referenced to detailed work papers and supporting audit documentation to enable an independent reviewer to understand fully the work performed and the conclusions reached because of the work performed. The contractor shall provide the COR with the summary work papers and supporting audit documentation within seven (7) business days after the completion of the planning phase. The COR is responsible for reviewing and providing recommendations/requests for the summary work papers for the planning phase within seven (7) business days after receipt. The contractor shall consider the recommendations/requests provided by the COR and, if determined necessary, provide responses and/or revised work papers to the COR. The review and response timeframe for this deliverable shall not exceed fifteen (15) business days from the date of the initial receipt by the COR.

6.1.5 Subtask 5 – CONTROL-SPECIFIC PLANNING WORK PAPERS. The contractor shall make available to the COR control-specific planning work papers created to support the planning phases of SSAE 18 examinations. The control- specific planning work papers shall be used to document the contractor’s confirmation of existing control processes, as well as changes to the design of controls since at the end of June. The contractor shall make the control-specific planning work papers available to the COR within seven (7) business days after the completion of the planning site visits. The COR will review and provide recommendations/requests within seven (7) business days after receipt. The contractor shall consider the recommendations/requests provided by the COR and, if determined necessary, provide responses and/or make available revised control-specific planning work papers to the COR. The review and response timeframe for these deliverables shall not exceed fifteen (15) business days from the date of the initial receipt by the COR.

6.1.6 Subtask 6 – SENIOR In Process Review (IPR)- PLANNING. The contractor will brief DoD E-ICAM Senior Management on results of planning. The contractor shall submit an agenda for DoD E-ICAM Senior Management Planning IPR to the COR for review and the issuance of recommendations/requests at least two (2) business days prior to the IPR. Within five (5) business days after the one-day IPR, the contractor shall provide the COR with the meeting minutes and the list of attendees.

6.1.7 Subtask 7 – AUDIT STAFF. The contractor shall provide a mix of labor categories to meet the requirements of the PWS tasks of the assigned audit staff. The COR will evaluate the contractor’s ability to ensure initial and continuing availability of the required expertise, skills, and capacity to meet all the audit requirements and provide appropriate oversight of the work that will be completed under this order. In addition to the technical quotation and un-sanitized price quotation, a sanitized price quotation including only the number of full-time equivalents, labor categories, and number of labor hours, broken out by task area, shall be submitted with the quote and will be considered under this subfactor. The contractor shall provide generic resumes for key personnel identified in Reference PWS Language. Generic resumes shall include years of employment; experience in chronological order including narrative description of duties and responsibilities; education, degree or certification earned, and year for all degrees or certifications earned; and the current level of security clearance and status (final, interim, or pending). Generic resumes, without names, shall be provided for each labor category for key personnel reflected in Reference PWS Language. Individual's names shall not be included within the technical quote nor on the generic resumes.

In addition to addressing the expertise as described for each position defined in Reference PWS 11 Language, Key Personnel, the contractor shall address in sufficient detail key personnel as a task lead to correspond to every task identified in Reference PWS. The contractor shall highlight the resume portions that indicate recent, relevant (within the last five years) technical and operational work experience and expertise with list Audit specific information that is directly transferrable.

After contract award, the contractor shall follow the terms of the Additional DITCO Instructions H3 Key Personnel in addition as well as not add, delete, or substitute assigned key personnel without prior written approval from the COR ten (10) business days in advance. Such approval shall not be unreasonably withheld. The contractor will not be paid for non-approved assigned staff individuals billed to the task order unless authorized in writing by the COR. In the event there is a disagreement between the COR and the contractor for the approval or disapproval of staff proposed for assignment on this task order, the Contracting Officer shall make the final decision.

6.1.8 Subtask 8 – AUDIT DOCUMENTATION. Upon task order award, the contractor must provide the latest copy of the firm’s peer review report and associated documentation, if applicable IAW DoDM 7600.07-M, “DoD Audit Manual,” Enclosure 14, Para 5b(2). Contractor shall provide statement prior to contract award that the firm is not currently doing work for the DoD Component that would impair its independence IAW DoDM 7600.07-M, “DoD Audit Manual,” Enclosure 14, Para 5b(3). The DoDIG and GAO will have access to the contractor’s audit documentation, electronic or hard copy. This includes obtaining all the audit documentation in either electronic or hard copies provided at no expense to the government IAW DoDM 7600.07-M, “DoD Audit Manual,” Enclosure 14, Para 5b(8).

Deliverables:

Plan for DoD

E-ICAM

Microsoft Office M365 Compatible Draft –No later than (NLT) 30 days following the date the contract award/option is exercised.

Final –NLT 60 days following the date the contract award/option is exercised.

Final – 7 business days for COR review.

Test Plan for DoD

E-ICAM

Microsoft Office M365 Compatible Draft –NLT 30 days following the date the contract award/option is exercised.

Final –NLT 60 days following the date the contract award/option is exercised.

Final – 7 business days for COR review.

Entrance Conference Microsoft Office M365 Compatible Conference Line Meeting NLT 14 days following the date the contract award/option is exercised.

Agenda NLT 2 days prior to meeting

*Standard Distribution 7 business days for COR review; total review and response timeframe not to exceed 15 business days

Specific Planning Work Papers Microsoft Office M365 Compatible NLT seven (7) business days after the completion of the planning for the operating environments examination

*Standard Distribution 7 business days for COR review; total review and response timeframe not to exceed 15 business days

IPR

Microsoft Office M365 Compatible Conference Line Agenda NLT two (2) business days prior to IPR

Meeting Minutes/Attendee List to COR – within 5 business days after IPR

*Standard Distribution Provide COR with meeting minutes and list of attendees NLT 5 business days after the IPR

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.2 Task 2. The following deliverables shall be completed during the testing phase:

6.2.1 Subtask 1 – CONTROL-SPECIFIC TESTING WORK PAPERS. The contractor will develop controls specific testing work papers supporting the SSAE 18 examinations for each control listed in the SSAE 18 test plans. Control-specific testing work papers used to document the contractor’s procedures performed in support of the SSAE 18 examination will include (1) the auditor’s assessment as to whether the controls are fairly presented, suitably designed, and operating effectively and (2) documentation of the tests of general controls and the results and conclusions related to the procedures performed, including condition, cause, criteria, and effect. Control- specific testing work papers may support both the SSAE 18 examinations and thus will contain a combination of the above. Because stand-alone work paper sets shall be maintained by the contractor to separately support the SSAE 18 examinations, such dual-purpose work papers shall be maintained in duplicate within each independent work paper set. There shall be no cross referencing between work paper sets. All control specific testing work papers must be properly cross referenced to supporting audit documentation. Control specific testing work papers and supporting audit documentation shall be made available to the COR within ten (10) business days after all supporting documentation for that control has been received.

All control-specific testing work papers and supporting work papers completed during the testing phase must be made available to the COR within ten (10) business days after phase completion. The COR will provide recommendations/requests back to the contractor within seven (7) business days after initial receipt of the site-specific control testing work papers. The contractor shall consider the recommendations/requests provided by the COR and, if determined necessary, provide responses and/or make available revised control-specific control testing work papers to the COR. The review and response timeframe for these deliverables shall not exceed fifteen (15) business days from the date of the initial receipt by the COR.

6.2.2 Subtask 2 - CONTROL OBJECTIVE SUMMARY WORK PAPERS. In support of the SSAE 18 examination, the contractor shall develop and provide control objective summary work papers for each in scope SSAE 18 control objective:

· Documenting the auditor’s assessment as to whether the general controls are fairly presented, suitably designed, and operating effectively during the specified period; and

· Documenting the tests of general controls and the results and conclusions related to the procedures performed, including condition, criteria, cause, effect, and suggested improvement of general control weaknesses.

All control objective summary work papers must be properly cross- referenced to supporting audit documentation. In the control, objective summary work papers, the contractor shall also suggest improvements for audit documentation supporting the procedures used for general and application control testing and general and application control weaknesses identified. Control objective summary work papers and supporting audit documentation for each site shall be made available to the COR within fourteen (14) business days after each site visit is concluded.

All control objective summary work papers and supporting work papers for each site visited during the testing phase must be made available to the COR within fifteen (15) business days after phase completion. The COR is responsible for reviewing and providing recommendations/requests on the control objective summary work papers and review all work papers supporting the summary work papers. The COR will provide recommendations/requests back to the contractor within seven (7) business days after initial receipt of the control objective summary work papers. The contractor shall consider the recommendations/requests provided by the COR and, provide responses and/or make available revised control objective summary work papers to the COR. The review and response timeframe for the control objective summary work papers shall not exceed fifteen (15) business days from the date of the initial receipt by the COR.

6.2.3 Subtask 3 - SENIOR IPR-TESTING. The contractor will brief DoD E-ICAM PMO Senior Management on results of testing. The contractor shall submit an agenda for DISA Senior Management Testing IPR to the COR for review and the issuance of recommendations/requests at least two (2) business days prior to the IPR. Within five (5) business days after the one-day Testing IPR, the contractor shall provide the COR with the meeting minutes and the list of attendees.

6.2.4 Subtask 4 - EXIT CONFERENCE. The contractor shall hold a formal exit conference for the SSAE 18 examinations with DoD E-ICAM Senior Leaders that sign the final SOC1 report and the COR no later than the first week of August. The contractor will lead this meeting, with input and participation from DoD E-ICAM PMO. The exit conference will allow the contractor to report on the results of the SSAE 18 examinations. The contractor shall determine the specific date of the exit conference with input from the COR. The contractor shall submit the agenda and briefing materials to the COR and DISA OC management for review and the issuance of recommendations/requests at least two (2) business days prior to the exit conference. The briefing materials for the exit conference will be in writing and be in such detail to discuss findings and recommendations. The contractor shall provide meeting minutes and a list of attendees to the COR within five (5) business days after the exit conference.

Deliverables:

Office M365 Compatible No later than (NLT) ten (10) business days after all supporting documentation for that control has been received.

review; total review and response timeframe not to exceed 15 business days

Office M365 Compatible NLT fourteen (14) business days after operating environments examination

review; total review and response timeframe not to exceed 15 business days

Office M365 Compatible Conference Line Agenda to COR 2 business days prior to conference

Meeting Minutes Attendee List to COR within 5 business days after conference

Office M365 Compatible Conference Line Agenda to COR 2 business days prior to IPR

Meeting Minutes, Attendee List to COR within 5 business days after IPR

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.3 Task 3. The following deliverables shall be completed during the reporting phase:

6.3.1 Subtask 1 - SSAE 18 SOC 1, TYPE II REPORT FOR DoD E-ICAM. The contractor shall prepare an SSAE 18 SOC 1, Type II report. In the Type II report, the contractor shall provide an opinion for the specified period, which is October 1 to June 30. The contractor shall provide an opinion as to whether:

· Management’s description of its system fairly presents the system that was designed and implemented throughout the specified period, ‘‘STATEMENT ON STANDARDS FOR ATTESTATION ENGAGEMENTS (SSAE) NO. 18 EXAMINATION’’.

· The controls related to the control objectives stated in the aforementioned description were suitably designed throughout the specified period.

· The controls selected by the contractor for testing operated effectively to provide reasonable assurance that the control objectives stated in management’s description of its system were achieved throughout the specified period.

The contractor will render the opinion based on the examination procedures and results. The contractor shall provide the COR with a draft SSAE 18 attestation report package by mid-July. The report package must include a SOC1 report and a management representation letter. In addition, the contractor will make available to the COR a separate, cross-referenced version of the draft SOC1 report. The COR is responsible for reviewing and making recommendations/requests on the draft SOC1 report. The COR will review and provide recommendations/requests to the contractor within five (5) business days after receipt. The contractor shall provide the final attestation report to the head of the DoD Component and Audit Committee, if one exists IAW DoDM 7600.07-M, DoD Audit Manual,” Enclosure 14, Para 5b(7) by first business day of August. All contractor audit documentation related to the SOC1 report shall be finalized by end of July.

Attachment 1: Notice of Findings and Recommendations (NFRs) for SSAE18s: General Reporting Requirements

NFRs will be prepared by an IPA as the mechanism of communication findings throughout any phase of the SSAE 18 examination. The NFR, at a minimum, shall contain a description of the (a) condition, (b) criteria, (c) effect, (d) cause, (e) recommendation, and (f) indication whether the NFR is a repeat finding from a previous year. The NFR numbering shall be unique enough as to not have duplicated numbering of NFRs between multiple fiscal years. The IPA shall provide the documented NFRs to the Service Organization Management and OUSD (C) FIAR Office and may use the IPA’s NFR format and protocols. The IPA shall provide both the Service Organization Control Report (SOC) and NFRs (final signed version) to Service Organization Management and OUSD (C) FIAR Office as soon as each is available.

In addition, the IPA shall report conditions or concerns that the IPA does not consider to be a finding but are of sufficient importance in the overall internal control structure of the SSAE 18 examination to require management’s attention. This would be provided no later than in the exit conference-briefing documents to the Service Organization Management and OUSD (C) FIAR Office.

Additional Reporting Requirements The Office of the Under Secretary of Defense Comptroller (OUSD(C)) has a requirement for all Notice of Findings and Recommendations (NFRs) created by an Independent Public Accounting firm (IPA), to be entered and tracked internally by DoD using an enterprise capability. On October 1, 2017, OUSD(C) deployed an NFR tracking solution and provided accessibility to process owners. In order for DoD to support and maintain the NFR tracking database, in addition to the general reporting requirements, the following shall be provided from the IPAs and included as an attachment to each year’s report in Microsoft Excel:

· In year one of the audit/examination, IPAs will include the required specific elements listed below for all new NFRs and Conditions.

· In subsequent years of the audit/examination, IPAs will update the NFR Status and Condition Status issued previously as necessary.

· In subsequent years of the audit/examination, IPAs will continue to include the required elements for all new NFRs and Conditions.

· In subsequent years of the audit/examination, if there is a new Condition associated with a preexisting NFR, the IPA will add a Condition to the preexisting NFR and indicate the fiscal year identified.

The contractor must ensure they have the current template approved by OUSD (C) received from the COR prior to completing the template.

The additional specific fields required for the NFR are:

Reporting Entity.

Report Type.

Report Scope (SSAE 18 Report Title).

IT System.

NFR Title.

IPA NFR Reference ID.

Previous IPA NFR Reference ID.

Fiscal Year.

NFR Issue Type.

NFR Status.

Control Objective/s Impacted by NFR.

Did the Finding Result in Control Objective/s Becoming Ineffective? (Yes/No).

List Control Objective/s that Became Ineffective.

Designate Management Non-Concurrence or Partial Non-Concurrence with NFR

The specific fields required for each individual condition are as follows:

Reporting Entity.

Contributing Command/Organization.

IPA Condition Reference ID.

IPA NFR Reference ID.

Condition Description.

Fiscal Year.

Condition Issue Type.

Condition Status.

Deliverables:

SOC 1,

Type II Report for DoD E-ICAM Secure Portable Document Format (PDF) files Draft report due by mid-July

Final report due by first (1) business day of August

COR Review

Document Format (PDF) files Draft report due by mid-July

Final report due by first (1) business day of August

COR Review

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

Delivery Schedule: Within this PWS, the term ‘audit documentation’ is used in connection with the description of various project deliverables, as well as general documentation requirements associated with the SSAE 18 examinations. The contractor shall submit deliverables in Microsoft Office M365 compatible electronic format, as well as any hard copy documents not included in the electronic files, except for the finalized SOC1 reports, which will be provided in secure Portable Document Format (PDF) files. All deliverables are subject to the COR review. Unless otherwise indicated in this task order, the COR will review and make recommendations/requests on all deliverables within seven (7) business days after submission by the contractor or provide requests for additional information. The contractor shall consider all COR recommendations/requests and, if determined necessary, provide responses and/or revised deliverables to the COR within seven (7) business days from receipt of the COR’s recommendations/requests. The COR will then review any revised deliverables that have been resubmitted by the contractor within 3 business days or provide additional necessary, provide responses and/or revised deliverables to the COR recommendations/requests within three (3) business days of receipt of the COR’s additional recommendations/requests. The timeframe for completion of these activities shall not exceed fifteen (15) business days from the date of the initial receipt by the COR. For all deliverables, the contractor shall possess final authority related to the manner of presentation, organization, and content, with the exception of such content provided by DoD E-ICAM PMO for inclusion in the SSAE 18 report as information provided by the service organization.

7. Performance Standards. The COR will measure, review, and approve the contractor’s performance against GAGAS and other guidance associated with performing the SSAE 18 examinations. The following areas will be focal points for the performance metrics under this task order:

· Attestation/Test Plan - The DISA COR will assess and provide comment on the methodology and procedures for assessing DoD E-ICAM and the risk assessed in accordance with the DoD FMR, DoD Instruction 8500.2, and NIST SP 800-100 and any other applicable guidance. In addition, the DISA COR will evaluate the steps relied upon to complete NIST SP 800 100 testing.

· Audit documentation – The DISA COR will assess and provide comment on the contractors’ preparation of audit documentation in accordance with GAGAS. Audit documentation will include how the work was performed in accordance with GAGAS standards and other guidance. Audit documentation will include cross-referencing from audit programs to supporting work papers and from summary work papers/conclusion memorandum to detailed work papers and supporting audit documentation.

· Draft and Final Reports – The DISA COR will assess and provide comment on the contractor’s review of DISA OC controls and reports in accordance with the GAGAS and other guidance.

Subtasks 6.1.1 – 6.3.1 Testing through Final SOC1 Reports Performance occurs with no required re-performance or rework at least 80% of the time.

Problems that occur are minor and are resolved in a satisfactory manner.

Routine inspection of Deliverable products and services.

8. Incentives. Not Applicable.

9. Place of Performance.

Mission Location: DISA Headquarters located at Ft. Meade MD.

Unclassified Development and programmatic work shall be conducted primarily at the contractor’s site. It is expected that each contractor personnel shall spend 20% of this time at DISA Headquarters located at Ft. Meade MD in meetings and discussing the schedules and other programmatic details with DISA program personnel.

Alternative work sites allow for regular telework or remote work flexibilities. Regardless of where work is performed, the Contractor shall ensure that work is completed effectively and requirements are met, without degradation of services. Also, the contractor may be required to account for the physical location of their personnel should this information be requested by the COR. The Contractor shall propose on-site rates for all work performed at an alternative work site. Incidental charges incurred while working at an alternative work site (e.g., electricity, internet) are not allocable to the contract and shall not be billed to the government.

*Classified work shall be conducted primarily at DISA Headquarters, 6914 Cooper Avenue, Fort Meade, MD 20755. Classified work can be conducted at the contractor’s secret security clearance facility (Block 8, Place of Performance on DD254, once contract is awarded).

Secondary Place of Performance – Contingency Only. As determined by the Contracting Officer’s Representative (COR), contractor employees may be required to work at a secondary place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, government closure due to inclement weather). Additionally, the contractor may be required to account for the physical location of their personnel should this information be requested by the COR. Non-emergency/non-essential contractors should not report to a closed government facility. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

10. Period of Performance. 1-year base period, plus four 1-year option periods after contract award.

In the event of a Government shutdown, and as directed by the COR, the contractor shall continue performance in emergency or mission essential conditions.

11. Security Requirements. This section supplements Block 13 of the Government provided DD Form 254, Contract Security Classification Specification. The following security requirements shall apply to this effort.

NOTE: This Indefinite Delivery Contract’s security requirements/DD254 will cover all future Tasks Orders; DD254s will not be required for individual task orders.

The contractor shall coordinate visits with site Point of Contract (POC)s providing at least a 72-hour notice (or according to each site security requirements) prior to any site access. Contractor personnel without security clearances performing any task under this PWS must be escorted by cleared DISA personnel (civilian, military, or contractor).

References:

1. DISA End User Access Agreement, 11 February 2021

1. DISA Policy Letter, Unauthorized Connections to Network Devices, 11 September 2013

1. DISA Instruction 240-110-8, Information Security

1. DISA Instruction 240-110-36, Personnel Security

1. DISA Instruction 240-110-38, Industrial Security

1. DISA Instruction 240-110-43, Insider Threat Program

1. DISA Instruction 630-230-19, Cybersecurity

1. DoD Manual 5200.01, Vol 1-3 Information Security Program, 24 February 2012

1. DoD Manual 5200.02, Procedures for the DoD Personnel Security Program, 3 April 2017

1. DoD Instruction 5200.48, Controlled Unclassified Information (CUI), 6 March 2020

1. 32 CFR Part 117, “National Industrial Security Program Operating Manual (NISPOM)”, 24 February 2021

1. DoDI 5230.24, “Distribution Statements for DoD Technical Information,” January 10, 2023

11.1 Facility Security Clearance. Work performed under this contract/order is up to the Secret level. Therefore, the company must have a final Secret Facility Clearance from the Defense Counterintelligence and Security Agency Facility Clearance Branch.

11.2 Security Clearance. All personnel performing on or supporting a DISA contract/order in any way shall be U.S. citizens. The personnel security requirements for this contract/order cover the individuals supporting the Task Areas delineated in the table below. Contractor personnel must possess final security clearance eligibility delineated in the table below when performance starts.

The following type of positions require a minimum of final Secret security clearance when performance starts.

- Partner

- Audit Manager

- Senior Auditor

- IT Auditor

- Consultant

11.3 Investigation Requirements.

11.3.1 All personnel requiring Secret access under this contract/order shall undergo a favorably adjudicated Tier 3 (T3) Investigation formerly known as a National Agency Check, Local Agency Check and Credit Check or Access National Agency Check and Inquiries as a minimum investigation. Enrollment into Continuous Evaluation current within 5 years and, reflected in DISS, would meet the requirement for a current PR.

11.3.2 The contractor is required to have personnel cleared with final Secret (as specified in the table located in section 11.2) at contract start date. If contractor personnel is replaced during performance of the contract, replacement personnel should also final clearance Secret (as specified in the table located in section 11.2).

11.4 Visit Authorization Letters (VAL). Visit requests shall be processed and verified through the DISS to Security Management Office (SMO) DKABAA10. (Include other DISS SMO codes as applicable. A complete list of DISA DISS SMO codes can be found at https://dod365.sharepoint-mil.us/Sites/DISA-Security/SitePages/Industrial-Security.aspx). DISS visits for contracts/orders are identified as “Other” or “TAD/TDY” and will include the Contract/Order Number of the contract/order in the Additional Information section. Contractors that do not have access to DISS may submit visit authorizations by e-mail in a password protected .pdf to the COR/ACOR specified in DITCO Additional Text G1 - Points of Contact.

*Prior coordination with the DISA COR should be made via email to ensure the VAL/ Visit Authorization Request (VAR)/ Visit Termination Notification (VTN) process is agreed upon and properly secure.

11.4.1 VAR Package. VARs must be received via email and require pre-approval from the assigned DISA COR five business days in advance of the report date. The VAL/VAR/VTN should be sent via email to the appropriate COR. The VAL/VAR/VTN should be sent using in a locked “Zip” file in one e-mail and then followed-up by another e-mail with the password to unlock the Zipped file, because it contains sensitive information covered by the Privacy Act.

Documents to include in the VAR Package:

1. Inter-office Memorandum (IOM)

2. DD Form 254 Prime and/or Sub (Good Standing approval emails for current option year)

3. Contractor VAL signed by the Contractor Facility Security Officer (FSO)

If DISS is not available, the VAL must contain the following information on company letterhead.

· Company name, address, telephone number, facility security clearance

· CAGE CODE

· Contract/Order Number

· Name, SSN, date and place of birth, and citizenship of the employee intending to visit

· Certification of personnel security clearance and any special access authorizations required for the visit (type of investigation & date and adjudication date & agency)

· Name of COR/Alt COR

· Dates or period the VAL is to be valid

11.4.2 VTN Package. The Contractor FSO will forward a VTN letter to the DISA COR identified in the PWS/TO/Sub for all employees leaving the contract/task order/subcontract.

11.4.2.3 In addition, the DISA CORs and security managers shall inform the…