Draft Requirements Statements FSA.pdf

OCC Flexible Spending Account Plan

Draft Requirements Statement

PART I – GENERAL INFORMATION

1.0 GENERAL

This requirement is for the administration of the Office of the Comptroller of the Currency (OCC Flexible Spending Account (FSA) Plan as described in Part II. The NAICS code for this requirement and resultant contract is 541611 - Administrative Management and General Management Consulting Services, with a small business size standard of $24.5M.

2.0 CONTRACT LINE-ITEM NUMBERS (CLINs)

The item list with service description is available in Block 20, “Supplies and Services” of the SF 1449.

PART II – PERFORMANCE WORK STATEMENT

1.0 PURPOSE

The Office of the Comptroller of the Currency (OCC) was established in 1863 as an independent bureau of the U.S. Department of the Treasury. The OCC is responsible for regulating and supervising the national banking system and federal savings associations. The OCC’s primary mission is to charter, regulate and examine approximately 2,000 national banks as well as 50 federal branches and agencies of foreign banks in the United States, accounting for two thirds of the assets of the commercial banking system.

The OCC currently employs approximately 3,650 employees nationwide. The OCC is headquartered in Washington, DC with servicing human resources offices in Denver, CO and Washington, DC.

OCC has independent authority to offer its own compensation and benefit programs. OCC has developed its programs as a supplement to the federally sponsored benefit programs OCC employees are not permitted to participate in the federally sponsored FSA program provided by FSAFEDS.

OCC employees can only elect to participate in the OCC FSA program.

The OCC FSA, as a governmental plan, is specifically exempt from Title I of Employee Retirement Income Security Act (ERISA).

2.0 SCOPE OF WORK

The OCC is seeking an experienced and qualified Contractor to administer its Flexible Spending Account (FSA) program for its employees. The Contractor shall administer the OCC’s Plan in accordance with Section 125 of the IRS Code and Section 132 of the IRS Code. The Contractor shall provide the following features as part of its FSA management administration services:

Web-based on-line enrollment

Dedicated Plan Administrator Participant account inquiry via the Internet Non-discrimination testing services Direct Debit Card for the Health Care FSA only Electronic claims submission Communication materials Administrative Operating manual

3.0 PLAN DESIGN

The OCC FSA plan includes a Health Care Account, Dependent Care Account, Parking Account with Plan Limits, Plan Year, Grace Period, Claim Filing Deadline and Account Contributions as detailed below. The plan also includes a Life Cycle Account (LCA) benefit feature.

Plan Design Feature Type of Accounts Health Care, Dependent Care and Parking Plan Limits $100 minimum up to the IRS maximum annually for

Health Care and Dependent Care Plan Limit $10 minimum up to IRS monthly maximum for Parking Plan Year January 1 through December 31 Grace Period 2 ½ months Claim Filing Deadline June 15 Account Contributions Pre-tax; Employee and Employer flex credit

3.1 Health Care Account (HCA)

Health care claims are administered in accordance with Section 125 of the IRS Code. At a minimum, the program provides reimbursement through submission of a paper claim by fax or mail, online claim submission, mobile phone application, by scheduling a direct payment to a provider and the use of a Health Care debit card. Reimbursement payments to the employee are made by direct deposit or check. The employee selects the desired method.

3.2 Dependent Care Account (DCA)

Dependent care claims are administered in accordance with Sections 125 and 129 of the IRS Code.

At a minimum, the program provides reimbursement through submission of a paper claim by fax or mail, or online claim submission, or by scheduling a direct payment to a provider. Reimbursement payments to the employee are made by direct deposit or check. The employee selects the desired method.

3.3 Parking FSA

Commuter claims for parking reimbursement are administered in accordance with Section 132 of the IRS Code. At a minimum, the program provides reimbursement through submission of a paper claim by fax or mail or online claim submission. Reimbursement payments to the employee are made by direct deposit or check. The employee selects the desired method. At the end of this contract, Parking FSA balances shall be transferred to a successor Contractor, if the incumbent is not awarded the new contract. The Contractor must exercise its best efforts and cooperation to affect an orderly and efficient transition of funds to a successor Contractor.

3.4 Life Cycle Account (LCA) Benefit

This program provides employees with an annual allowance to enhance their life. The employee can make his/her own choice about what their family needs. The employer contribution is a lump sum amount (which the OCC refers to as a Life Cycle Account benefit) provided to employees that the employee can elect to be deposited into either HCA or DCA

4.0 PERFORMANCE REQUIREMENTS

The Contractor shall have the full responsibility for FSA account management services. The Contractor shall ensure that the Plan design and implementation, as well as Plan consultation, communications, and reports, follow all applicable laws and regulations. The Contractor shall provide, at a minimum, the services and personnel to accomplish the following requirements:

4.1 Enrollment

The contractor shall provide an online enrollment system which has the capabilities to allow for new hire enrollments, annual enrollments, mid-year enrollments elections due to qualifying life events or any other changes as directed by the agency (such as adjusting allotments or cancellations) and lifecycle elections. The contractor is responsible for conducting enrollments that are scheduled anytime within the contract’s period of performance.

Annual open enrollment for HCA and DCA is held annually over a 4-week period during the months of November and December. Annual enrollments and new hire enrollments for HCA and DCA shall be performed via the Contractor’s internet website through an online enrollment tool. Employees shall have the ability to access the Contractor’s enrollment tool by entering a personalized username and password.

The Contractor shall provide a mechanism for handling mid-year enrollment elections due to a qualifying life event.

Parking FSA enrollments and changes shall be performed by employees through the Contractor’s internet website throughout the year.

4.2 Transition (In/Out)

The Contractor shall provide transition in and out services. The cost of performing all transition actions shall be built into the Contractor’s pricing, and no adjustments shall be made to pricing and no additional fees assessed as a result of the need to transition to a new Contractor.

Transition-in: The claims grace period for the incumbent Contractor ends 3/15/2026. The claims runout period ends 6/15/2026. The new Contractor shall be ready to process and receive all claims beginning 1/1/2026. The new Contractor shall coordinate with the previous Contractor and the COR to ensure all 2025 claims received during the grace and runout period are processed accurately and in a timely manner. The Contractor shall document this process in its transition plan and identify any reports required from the outgoing contractor.

Transition-out: The Contractor shall include in its transition out plan the process by which it will transition data, information and funds to the COR and incoming Contractor. Specifically, the Contractor shall address how it will satisfy its obligation to process all claims in a timely and accurate manner during the claims grace and runout periods at the conclusion of the contract.

During the transition-out period, the contractor must transfer all enrollee information and associated information on its systems to the Government and/or assignees (e.g., incoming contractor(s)). All government furnished data and information, including data and information associated with FSA enrollees and participants, shall remain the property of the government and be transferred back to the government at the end of the contract’s period of performance. The contractor shall ensure the transfer of all such information to the government and/or the incoming contractor in a format accessible to both the government and incoming contractor and per industry standards, e.g., Secure File Transfer Protocol (SFTP). The contractor shall be prepared to participate in a test period, during which time “test data” will be transferred from its systems to the incoming contractor’s systems to ensure a smooth transfer of data and information. The contractor shall demonstrate professional courtesies between its account manager and employees and those of the incoming contractor. The contractor shall work with the COR and incoming contractor’s personnel to ensure a seamless transition between the end of the incumbent contract and the beginning of the new contract. The contractor shall adapt as necessary to comply with any new statutes concerning FSAs.

4.3 Plan Activities Dates

4.3.1 Startup Period

The Contractor shall perform all required tasks to take over the administration of OCC’s FSA participant accounts from the incumbent contractor and must complete these tasks by March 31, 2026, when the current contract expires.

4.3.2 Administration/Performance Period

The Contractor shall provide an IRS compliant Health Care FSA, Dependent Care FSA and Parking FSA for eligible OCC employees.

a. Open Season Enrollment - this occurs annually from the second week of November through the second week of December,

b. Health Care FSA - the plan year is January 1st - December 31st, subject to a 2 ½ month grace period. The grace period ends March 15th with a filing deadline of June 15th.

c. Dependent Care FSA-the plan year is January 1st - December 31st, subject to a 2 ½ month grace period. The grace period ends March 15th with a filing deadline of June 15th.

d. Parking FSA - Monthly enrollment, not subject to annual enrollment

4.3.3 End of Contract Period Open Enrollment

In the final exercised option year, the Contractor shall continue to perform all functions through the end of the calendar year of this contract to include Open Enrollment for the upcoming calendar year.

Performance will be maintained at the same level of quality, effort and expertise regardless of whether the incumbent is awarded a new contract to perform in the upcoming calendar year, or a different Contractor has received the next award.

The Contractor shall transfer to the OCC all remaining aggregate funds, as well as forfeitures, no later than 180 days following the end of the contract. Account information where the funds are to be transferred will be provided by the OCC. No later than one hundred eighty (180) days following completion of the Contract, or, if applicable, the end of the Claims Run Out Period following such completion, and in the event an FSA reimbursement check remains outstanding at that time, the Contractor shall void uncashed checks.

4.4 Account Contributions

The Contractor shall accept HCA and DCA employee and employer contributions. All FSA contributions are on a pre-tax basis. Employee HCA and DCA contributions are payroll deducted on a biweekly basis (26 pay periods in a tax year) and parking contributions are deducted twice a month.

The Contractor shall accept, at the beginning of each plan year, funds representing the total employer contribution election for plan participants.

The Contractor shall establish a non-interest-bearing bank account, in care of the OCC, for the purpose of accepting payroll contributions electronically transmitted by National Finance Center (NFC) biweekly.

The Contractor shall accept an OCC lump sum contribution for the OCC Life Cycle Account benefit, in the non-interest-bearing bank account established in care of OCC, at the beginning of each plan year.

The current employer contribution is $500 per employee per year (this amount is prorated for new hires). The OCC only transmits funds (employee and employer contributions), to the Contractor, for the use of paying claims via electronic funds transfer (EFT).

4.5 Data File Transmission

The Contractor shall receive and upload employee eligibility data files to its system weekly to facilitate participant eligibility. The employee eligibility data file shall consist of employee personal information (i.e., name, social security number, date of birth, home address, hire date, business email address and separation date, if applicable). Employee elections are to be captured on an enrollment file by the Contractor and transmitted to the OCC electronically. The Contractor shall work with the OCC on converting the enrollment file into a format that is accepted by the OCC’s third-party payroll provider, the National Finance Center (NFC). In addition, the Contractor shall accept a payroll file produced by NFC that contains employee payroll deductions and post that information to the employee’s applicable FSA accounts. The NFC payroll file shall be a single file with a separate row of data for each account type (HCA, DCA and Parking). The payroll file prepared by NFC is only produced in Extended Binary Coded Decimal Interchange Code EBCDIC format with a packed decimal. The Contractor shall either process this file raw (in EBCDIC format) or accept the file and format it as needed.

4.6 System Capabilities

The Contractor shall provide to plan participants, at a minimum, the following:

Electronic notifications:

• Enrollment confirmation

• Debit card suspension

• Claim filing status

Online access to:

• Enter enrollment elections online

• View account information e.g. enrollment election, balances, contributions history, claim activity and account statements

• Update personal information e.g. home address, email address, banking information for direct deposit and reimbursement preference (direct deposit or check)

• Request /Replace additional debit cards

• Obtain claim forms

• View Inventory Information Approval System (IIAS) approved merchants list

Educational materials:

• Eligible HCA and DCA expenses

• Debit card use

• Benefits of pre-tax savings through HCA and/or DCA

• Claim filing instructions

• Commuter benefits

4.7 Administrative Services and Account Management

At a minimum, the Contractor shall provide:

1. A secure Web-based system that allows employer access to view participant enrollment information.

2. A system operating manual complete with instructions on essential system functionality.

3. A toll-free telephone number for contacting customer service with Interactive Voice Response (IVR), Teletype (TTY) access, and for faxing of claims.

4. Live customer service representatives located in the United States or its Territories available weekdays from 8:00am until 7:00pm ET. The contractor must not use foreign call centers.

5. 24-hour automated access to benefits information.

6. The Contractor shall have expertise, knowledge, and understanding of the regulatory arena impacting FSAs and keep the OCC abreast of any upcoming regulatory changes in a timely manner.

7. An onsite representative at OCC’s annual benefits fair in November of each year to provide information about the FSA plan and to answer employee questions (not separately priced). In the event the benefits fair is virtual, the contractor shall participate virtually as directed by the COR, in strict accordance with the terms of the contract.

8. Knowledgeable Customer Service Representatives who can assist participants with account and plan inquiries.

9. A system for use by the account manager for the purpose of tracking inquiries and/or issues brought to his/her attention by OCC.

10. Timely notification to the OCC of any system enhancements/upgrades that could impact the ability to meet the performance requirements under this PWS. Personnel to support program implementation of the Contractor’s enrollment system to ensure a timely annual open enrollment.

11. Assurance that annual open enrollment elections (both employee and employer) can be viewed by participants beginning on January 1 of each plan year.

12. Determine eligibility for benefits.

13. Develop and implement financial systems, as appropriate for transfer of funds, reimbursement to employees and plan accounting within 60 days of contract award.

14. A Day-to-day account manager with at least five years of experience in the FSA area and familiarity with federal benefits.

15. Ongoing assistance, as requested by employees and the OCC Contracting Officer Representative.

16. Monitor and report the number of OCC accounts with elevated access privileges (administrative accounts) and provide accompanying audit log of activities.

4.8 Key Personnel

The contractor shall provide a dedicated account manager. The account manager shall be the primary point of contact to the OCC for reporting purposes and shall be accountable for contract performance.

The contractor shall refer to the clause (OCC) 1052.215-8003 KEY PERSONNEL (APR 2014) for further terms and conditions.

4.9 Site Visits

The contractor shall host the OCC for a site visit of the contractor’s site at OCC’s discretion.

Scheduling information for this site visit will be communicated in advance by the OCC to allow time for preparation.

5.0 SECURITY AND PRIVACY REQUIREMENTS

A. Compliance with Applicable Laws, Regulations, and Standards

Federal Laws. The contractor and all of its respective subcontractors shall follow and remain compliant at all times with the Federal Acquisition Regulation (FAR), Privacy Act of 1974 (5 U.S.C.

552a - the Act), Federal Information Security Modernization Act of 2014 (Public Law 107-347)

(FISMA).

FIPS. The contractor and all of its respective subcontractors shall follow Federal Information Processing Standards (FIPS), National Institute of Standards and Technology (NIST) standards and guidelines, and other laws, mandates, or executive orders pertaining to the protection of sensitive information and information systems.

OCC Enterprise Cloud Secure Communication Standards. All user-to-cloud service communications must be encrypted with the latest OCC-approved browser protocol.

B. General Requirements

Location. Information collected, used, stored, maintained, or otherwise processed by the contractor in the performance of this contract shall be accessed, transferred, stored or processed only within the United States. In addition, the maintenance and support operations of the contractor's technology and information must take place, and originate from, within the United States.

The contractor shall not host any portion of the information, information system, infrastructure, or environment in facilities outside the contiguous United States, Alaska, Hawaii, and other U.S.

Territories.

Authorization to Use, Store, or Share Sensitive Information. The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all government data, equipment, etc. by treating the information as sensitive. All information gathered or created under this contract shall be considered as Controlled but Unclassified (CUI) information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets.

Confidentiality. The contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

Deliverables. The deliverables in this contract will be considered CUI and shall not be shared with any other organization without prior written approval from the Contracting Officer.

C. Security and Privacy Authorization

FIPS 199 System Security Category - FedRAMP. It is anticipated that the Federal Information Processing Standard (FIPS) 199 system security categorization for the FSA system will be FIPS 199 FIPS 199: Moderate. Since the FSA system is a public cloud solution, the Federal Risk and Authorization Management Program (FedRAMP) FIPS 199 Moderate control baseline, which is based on the Federal Information Security Modernization Act of 2014 (FISMA) security and privacy requirements for a FIPS 199: Moderate impact system, applies to the contractor and the contractor systems supporting these public cloud services.

Authorization Boundary. The contractor shall provide a security architecture diagram(s) specific for the OCC, that clearly demarcates the information system authorization boundary and depicts all of its connections, ports, protocols, functions, services, and components, including the means for monitoring and controlling communications at the external boundary and at key internal boundaries within the system. The contractor shall address all components, connections, ports, protocols, security controls, and managed interfaces of the information system authorized for operation (e.g., routers, firewalls).

The diagram must include a predominant border drawn around all system components and services included in the authorization boundary. If there are OCC-specific components (e.g., components developed or customized for the OCC, OCC-hosted components, etc.) and/or other components supporting this solution that are not in the scope of the contractor's existing security documentation, then identify those components in the diagram as well, as part of a separate OCC-specific boundary since those are unique to OCC and shall be part of the OCC-specific security authorization. The diagram must be easy to read and understand. Formal names of components as they are known at the service provider organization in functional specifications, configuration guides, other documents and live configurations shall be named on the diagram and described. The contractor shall provide a key for symbols used. This diagram shall be delivered to the Everbridge COR, Enterprise Architect, and Information System Security Officer.

Customer Responsibilities - FedRAMP. The contractor shall provide a detailed list of all customer responsibilities assigned to the OCC, as defined by the vendor and documented under each Federal Risk and Authorization Management Program (FedRAMP) package in the Customer Responsibilities Matrix (CRM) to be leveraged in the solution, as applicable.

For each customer responsibility, the contractor shall identify whether the contractor will be addressing the responsibility under the contract in order to fully meet the requirements specified in this PWS, or whether the responsibility will be assigned to the OCC. The contractor shall provide the CRM as directed in the "Security and Privacy Vendor Deliverables" section.

External Service Provider Compliance & Monitoring Background. The FISMA and OMB policies require that federal agencies using external service providers to process, store, or transmit federal information or operate information systems on behalf of the federal government, assure that such systems meet the information security protections commensurate with the information and system sensitivity. Federal agencies are responsible and accountable for the information security risk incurred by the use of information system services provided by external providers.

Such risk is addressed by incorporating the Risk Management Framework (RMF) 1 and security requirements for external information systems and services as part of the terms and conditions of the contracts with external providers. Federal agencies can also require external providers to provide appropriate evidence to demonstrate that they have complied with protecting federal information.

Prior to the implementation of the contractor's system or services, the OCC ensures compliance with the RMF by issuing an Authorization to Operate (ATO) or Authorization to Use (ATU), based on its review and analysis of the external provider's security documentation (described in detail in the next section) and assessment of customer (OCC's) security responsibilities.

1NIST Special Publication 800-37, as amended, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy.

FedRAMP Cloud Authorization Package. FedRAMP is mandatory for Federal Agency public cloud deployments and service models. Private cloud deployments intended and dedicated for single organizations are the only exception.

The contractor shall be responsible for obtaining a FedRAMP-approved Third-Party Assessment Organization (3PAO) to perform the following:

a. Initial IT security and privacy control assessment of the [to be determined];

b. Annual IT security and privacy control assessment of the [to be determined] on a subset of controls in accordance with the [to be determined] Information Security Continuous Monitoring (ISCM) Plan; and

c. Upon significant change to the [to be determined], full or delta assessment of the system depending on the degree and scope of the significant change.

The FedRAMP Authorization Package and its contents shall be developed in accordance with OMB A-130, FedRAMP, and applicable NIST SPs guidance. The contractor shall provide the FedRAMP Authorization Package resulting from each of these assessments and contents, as listed and per the frequency in the "Security and Privacy Vendor Deliverables" section, to support OCC's initial and Ongoing Authorization for the solution.

OCC Security Authorization to Use. The determination of whether to issue an OCC security authorization will be made by the OCC based on the identified risks to the OCC's data and operations.

These risks include: (1) deficiencies noted in the FedRAMP Package(s), including weaknesses and associated risks identified in the most recent 3PAO Security Assessment Report and Plan of Action & Milestone and (2) gaps in OCC control responsibility (i.e., OCC's customer responsibilities per the CRM) implementation identified by the OCC Security Assessment Team and documented in the OCC

SAR.

Ongoing Authorization. The contractor shall provide the OCC with access to all information and documentation needed to support the OCC's ongoing authorization for the solution and shall provide periodic status of risk updates per the frequency and instructions in the "Security and Privacy Vendor Deliverables" section, including:

a. Annual 3PAO Security and Privacy Assessment Report (SAR).

b. Open POA&M report included in FedRAMP Monthly Continuous Monitoring report (See Section E. Continuous Monitoring)

c. Annual System Security Plan (SSP) Update.

FedRAMP ATO Pending. In cases where the contractor does not already have a FedRAMP Authorization1 for the [insert Cloud solution name] at time of award, at a minimum, the contractor shall have a comprehensive and current 3PAO FedRAMP assessment for the [to be determined], conducted against the FedRAMP FIPS 199: Moderate security control baseline.

This comprehensive 3PAO FedRAMP assessment must have been completed within the last year.

The OCC will use the results of this assessment documented in the 3PAO Security and Privacy Assessment Report (SAR) and the remaining contents of the contractor's FedRAMP package to issue the OCC-specific Authorization to Use. The contractor shall provide the 3PAO SAR and the rest of the contents of the FedRAMP Security and Privacy Package, excluding the FedRAMP ATO memo (since it is pending/not available), to the OCC as directed per the "Security and Privacy Vendor Deliverables" section of this document.

The contractor should obtain the FedRAMP authorization for the [insert Cloud solution name] from the FedRAMP Program Management Office (PMO) prior to OCC implementing the system for production use. However, if the FedRAMP authorization is not possible prior to OCC's required go-live date due to the FedRAMP Program Management Office's (PMO) schedule, agency sponsorship, or other external limitations, then OCC will work with the contractor to determine the best path forward to achieve the FedRAMP authorization as soon as possible. In addition, the contractor shall support the OCC in the quarterly report in the PortfolioStat process, which lists cloud services that do not meet FedRAMP requirements, the appropriate rationale, and the proposed resolution for achieving compliance.

There are two types of FedRAMP Authorizations: Provisional-Authorization to Operate (P-ATO) -issued by the FedRAMP Joint Authorization Board (JAB); and FedRAMP Agency ATO - issued by the FedRAMP Program Management Office (PMO) upon its review of the Agency Sponsor ATO package.

D. Configuration Management

Security Configuration Settings. The contractor shall establish and enforce security configuration settings for information technology products employed in the [to be determined].

Security Updates and Patches. The contractor shall ensure that the [to be determined] is properly maintained and monitored, to include immediate response to critical security patches, routine maintenance windows to allow for system updates, and compliance with the defined configuration management and change control processes. All patches and system updates shall be properly tested in a development environment before being implemented in the production environment.

Least Functionality. The contractor shall restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services for information technology products employed in the [to be determined].

E. Continuous Monitoring

Information Security and Privacy Continuous Monitoring. All contractor systems must participate in Information Security and Privacy Continuous Monitoring (ISCM) and reporting. The contractor will be expected to perform automated scans and continuous monitoring activities which may include, but will not be limited to, authenticated and unauthenticated scans of networks, operating systems, applications, and databases.

Compliance Reviews and Audits. The contractor shall permit and support compliance reviews and audits under applicable laws to allow the OCC to meet legal and compliance obligations and shall implement processes that allow visibility into the privacy and security controls employed and their effectiveness. The contractor shall provide the OCC or authorized designated officials with information requested by auditors in a timely manner, consistent with the respective auditor's deadline, in support of security compliance reviews and various annual audits, e.g., FISMA, Financial Statement Audit, A-123, etc.

In addition, the contractor shall provide the OCC or authorized designated officials logical and physical access to the contractor's facilities, installations, technical capabilities, operations, records, and databases pertinent to this contract within seven (7) calendar days upon request for these purposes.

The OCC may decide to prioritize specific security controls in which the contractor must perform ISCM to include AC-2, AU-6, CA-5, RA-5, SI-2, and SI-3.

Continuous Monitoring Reports. The contractor shall submit monthly continuous monitoring reports to the OCC as directed in the "Security and Privacy Vendor Deliverables" section. At a minimum, the continuous monitoring reports shall detail vulnerabilities identified, secure configuration compliance findings and status, open POA&Ms; accepted risks status and rationale, and independent assessments planned/completed.

Annual 3PAO Security Assessment Report and Package Review. As mentioned in Section C.

"Security and Privacy Authorization," under "FedRAMP Authorization to Operate," the contractor shall provide annual 3PAO Security Assessment Reports (SAR) reflecting the results of the assessment of a subset of controls completed by the 3PAO in accordance with the contractor's system ISCM Plan. The contractor shall provide these annual 3PAO SARs and updates to the Plan of Actions and Milestones, and System Security Plans and supporting documents, including the annual Contingency Plan (CP) Update and CP Test Report, to the OCC as directed in the "Security and Privacy Vendor Deliverables" section.

F. Data Protection

Data Encryption. Where encryption is required, as specified by the OCC, the contractor shall ensure that encryption is established and maintained for data at rest and in transit for the duration of the contract. The encryption employed shall be equivalent to those approved in Federal Information Processing Standards (FIPS) Publication 140-2 or 140-3.

Need to Know. Sensitive information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected.

Data Separation. Unless otherwise directed by the OCC and/or controls are implemented to ensure adequate separation, any storage of data shall be contained within the resources allocated by the contractor to support the OCC and may not be on systems that are shared with other commercial or government clients.

General Use of Controlled Unclassified Information (CUI). The contractor shall not use any CUI or CUI subcategories, including, Personally Identifiable Information (PII) or low-sensitivity PII (e.g., E-mail Groups and Lists), for any purpose other than those activities necessary to the performance of this contract.

Use of Contractor Equipment. Use of contractor-owned laptops or other equipment (e.g., media storage devices, servers, etc.) to process, transmit, or store OCC information or to access the OCC network or other OCC information resources without OCC's formal approval is prohibited. This restriction does not apply to the use of non-OCC laptops or PCs to use OCC-approved virtual desktop infrastructure to remotely access the OCC network.

G. Incident Response

Notification. The contractor must report all information security incidents that potentially or actually cause the compromise of OCC information, even if the contractor believes the security incident may be limited, small, or insignificant with respect to OCC data or systems. The OCC will determine when the contractor's reported security incident requires additional focus and attention.

Within one hour from the time the contractor validates that an information security incident has occurred, the contractor must report the security incident information to OCC:

ComputerSecurityIncidentResponse@occ.treas.gov, (202) 649-7930, regardless of day or time.

The contractor must provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC with the following text in the subject line of the email:

“Supplementary Information/Report related to previously reported incident # [insert number].”

Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

When notifying the OCC CDC, copy the Contracting Officer if possible or, if reporting by phone or Contracting Officer's email is not immediately available, contact the Contracting Officer immediately after reporting the incident to the OCC CDC.

Information, System and Tool Availability. The contractor shall make available any information, systems and tools necessary for the OCC to respond to incidents in a manner consistent with NIST SP 800-61, as amended. In the case of a reported security incident, the contractor shall provide the OCC with access to the contractor's system and/or facilities within 72 hours of the OCC's request.

H. Information Ownership

Government Access. The government will retain unrestricted rights to government data. The OCC retains ownership of any user created/loaded data and deliverables (e.g., documents, applications, custom code, diagrams, workflows, data sets, etc.) hosted on contractor's equipment, systems, infrastructure, etc., as well as maintains the right to request full copies of these at any time.

Removal of OCC Data. The contractor acknowledges the OCC's exclusive right of ownership of the information and is required to transfer, return, and/or delete all agency data collected, processed, stored or maintained by the contractor on behalf of OCC upon termination of services, and shall provide written certification and supporting documentation attesting to the transfer, return and/or deletion of agency information or data generated, collected, processed, maintained, or stored by the contractor and any subcontractors, per instructions the "Security and Privacy Vendor Deliverables" section.

Documents and Deliverables. The preliminary and final OCC-specific deliverables and all associated working papers are the property of the U.S. Government. The contractor shall not release any information without the written consent of the Contracting Officer. All work papers, preliminary and final deliverables must be submitted to the COR at the conclusion of the contract in an acceptable and usable format, which may include the original format.

eDiscovery. The contractor must ensure data preservation requirements (i.e., halt destruction and maintain data the contractor may not otherwise have to maintain) related to litigation holds are met.

The contractor shall also ensure that metadata associated with litigation holds are preserved. Metadata is electronically stored information that describes the history, tracking, or management of an electronic document. It is created automatically when a user creates, modifies, accesses, or takes other actions with respect to an electronic document.

The contractor shall provide immediate access to all government data and government-related data impacting government data for review or scan, or conduct of a forensic evaluation, and physical access to any contractor facility with government data.

I. System Access

Government Right to Terminate Access. The OCC, at its discretion, may suspend or terminate the access to any systems and/or facilities when an information security incident or other electronic access violation, use or misuse issue gives cause for such action. The suspension or termination may last until such time as OCC determines that the situation has been corrected or no longer exists.

Identity as a service Solution (IDaaS): The OCC has implemented a cloud-based IDaaS solution for issuing user credentials for role-based access permissions.

a. The [to be determined] shall interface with the OCC IDaaS solution for identity access management, utilizing standard Security Assertion Markup Language (SAML) version 2.0. SAML is an XML-based standard for exchanging authentication and authorization data between an identity provider (IdP) (e.g., the OCC IDaaS solution provider) and a service provider.

b. The contractor shall ensure the [to be determined] integrates with the latest version of the OCC IDaaS solution provider.

Two Factor Access Authentication:

a. The [to be determined] shall support Single Sign-On using two-factor logins:

b. Support OCC's Identity Access Management using the OCC's IDaaS solution;

c. Support SAML assertions with the OCC as the identified provider to exchange user access trusts with external or cloud-based managed service.

OCC Cloud Security Stack:

a. The contractor shall support and integrate with the OCC Cloud Security Stack. The OCC has implemented Cloud Access Security Broker (CASB) to safeguard access to OCC production systems.

b. The [to be determined] shall interface with the OCC CASB solution for production system access protection.

c. The contractor shall ensure the cloud service integrates with the latest version of OCC's CASB solution.

J. Training Requirements

K. Supply Chain Risk Management

Background. In accordance with Federal requirements, the OCC requires supply chain entities to implement necessary security safeguards to: (i) reduce the likelihood of unauthorized modifications at each stage in the supply chain; and (ii) protect information systems and information system components, prior to taking delivery of such systems/components. This control also applies to information system services.

Supply Chain Safeguards. The contractor will:

a. Implement security and privacy controls for systems, facilities, and external connections to systems as necessary to ensure compliance with the laws, regulations, standards, and requirements specified in Sections C. Security and Privacy Authorization, F. Data Protection, and I. System Access.

b. Implement personnel screening processes to ensure suitability in accordance with relevant standards and requirements.

c. Use of tamper-evident packaging during shipping/warehousing.

d. Avoid the purchase of custom configurations to reduce the risk of acquiring information systems, components, or products that have been corrupted via supply chain actions targeted at specific organizations.

e. Vet the processes and security practices of subordinate suppliers, critical information system components, and services.

f. Employ a diverse set of suppliers to limit the potential harm from any given supplier in the supply chain.

g. Implement contract language regarding the prohibition of tainted or counterfeit components.

h. Restrict purchases from specific suppliers or countries per requirements issued by the U.S.

Department of Homeland Security (DHS) and/or Federal Acquisition Security Council, as these requirements pertain to the management of supply chain risk for Federal Agencies.

i. Use trusted/controlled distribution, delivery and warehousing options to reduce supply chain risk.

L. Security and Privacy Vendor Deliverables

Authorization Boundary Deliverables

FedRAMP - Public Cloud Deliverables

Removal of Data Deliverables

1. Privacy Act. As prescribed in the FAR 24.104, if the contract involves the design, development, or operation of a system of records on individuals, the contractor must implement requirements in FAR clause 52.224-1, “Privacy Act Notification” and FAR clause 52.224-2, “Privacy Act". In addition, the contractor is responsible for ensuring individuals supporting the OCC are trained in accordance with FAR clause 24.301, “Privacy Training.”

2. Section 508 Accessibility. The contractor’s products and services shall comply with all applicable provisions of the standards issued by the Architectural and Transportation Barriers Compliance Board (Access Board) (http://www.access-board.gov/sec508/guide/) to ensure the accessible use of federal electronic and information technology.

http://www.access-board.gov/sec508/guide/

M. Section 508 Compliance Requirement

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L.

105-220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities.

Items that contain ICT: FSA User Management Tools

FSA User Management Tools

E201 Application

E201.1 Scope ICT that is procured, developed, maintained, or used by agencies shall conform to the Revised 508 Standards.

E205 Electronic Content

E205.1 General Electronic content shall comply with E205.

E205.2 Public Facing Electronic content that is public facing shall conform to the accessibility requirements specified in E205.4.

E205.3 Agency Official Communication Electronic content that is not public facing shall conform to the accessibility requirements specified in E205.4 when such content constitutes official business and is communicated by an agency through one or more of the following:

• A. An emergency notification;

• B. An initial or final decision adjudicating an administrative claim or proceeding;

• C. An internal or external program or policy announcement;

• D. A notice of benefits, program eligibility, employment opportunity, or personnel action;

• E. A formal acknowledgement of receipt;

• F. A survey questionnaire;

• G. A template or form;

• H. Educational or training materials; or

• I. Intranet content designed as a Web page.

E205.4 Accessibility Standard (WCAG 2.0) - Electronic content shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (Incorporated by reference, see 702.10.1).

E206 Hardware

E206.1 General. Where components of ICT are hardware and transmit information or have a user interface, such components shall conform to the requirements in Chapter 4.

E207 Software

E207.1 General Where components of ICT are software and transmit information or have a user interface, such components shall conform to E207 and the requirements in Chapter 5

Exception from E207.1 General: Software that is assistive technology and that supports the accessibility services of the platform shall not be required to conform to the requirements in Chapter 5.

E207.2 WCAG Conformance User interface components, as well as the content of platforms and applications, shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1).

Exceptions from E207.2 WCAG Conformance:

• Software that is assistive technology and that supports the accessibility services of the platform shall not be required to conform to E207.2.

• Non-web software shall not be required to conform to the following four Success Criteria in WCAG 2.0: 2.4.1 Bypass Blocks; 2.4.5 Multiple Ways; 3.2.3 Consistent Navigation; and

3.2.4 Consistent Identification.

• Non-Web software shall not be required to conform to Conformance Requirement 3 Complete Processes in WCAG 2.0.

E207.3 Complete Process for Non-Web Software Where non-Web software requires multiple steps to accomplish an activity, all software related to the activity to be accomplished shall conform to WCAG 2.0 as specified in E207.2.

E208 Support Documentation and Services

E208.1 General Where an agency provides support documentation or services for ICT, such documentation and services shall conform to the requirements in Chapter 6.

E301 General

E301.1 Scope. The requirements of Chapter 3 shall apply to ICT where required by 508 Chapter 2 (Scoping Requirements), 255 Chapter 2 (Scoping Requirements), and where otherwise referenced in any other chapter of the Revised 508 Standards or Revised 255 Guidelines.

E302 Functional Performance Criteria

302.1 Without Vision. Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that does not require user vision.

302.2 With Limited Vision. Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited vision.

302.3 Without Perception of Color. Where a visual mode of operation is provided, ICT shall provide at least one visual mode of operation that does not require user perception of color.

302.4 Without Hearing. Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that does not require user hearing.

302.5 With Limited Hearing. Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited hearing.

302.6 Without Speech. Where speech is used for input, control, or operation, ICT shall provide at least one mode of operation that does not require user speech.

302.7 With Limited Manipulation. Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that does not require fine motor control or simultaneous manual operations.

302.8 With Limited Reach and Strength. Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that is operable with limited reach and limited strength.

302.9 With Limited Language, Cognitive, and Learning Abilities. ICT shall provide features making its use by individuals with limited cognitive, language, and learning abilities simpler and easier.

503 Applications

503.1 General Applications shall conform to 503.

503.2 User Preferences Applications shall permit user preferences from platform settings for color, contrast, font type, font size, and focus cursor.

Exception from E503.2 User Preferences: Applications that are designed to be isolated from their underlying platform software, including Web applications, shall not be required to conform to 503.2.

503.3 Alternative User Interfaces. Where an application provides an alternative user interface that functions as assistive technology, the application shall use platform and other industry standard accessibility services.

503.4 User Controls for Captions and Audio Description Where ICT displays video with synchronized audio, ICT shall provide user controls for closed captions and audio descriptions conforming to 503.4.

503.4.1 Caption Controls Where user controls are provided for volume adjustment, ICT shall provide user controls for the selection of captions at the same menu level as the user controls for volume or program selection.

503.4.2 Audio Description Controls. Where user controls are provided for program selection, ICT shall provide user controls for the selection of audio descriptions at the same menu level as the user controls for volume or program selection.

504 Authoring Tools

504.2 Content Creation or Editing Authoring tools shall provide a mode of operation to create or edit content that conforms to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1) for all supported features and, as applicable, to file formats supported by the authoring tool.