Amended SOW GRC and BI Solicitation Jan 2020 with Track Changes .pdf

Statement of Work for

Financial Reporting and Business Intelligence Tool with Integrated Governance, Risk Management, and Compliance Capabilities

January 2020

Contents

1. BACKGROUND

2. OBJECTIVE

3. SCOPE

4. CURRENT PROCESSES AND OBJECTIVES

5. REQUIREMENTS

6. MILESTONES/DELIVERABLES

7. PRICING CHART

8. REFERENCES

9. CONTRACT

10. PLACE OF PERFORMANCE

11. CONFIDENTIALITY AGREEMENT

12. RIGHT TO CONTRACT EXTENSION FOR OTHER SERVICES

13. RIGHT OF SUBSTITUTION

14. CLAIM FOR RELIEF

15. EMPLOYER-EMPLOYEE RELATIONSHIP

16. NOTICE TO FCSIC OF DELAYS

17. NO IDEMNIFICATION

18. NO UNPAID FEDERAL TAX LIABILITY

19. TERMINATION CLAUSE

20. CLAUSES INCORPORATED BY REFERENCE

21. SOLICITATION

22. METHOD OF PAYMENT

23. EQUAL OPPORTUNITY

24. JOINT AND SEVERAL LIABILITY

25. ADVERTISING AND PUBLICITY

26. APPENDIX A

27. Q&A from vendors – 1-24-2020.pdf (see beta.sam.gov announcement for file attachment)

28. Requirements Response Sheet (see beta.sam.gov announcement for file attachment)

29. Attachment A – Investment Detail Source Data Example (see beta.sam.gov announcement for file attachment)

30. Attachment B – Financial Statement and TB Source Data Example (see beta.sam.gov announcement for file attachment)

31. Attachment C – Bank Data Source Data Example (see beta.sam.gov announcement for file attachment)

STATEMENT OF WORK

Financial Reporting and Business Intelligence Tool with Integrated Governance, Risk Management, and Compliance Capabilities

Farm Credit System Insurance Corporation

1501 Farm Credit Drive McLean, VA 22102 www.fcsic.gov

1. BACKGROUND

The Farm Credit System Insurance Corporation (FCSIC or the Corporation) is an independent federal government-controlled corporation whose primary mission is to protect investors who purchase insured Farm Credit System (System) debt obligations. FCSIC administers the Farm Credit Insurance Fund (Insurance Fund) and collects annual insurance premiums from System banks.

In addition to providing insurance to investors that purchase System debt obligations, FCSIC has other mandatory and discretionary statutory responsibilities including serving as conservator or receiver when appointed by the Farm Credit Administration (FCA) Board and providing assistance to System banks suffering financial difficulty. FCA is the independent federal regulatory agency responsible for ensuring the safety and soundness of the System. FCA’s Board is comprised by the same three individuals who make up the FCSIC Board, however, the same member may not serve as chair of both entities.

FCSIC operates with a small staff. Its streamlined business model utilizes contractors and FCA staff to assist in fulfilling its mission. FCSIC purchases staffing and other support services from FCA through an interagency agreement. FCSIC has contracted with FCA to provide IT related services to FCSIC and its staff.

2. OBJECTIVE

FCSIC is looking for a 100% cloud-based solution, in one secure, integrated, and centralized software-as-a-solution tool to facilitate, automate, generate, streamline processes, and track data and provide narrative required for

• Financial Reporting and Business Intelligence capabilities, specifically to support FCSIC’s Annual Financial Report (AFR) and other weekly/monthly/quarterly/annual reports; and

• Governance, Risk Management, and Compliance (GRC) capabilities, specifically to support FCSIC’s management and testing of the requirements of the Office of Management and Budget (OMB) Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal Control, Appendix A, Internal Control Over Reporting (OMB A-123, Appendix A).

http://www.fcsic.gov/

3. SCOPE

The scope of work explains the financial reporting automation and the internal control management solution requirements. It also provides guidelines for the vendor responses to the procurement. The terms “tool,” “product,” and “software” may be used interchangeably in this document to reference the solution we are seeking to procure.

The tool will manage and store all work processes, workflows, supporting documentation and evidence, tracking (comments and status), and monitoring functions. The tool will extract and accept data from Excel reports and other inputs and will transform the data into formats required for financial reporting and audit management (tables, charts, graphics, text), track changes and comments, provide version controls and status (including time tracking and calendar updates), load data and formats into the report layout, and generate a report for publishing.

The tool will allow flexibility for up to 15 user licenses. It should be collaborative and allow for multiple users in the same file simultaneously and have customizable administrative and user roles. The tool should be 100% cloud accessible and must be a certified FedRAMP Moderate software. Software version updates are to be managed by the vendor and include the most recent security and functional capabilities available. The tool should have a user-friendly interface, dynamic linking of objects and content, audit trail capabilities with edits tracked in real time (tracking/version capabilities with track changes), workflow responsibilities/restrictions, file sharing and access controls, editing and publishing capabilities, and options to input/output in various formats.

The scope of work includes the Contract Line Item Numbers (CLIN) that are described below.

CLIN01 - Implementation Services (BASE YEAR)

CLIN01 is for the services required to instantiate the requested cloud resources, complete required FedRAMP paperwork, review customer responsibilities, and install and configure software in FCSIC’s IT environment (managed by FCA). Managed solutions services must have a FedRAMP Moderate authorization issued either by an Agency or the FedRAMP Joint Authorization Board (JAB). FCSIC does not have the available resources to sponsor an Agency authorization. The tool is to be turn-key/operational in 6- 9 weeks after contract award. It is expected that CLIN01 will be invoiced upon completion.

CLIN 02 - Managed Solutions Services (BASE YEAR)

CLIN02 is for 12 months of managed solutions services for the requirements listed in the “Work Requirements” section of this Statement of Work (SOW) which includes licensing for up to 15 individuals. CLIN02 is to be invoiced monthly starting after the completion of CLIN01.

CLIN 03 - Managed Solutions Services (OPTION YEAR)

CLIN03 is for 12 months of managed hosting services for the requirements listed in the “Work Requirements” section of this SOW. The vendor must remain FedRAMP Moderate-certified. CLIN03 is an option to be executed via contract modification by the

Contracting Officer at FCSIC’s discretion. The vendor will be notified at least 30 days before the expiration of CLIN03 of FCSIC’s intent to execute the option year.

CLIN 04, CLIN 05, CLIN 06 (OPTION YEARS 2, 3, and 4) CLIN 04, CLIN 05, and CLIN 06 option years are equivalent to CLIN03 in every way except for the option year period.

CLIN 07

At the option of FCSIC, at any time during the contract, we may elect to implement active directory sign-on.

4. CURRENT PROCESSES AND OBJECTIVES

Objective 1: Financial reporting and business intelligence capabilities - Agency Financial Report and other weekly/monthly/quarterly/annual reports

The current Agency Financial Report (AFR) manual production processes and preparation of management reports and dashboards (i.e., business intelligence reports) are inefficient and risky because there is limited audit tracking and control management.

The calendar year (CY) 2020 AFR format will follow the format published in CY 2019, which is available for viewing online at www.fcsic.gov. The AFR is composed of three major narrative sections, sourced from many authors, using various Microsoft and other applications, and includes narratives, graphs, charts, page breaks, pictures, and other common elements of an

AFR.

The AFR’s current manual production process uses a variety of commercial software applications, including Adobe Acrobat and various Microsoft applications, for report preparation, editorial and comment tracking, file version control, workflows/file access controls, content validations, and scheduling/milestones/deadlines.

Macro-based Excel data is used to prepare the financial tables, charts, and graphs that are imported into the narrative Word files supplied by multiple authors, inside and outside of FCSIC.

During the production process, there are several draft reviews of content within FCSIC, as well as with FCSIC’s external auditors, and each process requires tracking, version control, and validation of incorporation of editorial comments/changes and data table/chart/graph updates.

When the editorial review process is complete, and the AFR is deemed final and ready to publish, all Word files are combined into one Portable Document Format (PDF) file using Adobe Acrobat. The Corporation uses an outside printer, who must know certain information about the color schemes for the page. The AFR is then published on FCSIC’s website, while it is concurrently printed in hard copy and manually distributed.

Major issues with the AFR’s current manual production process include potential for inaccuracy due to manual nature of inputting key data, and reliance on a manual process to track complex editorial and comment tracking, file version control, workflows/file access controls, content and http://www.fcsic.gov/ validations, scheduling and milestone deadlines, interactions with other FCSIC offices, external auditors, and OMB. Issues with the current AFR production process cannot be resolved by SharePoint and/or other Microsoft software.

Other weekly/monthly/quarterly/annual reports and dashboards are prepared manually by FCSIC staff and are generally executed in Excel, Word, and PowerPoint.

Objective 2: Governance, risk management, and compliance capabilities – FCSIC’s management and testing for OMB A-123, Appendix A requirements

The current internal control management process to implement the Federal Managers’ Financial Integrity Act (FMFIA) and OMB A-123, Appendix A, monitoring and testing of internal controls, is inefficient and primarily maintained with spreadsheets and Word documents. The tool should eliminate the use of separate files, improve the efficiency and timeliness of coordination between offices, improve efficiency and quality of mandated reporting to our auditors, the OMB and the Government Accountability Office (GAO).

Using our current process of separate, non-integrated tools that offer limited collaboration, complicate version control between the various users. Documents pass each other in email making it difficult to know if any one version contains all the input as provided by the various people required to be involved in the final document. Additionally, since no workflows exist, and separate documents are not linked automatically, the processes around updating are manually intensive and prone to version control discrepancies.

An integrated database needs to capture logistical transactions, summary internal control testing results, management assessments of issues and organizational demographic details as the different audits progress through their various implementation cycles.

5. REQUIREMENTS

The following are detailed system requirements.

Table 1 – Solution Requirements Reference Topic Requirement

1.1 Cloud software

Application must provide a 100% Cloud Software as a Service (SaaS) solution, in one secure and centralized system. The tool manages and stores all work processes, workflows, supporting documentation, and evidence (e.g., all FCSIC supporting documentation and evidence resides in the tool, and is not in stored in other systems, shared folders, or networks).

1.2 FedRAMP authorization to

operate (ATO)

At a minimum, certified FedRAMP Moderate security. The vendor should also provide a Service Auditor Report on an annual basis related to the solution being provided.

1.3 Role-based security Provide role-based security at a granular level (e.g., sections of a document or process).

1.4 Scalability

Workflow coordination, tracking, reporting, and publishing features suitable for finance and accounting. Collaborative platform allows multiple users to access and edit the same file simultaneously, with version controls and status tracking.

1.5 Integration

Documents and "modules" within the application should be fully integrated to avoid duplicate data entry and data integrity issues.

1.6 Dynamic object linkages

and data integrity

Must provide dynamic linking of objects, content, and data to the individual data element/cell level that can secure content across multiple places and reports for efficiency and data integrity. Data within a file can be linked to other places in the file, as well as to other files inside the Tool.

1.7 Workflow

responsibilities/restrictions

Roles and rules-based workflow must be embedded and available within the application throughout each process.

The tool must route items automatically based on role and conditions. The tool shall manage the workflow tracking of audits, preliminary reports, draft reports, final reports, findings, recommendations, and responses to audit reports, management decisions, action plans, and audit follow-up documents, while maintaining the relationships between them. Customizable administrative and user roles, including workflow responsibilities/restrictions, file sharing, and access controls. FCSIC administrators can define and configure roles and assign individuals to those roles.

1.8 Workflow tracking

Sections within a file can be assigned to different users.

Users and edits can be tracked and reported. Capable of direct tasking and commenting, time tracking, and calendar updates.

1.9 Segregation of data and periodic access based on roles

Capability to provide and deny access to segments of the system based on roles.

1.10 Document management and

attachments

Ability to attach files in a variety of file formats such as PDF, Word, Excel, .txt, with no limitations in the number of files or file sizes. Ability to edit files within the application without the need to detach, save, edit, and reattach documents.

1.11 Version control

The application must have version control that captures the timing of, and individual(s) who make changes to documents.

The application should permit one active version to be worked on by multiple users at one time, to eliminate the inefficiencies of managing multiple versions of a document.

1.12 Revision of documents Application must be able to prevent the revision of comments or responses after submittal.

1.13 Dashboard interface

Provides role specific, editable dashboards. Users must be able to customize and configure individual dashboards as applicable and needed.

1.14 Import existing data Ability to import existing data from SQL, Adobe Acrobat, and Microsoft applications without manual re-typing of the data.

1.15 Transform data

Transform data into formats required for financial reporting and audit management, including tables, charts, graphics, and text. Tool loads data and formats into report layouts.

1.16 Exporting

Ability to generate and export data, reports, and documents to a corresponding Microsoft-type format (Excel, PowerPoint or Word), and to PDF format.

1.17 Audit trail

Provide an audit trail of activities, changes/edits, updates, and deletions made to any activity/document/version. The software captures modifications and actions performed by users, including name, date, version, and time stamp. Versions tracked in real time.

1.18 Report distribution

Ability to forward reports and other deliverables by email via the software platform and to automatically send copies to the sender’s standard email system.

1.19 Search queries Ability to search database tables and stored documentation captured/stored in the tool.

1.20 Active, complete, and

archived work

Ability to designate information/documents as active, complete, or historic/archived information.

Ability to lock completed work processes and documents to prevent additional modifications after completion.

Capability to lock each document to create a final unmodifiable document.

Reversing the process is possible with a workflow concurrence from a high role user.

1.21 System flexibility, no

custom programming

System flexibility for users to create/produce various report types and/or report styles within the software application, without software customization/development requiring additional costs.

1.22 Ease of use Application must be user-friendly, intuitive, accessible, and does not require extensive training.

1.23 Training

Any necessary standard training is provided at no additional cost. The training should enable a user to implement an automated report from a new data source and to build graphics, such as charts and graphs, that will be updated automatically as the source data is updated.

1.24 User access

User access only requires the tool, a computer, internet connection, browser and VPN access through the FCSIC network.

1.25 Customer support, user

help and documentation

User help and documentation is available via 1) a U.S.-based dedicated FCSIC Customer Service Manager, available via telephone and email during FCSIC’s core business hours of 8:30 AM to 5 PM Eastern, Monday through Friday, 2) a U.S.-based customer service telephone number, available 24 hours a day, 7 days a week, 365 days a year, for help outside of core business hours, and 3) a U.S.-based website for online support, including a repository of reference and self-help materials (such as webinars, tutorials, FAQs, PDFs, or other formats). The tool is user-friendly, easy to use, and has an intuitive interface, with any necessary standard training provided at no additional cost.

1.26 Collaboration

User ability to conduct controlled collaboration, add comments, and initiate tasks (with automated event/deadline notifications).

1.27 Up to 15 user licenses for one annual subscription cost

Flexible with up to 15 users is required to avoid additional costs, unnecessary modifications, easy expansion, and scalable use.

1.28 Self-contained solution

Ability to provide a comprehensive, vigorous, secure platform with capabilities including audit trail and linking for visibility, control, and risk management, without the need to rely on SharePoint or other systems/tools for any part of the process.

1.29 No configuration maintenance or upgrade costs

No additional costs required for ongoing configuration, maintenance, upgrades/updates.

Automated software upgrades/version updates, including the newest security and functional capabilities available.

1.30 Professional consulting

services

The vendor will provide professional consulting services to assist with the integration of business processes into the software solution.

1.31 Data location No data may reside outside of the U.S. and is secured per FedRAMP compliance.

1.32 Working with the Farm Credit Administration

(FCA)

FCSIC outsources its technology support to the Farm Credit Administration (FCA). The vendor must work with the FCA team to secure an Authority-to- Operate.

1.33 Data linking

The system shall have the capability to link data automatically from source documents or files to dashboards, narratives, and other information.

Reports and dashboards shall have the ability to automatically update based on updated source data.

1.34 Application programming

interfaces

Can support future integrations and Application Programming Interfaces (APIs).

1.35 Section 508 Compliance

All parts of the system that FCSIC will use must be compliant with Section 508 of the US Workforce Rehabilitation Act of 1973, as amended in 1998.

1.36 Records retention

The vendor shall support a system in accordance with the requirement for Federal agencies to manage their electronic records in accordance with applicable laws and regulations, such as 36 CFR § 1236.

The federal requirements for maintaining records to retain functionality and integrity throughout the records’ full lifecycle include:

- Maintenance of links between records and metadata, and

- Categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA approved retention schedules.

Table 2 -Financial Reporting and Business Intelligence Capabilities of AFR and Other Weekly, Monthly, Quarterly, and Annual Reports / Table 2 Requirements Reference Topic Requirement

2.1 Publication production processes

Streamline FCSIC data collection, accessibility, report generation, and publishing.

2.2 Risks, time, and

costs

Reduce risk, report production time, and costs. Allow accurate data reports to be produced on time and on or under budget.

2.3 Workflows, tracking, version control, scheduling

Increase the ease, efficiency, and accuracy of editorial and comment tracking, file version control, workflows/file access controls, content validations, and scheduling/milestones/deadlines.

2.4 Interactions within FCSIC and outside of the Corporation

Increase the ease, efficiency, and accuracy of interactions with other FCSIC offices, external auditors, and OMB.

2.5 Flexible

inputs/outputs

Add flexibility in inputs/outputs and formats. Allow AFR data to be readily available and accessible for other uses, inside and outside of the OCFO.

Table 3 -GRC Capabilities – Management and Testing of OMB A-123 Requirements / Table 3 Requirements Reference Topic Requirement

3.1 Audit tracking Solution must be able to link to and share data across other FCSIC processes, not just a solution for one or the other.

3.2 Reporting

Solution must be able to create, maintain, develop, process, and update the interim and final reports of any reporting processes that stem from Notices of Finding and Recommendation.

3.3 Includes certification

capability

Solution must include an approval/certification solution so that these do not have to be processed externally.

3.4 Includes control

frameworks

The application must be able to contain control frameworks such as COSO, ISO ERM, CobiT, CMS.

3.5 Status tracking

The applications must be able to track and provide the statuses of reviews, audits, inspections, reports, documents, findings, and recommendations.

3.6 Case management

The primary purpose of case management is to track the status of the audit process, including tasks processed by multiple parties, multiple approving channels or transfer of responsibilities. Case management includes defined user roles and permits the addition of individuals on an ad hoc basis.

3.7 Connecting recommendations with corrective action plans

The solution must provide for management planning and oversight of corrective actions needed to address audit recommendations in a timely manner and comply with Federal Managers' Financial Integrity Act (FMFIA) requirements.

3.8 Tracks four two distinct audit resolution processes

1) Tracking of audits from announcement through to the completion of corrective actions; 2) Tracking of External/GAO audits from announcement to completion of corrective actions recommended in audit reports.

3.9 Reporting

The application must provide for integrated report writing, provide standard reports or templates and permit input of FCSIC-specific reporting templates. Scheduled report generation would be highly desirable. Information for reporting will require access to existing data and fields (from existing systems) and additional fields as determined by FCSIC. This working group will be formed prior to and during the configuration phase of the solution implementation.

3.10 Provided by client

(PBC) process

Must include an automated process for audit related Provided by Client (PBC) requests/deliverables that incorporates workflow, tracks due dates and other relevant dates, manages and holds every part of the process (including attachments), and provides status reports.

3.11 Automatic evidence

collection

Ability to attach audit evidence/documents and edit such evidence/documents within the software to avoid the storage of redundant data on the network and/or in a shared drive.

4.0 In addition to the above system requirements, the vendor shall design, configure, and set up the system to automate a number of key quarterly/monthly/weekly/daily reports that are currently prepared manually. The list of reports that are included within this requirement are detailed in Appendix A starting on page 210. We are referring to these reports as “Day 1” reports because the vendor shall have them built soon after the system is set up for users. The reports should be completed within 9 weeks from the contract award date. The reports shall require FCSIC to download the relevant source data into the system, and then the reports should automatically be updated and generated based on the source data and period the report is being run for. The reports shall be set up to be run during a frequency dictated by FCSIC, but no less than monthly.

5.0 The vendor shall also build FCSIC’s Annual Report template in the system and automate relevant financial reporting and trial balance data to interface with that report. The vendor shall incorporate prior year pictures and graphs (or new similar pictures/graphs, as determined by FCSIC) into the annual report so that the template is fully compliant. See https://www.fcsic.gov/financials/annual-reports for a copy of our most recent annual report. The vendor shall work with FCSIC’s current printer to establish that print colors and proper schemas are established and communicated. This work shall be completed within 9 weeks from the contract award date.

6.0 The vendor shall also set up the internal controls portion of the system with FCSIC’s updated Risk Control Matrix (RCM) and related policy and procedure documents. The vendor shall establish an executive dashboard over the internal control status. The vendor shall allow FCSIC up to 11 months after award date to prepare the RCM and other related support. Once the internal control documents (RCM, narratives, policies and procedures, etc.) are delivered to the vendor, they shall import them and create an executive dashboard within 9 weeks of delivery.

Each vendor shall complete the Excel file labeled Requirements Response Sheet and identify if their solution meets the requirements through 1) baseline product capabilities, 2) configuration of their system, or if the system will require 3) customization (coding to the baseline solution).

6. MILESTONES/DELIVERABLES

The acceptance of all deliverables will reside with the COR. The COR will consult with staff that will include FCA’s Office of Information Technology (OIT) to ensure the completeness of each stage of the project and to ensure that the requirements of the work has been met. Any discrepancies involving completion of project tasks or disagreement between FCSIC and the vendor will be submitted in writing and reviewed by the COR and FCSIC Contracting Officer.

Once a project phase is presented and the vendor provides their deliverables for review and approval, the COR will either sign off on the approval for the next phase to begin or reply to the vendor advising what tasks must still be accomplished.

The table below consists of the initial milestones and deliverables for CLIN01.

Milestone # Milestone/Deliverable Description CLIN 01-1 Project kickoff https://www.fcsic.gov/financials/annual-reports

CLIN 01-2 Required servers instantiated and FedRAMP security documentation completed, including, receiving an “authority-to-operate” from FCA.

Milestone # Milestone/Deliverable Description

CLIN 01-3

Implementation of vendor provided service:

- Installation of necessary platform software that meets the system requirements outlined in section 8 (namely, requirements 1.10 to 3.11)

- Access to servers provided to FCSIC staff and useable from FCA’s network

- Ability to use all components of Solution without connection issues.

99% of all transactions performed in the system shall occur within 1 second.

CLIN 01-4 Vendor solicits and documents AFR and Day 1 reports report requirements

CLIN 01-5 Vendor completes design and development of AFR and Day 1 report requirements

CLIN 01-6 Vendor performs 100% system test of CLIN 01-5 reports, within 6 to 9 weeks of contract award.

The table below consists of the initial milestones and deliverables for CLIN02.

Milestone # Milestone/Deliverable Description

CLIN 02-1

Vendor provides 100% system test scripts and results for all Day 1 reports developed. Test scripts should include at least 3 separate data sets over at least 2 financial statement periods. All system tests shall pass 100%.

CLIN 02-2 Vendor-provides user training CLIN 02-3 FCSIC performs 100% user-acceptance test of CLIN 01-4 reports

CLIN 02-4 Vendor provides final procedure guides for reports and processes developed for FCSIC.

CLIN 02-5 Vendor establishes internal control dashboard CLIN 02-6 12-months of managed hosting services invoiced monthly.

The table below consists of the initial milestones and deliverables for CLIN03.

The same milestones shall also exist for CLIN04, CLIN05 and CLIN06.

Milestone # Milestone/Deliverable Description

CLIN 03-1 Bug fixes, upgrades, and other system issues, if present, are resolved within 30 days of report. The vendor must remain FedRAMP Moderate-certified.

CLIN 03-2 12-months of managed hosting services invoiced monthly

The exact period of performance will be determined after the contract award. The base period and each option year will be for one-year periods.

7. PRICING CHART

The chart below is a guide with estimates based on the Corporation’s expected hours by the labor category during the base year and each option year. The vendor shall propose any labor categories they deem appropriate for the scope of work. The price quoted shall be all inclusive for each CLIN. Vendors are encouraged to provide additional details explaining their price quotation in addition to the chart.

CLIN Description Quantity MonthlyUnit

Price Total Price

CLIN01 Implementation Services 1 N/A$ $ CLIN02 Base Software Solution 12 $ $ CLIN03 Option Year 1 12 $ $ CLIN04 Option Year 2 12 $ $ CLIN05 Option Year 3 12 $ $ CLIN06 Option Year 4 12 $ $ CLIN07 Cost, if any, to work with FCA to implement Active Directory connection

1 N/A$ $

8. REFERENCES

The Corporation uses guidance from the publications listed below when completing its Agency Financial Report (AFR) and/or when monitoring internal controls. All Acts noted below are as amended. These references are included for background or informational purposes. They are:

• OMB Circular No. A-136, Financial Reporting Requirements – Revised (7/30/2018) provides guidance for Executive Branch entities to submit audited financial statements, interim financial statements, and Performance and Accountability Reports (PARs) or Agency Financial Reports (AFRs)

• Improper Payments Elimination and Recovery Act of 2010 (IPERA) and the Improper Payments Elimination and Recovery Improvement Act of 2012 (IPERIA)

• Federal Financial Management Improvement Act (FFMIA) of 1996 requires an assessment of the agency’s financial systems for adherence to government-wide requirements

• Government Management Reform Act (GMRA) of 1994 requires an agency to have audited financial statements

• Federal Managers’ Financial Integrity Act (FMFIA) of 1982 requires a report on the status of internal controls and agency priorities

• Prompt Payment Act of 1982

• Government Performance and Results Act (GPRA) of 1993 and Government

Performance and Results Modernization Act (GPRMA) of 2010

• Reports Consolidation Act of 2000

• Digital Accountability and Transparency (DATA) Act of 2014

• Federal Information Security Modernization Act (FISMA) of 2014

• Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015

• Audit Management Guidance: OMB Circular No. A-050, Audit Follow Up (09/29/1982)

9. CONTRACT

This contract is governed by federal law and will be construed accordingly. To the extent state law may apply, in the case where there is no applicable federal law, the state law that applies is the law of the Commonwealth of Virginia. The Corporation shall exclusively own all deliverables and all final work products. The contract shall have a base year plus four option years. The vendor shall propose a firm fixed price for the base and option years 1-4. Vendor’s fixed prices include any and all of vendor’s costs and expenses, direct and indirect, as well as any profit, fee, or any markups of any nature. Any modifications will be requested through FCSIC’s Contracting Officer, Mark Bowen and the FCSIC Contracting Officer’s Representative (COR), Andrew Grimaldi, for review and discussion. The vendor will not make any contractual agreement with any party to furnish any of the work or services under contract without approval of FCSIC’s COR. Travel expenses are not included in the contract and shall not be reimbursed.

10. PLACE OF PERFORMANCE

The vendor is expected to perform most of the work at their own facility, however, if needed, they may be requested to come to the FCSIC offices. If the vendor has different rates for on-site work compared to off-site work, the vendor will identify these in their solicitation.

11. CONFIDENTIALITY AGREEMENT

The vendor must sign a confidentiality agreement concerning the disclosure/nondisclosure of confidential information. The term “confidential information” means any information acquired by the vendor in carrying out the duties under the contract, including any information obtained before the date of the contract, and which had not become public information, including information regarding the Farm Credit System and Farm Credit System institutions, FCSIC, and the Farm Credit Administration.

Except as required by law or court order, the vendor shall not disclose or permit the disclosure of any confidential information, including this and any other engagement with FCSIC to anyone without FCSIC's expressed written consent. The Corporation will provide the vendor with access to electronic documentations, which may also be provided through printing of those documents, at the request of the vendor. Access to these documents shall be under the control of FCSIC personnel. Upon termination of this contract, all information, documents, and work products in the vendor’s possession relating to any work performed under this contract shall be returned to the COR of this project. FCSIC will review and may authorize the vendor to retain copies of any information that the vendor reasonably considers necessary for its confidential business records.

The vendor shall take all reasonable measures to avoid at any time any unintentional or inadvertent disclosure of any confidential information to any unauthorized person by the vendor’s employees, agents, or attorneys.

12. RIGHT TO CONTRACT EXTENSION FOR OTHER SERVICES

If FCSIC elects other tasks, within the scope of this SOW, they may be identified without competition and the vendor may assist to meet the goals of this project to include, but not limited to, one year of ongoing support.

13. RIGHT OF SUBSTITUTION

During the term of the contract, if FCSIC is not satisfied with the services provided by any employee of the vendor, the vendor will provide a substitute employee acceptable to FCSIC. If an acceptable employee cannot be provided, FCSIC reserves the right to terminate the contract.

14. CLAIM FOR RELIEF

FCSIC is a non-appropriated fund activity not subject to GAO’s bid protest provisions. Any claim for relief filed by a vendor shall be adjudicated by the FCSIC Contracting Officer. If the parties cannot reach an agreement mutually satisfactory after diligently pursuing a solution through discussions and negotiations, the FCSIC Contracting Officer shall make a final decision.

The FCSIC Contracting Officer’s decision shall prevail unless the vendor submits an appeal within 30 days of the Contracting Officer’s decision to the FCSIC Chief Operating Officer (COO). The decision of the COO shall be final and binding on the parties. Pending the final decision, the vendor remains obligated to proceed diligently with the performance of the contract, in accordance with the Contracting Officer’s decision.

15. EMPLOYER-EMPLOYEE RELATIONSHIP

This contract does not create an employer-employee relationship between the Corporation and the vendor. The vendor will be responsible for any and all obligations arising from its status as an independent vendor, including but not limited to, tax reporting and payment obligations.

Neither the vendor nor any of its employees will be considered as a Federal employee for any purpose, nor will it be regarded as performing a personal service or be eligible for civil service employee benefits. If subcontracting is permitted, the use of the term “vendor” herein refers to both the vendor and all subcontractors at all levels. Vendor must ensure that all subcontractors adhere to all of the terms and conditions of this contract that have flow-down requirements.

16. NOTICE TO FCSIC OF DELAYS

In the event the vendor encounters difficulty in meeting performance requirements, or when the vendor anticipates difficulty in complying with the performance schedule, or whenever the vendor has knowledge that any actual or potential situation is delaying or threatening to delay the timely performance of this contract, the vendor shall immediately notify the FCSIC Contracting Officer and the COR in writing, giving pertinent details; provided, however, that the data shall be informational only in character and that these provisions shall not be construed as a waiver by the Corporation of any delivery schedule or date, or of any rights or remedies provided by law or under this contract.

17. NO IDEMNIFICATION

FCSIC will not indemnify, waive, or disclaim any rights or obligations to the vendor as a result of services performed under this contract.

18. NO UNPAID FEDERAL TAX LIABILITY

No contract award is to be made to any entity that has any unpaid Federal tax liability that has been assessed, for which all judicial and administrative remedies have been exhausted or have lapsed, and that is not being paid in a timely manner pursuant to an agreement with the authority responsible for collecting the tax liability.

19. TERMINATION CLAUSE

FCSIC, in its sole discretion, may terminate performance of work under this contract in whole or, from time to time, in part if the Contracting Officer determines that a termination is in the FCSIC’s interest. The Contracting Officer shall terminate by delivering to the vendor a Notice of Termination specifying the extent of termination and the effective date.

After receipt of a Notice of Termination, and except as directed by the Contracting Officer, the vendor shall immediately proceed with the following obligations, regardless of any delay in determining or adjusting any amounts due under this clause:

(a) Stop work as specified in the notice.

(b) Place no further subcontracts or orders (referred to as subcontracts in this clause) for materials, services, or facilities, except as necessary to complete the continued portion of the contract.

(c) If applicable, terminate all subcontracts to the extent they relate to the work terminated.

(d) Assign to FCSIC, as directed by the Contracting Officer, all right, title, and interest of the vendor under the subcontracts terminated, in which case the FCSIC shall have the right to settle or to pay any termination settlement proposal arising out of those terminations.

(e) With approval or ratification to the extent required by the Contracting Officer, settle all outstanding liabilities and termination settlement proposals arising from the termination of subcontracts; the approval or ratification will be final for purposes of this clause.

(f) As directed by the Contracting Officer, transfer title and deliver to FCSIC (i) the fabricated or unfabricated parts, work in process, completed work, supplies, and other material produced or acquired for the work terminated, and (ii) the completed or partially completed plans, drawings, information, and other property that, if the contract had been completed, would be required to be furnished to FCSIC.

(g) Complete performance of the work not terminated.

(h) Take any action that may be necessary, or that the Contracting Officer may direct, for the protection and preservation of the property related to this contract that is in the possession of the vendor and in which the FCSIC has or may acquire an interest.

The cost principles and procedures of part 31 of the Federal Acquisition Regulation, in effect on the date of this contract, shall govern all costs claimed, agreed to, or determined under this clause.

20. CLAUSES INCORPORATED BY REFERENCE

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the FCSIC Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this address:

http://www.arnet.gov/far/

Clause Title Date FAR Ref 52.202-1 Definitions JUL 2004 2.201 52.203-3 Gratuities APR 1984 3.202 52.203-5 Covenant Against Contingent Fees APR 1984 3.404 52.203-7 Anti-Kickback Procedures JUL 1995 3.502-3 52.203-13 Contractor Code of Business Ethics and Conduct APR 2010 3.1009(a) 52.204-9 Personal Identity Verification of vendor Personnel NOV 2006 4.1301 52.222-55 Minimum Wages Under Executive Order 13658 DEC 2014 22.1906 52.239-1 Privacy or Security Safeguards AUG 1996 39.107 52.242-15 Stop-Work Order AUG 1989 42.1305(b) 52.243-1 Changes – Labor Hours SEP 2000 43.205(c) 52.246-6 Inspection of Services MAY 2001 46.306 52.246-25 Limitation of Liability - Services FEB 1997 46.805 52.249-2 Termination for Convenience of the Government APR 2012 49.502(b)(1)(i)

21. SOLICITATION

The vendor’s proposal will be reviewed by a panel whose decision for reward will be based on the best value for FCSIC. Best value will be determined based on the vendor’s ability to meet FCSIC requirements, previous work experience providing cloud software services and total price.

If FCSIC elects, oral discussions for clarifications may be held prior to awarding the contract including, but limited to, live demonstrations of software capabilities. All questions regarding the statement of work should be submitted in writing to the Contracting Officer not later than 5 days prior to the closing date.

This solicitation does not commit the FCSIC to award any contract, to pay any cost incurred related to proposal submission, oral presentation, or any subsequent negotiations.

To be considered for contract award, the proposal must include:

• Description of company, partners, service offering, and any assumptions or exceptions to stated requirements

• A copy of the organization’s most recent Service Auditor Report related the solution being proposed.

• Completed Requirements Matrix for all requirements identified

• Evidence of an existing FedRAMP moderate certification

• Completed Milestone Delivery Chart for each CLIN

• Past performance reference for similar cloud-based software solution for at least 3 agencies or corporations, at least two of which is with a US Federal or state government (Preference is given to references that are similar in platform and architecture to FCSIC’s requirements as detailed by this Statement of Work.)

http://www.arnet.gov/far/

• Fixed-priced bid, inclusive of all costs, provided in the Pricing Chart section above.

Bids with annual costs in any given year over $75,000 will be excluded from consideration.

• The proposal shall be signed by an authorized officer of the vendor who can commit the vendor, and shall include a statement that the offer is valid for a period of not less than 120 days, unless withdrawn by written notice to the Contracting Officer.

Any proposal that fails to comply with the material requirements of this solicitation may be considered non-responsive and may be eliminated from further consideration.

All pages should be typewritten, using a minimum 10-point size font with 1” margins on 8.5”x11” (letter) paper. All responses must be submitted not later than 5:00 p.m. EST, on Monday, 12/273/2020 to the following:

Mark Bowen Contracting Officer, Farm Credit System Insurance Corporation 1501 Farm Credit Drive Suite 3600 McLean, VA 22102 or via email to: bowenm@fcsic.gov

22. METHOD OF PAYMENT

Payments by FCSIC under this contract shall be made by electronic funds transfer (EFT). FCSIC may, at its option, also forward the associated payment information by electronic transfer. As used in this section, the term “EFT” refers to the funds transfer and may also include the information transfer.

In the event the FCSIC is unable to release one or more payments by EFT, the vendor agrees to either -

a. Accept payment by check or some other mutually agreeable method of payment; or

b. Request FCSIC to extend payment due dates until such time as the FCSIC makes payment by EFT.

The vendor is required, as a condition to any payment under this contract, to provide FCSIC with the information required to make payment by EFT by registering in the General Services Administration’s System for Award Management (SAM).

Prior to submission of the first request for payment (whether for invoice or contract financing payment) under this contract, the vendor shall provide the information required to make contract payment by EFT directly to SAM. In the event that the EFT information changes, the vendor shall be responsible for providing the changed information to SAM.

The vendor shall designate a single financial agent capable of receiving and processing the electronic funds transfer using the EFT methods. The vendor shall pay all fees and charges for receipt and processing of transfers.

Liability for uncompleted or erroneous transfers:

a. If an uncompleted or erroneous transfer occurs because FCSIC failed to use the vendor-provided EFT information in the correct manner, FCSIC remains responsible for

(i) Making a correct payment;

(ii) Paying any prompt payment penalty due; and

(iii) Recovering any erroneously directed funds.

b. If an uncompleted or erroneous transfer occurs because vendor-provided EFT information was incorrect at the time of FCSIC release of the EFT payment transaction instruction to the Federal Reserve System, and

(i) If the funds are no longer under the control of the CFO, FCSIC is deemed to have made payment and the vendor is responsible for recovery of any erroneously directed funds; or

(ii) If the funds remain under the control of the CFO, FCSIC retains the right to either make payment by mail or suspend the payment in accordance with paragraph 4 of this section.

In the event that payment is not received timely, determination of interest due will be under the provisions of the Prompt Pay regulations at 5 CFR Part 1315.

FCSIC is a Federal Government-controlled corporation and is exempt from State sales tax.

Therefore, it is not required to pay sales tax on invoices submitted to it and if included, the amounts will be deducted from the total amount invoiced.

Upon FCSIC adopting the Administrative Resource Center’s (ARC) Invoice Processing Platform (IPP) (expected in 2020), the vendor shall submit payment requests electronically using the Invoice Processing Platform (IPP). Information regarding IPP is available on the Internet at www.ipp.gov. Assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email ippgroup@stls.frb.org or phone (866)973-3131. For payment and invoice questions, contact the Accounts Payable Branch at (304) 480-8000 option 7 or via email at AccountsPayable@fiscal.treasury.gov.

23. EQUAL OPPORTUNITY

During the performance of this contract, vendor agrees to comply with Executive Order 11246, as amended, and the rules, regulations and relevant orders of the Secretary of Labor. In the event vendor does not comply with this clause, or with any of the rules, regulations or orders referred to herein, FCSIC may cancel, terminate or suspend this contract, in whole or in part.

24. JOINT AND SEVERAL LIABILITY

If vendor is organized as a joint venture, the liability of the members of the joint venture in connection with all duties, obligations and liabilities under this contract is joint and several.

http://www.ipp.gov/ mailto:ippgroup@stls.frb.org mailto:AccountsPayable@fiscal.treasury.gov

25. ADVERTISING AND PUBLICITY

Except as specifically described in this provision, the vendor shall not make statements to the media or issue press releases regarding the award of the contract, or goods or services provided under the contract. Requests for information from the media or public must be directed to the Contracting Officer, who will obtain appropriate approvals for a response, if any, from the FCSIC. Advertising or publicity materials (including the placement of information on vendor’s website) may include a reference to FCSIC in a list of the vendor’s clients, along with a short, broad description of the goods or services provided. In no event may any confidential information regarding the details of the contract be disclosed. Without the prior written approval from the FCSIC, the vendor shall not:(i) issue or sponsor any advertising or publicity (including the placement of information in its website) that states or implies the FCSIC endorses, recommends or prefers the vendors goods or services; or (ii) use the FCSIC’s logo or other FCSIC material or refer to the FCSIC in its advertising and publicity materials (including its website). The prohibitions also apply to information placed on social networks (Twitter, Linkedin, Facebook, blogs, etc.). All requests for such approvals must be submitted to the Contracting Officer at least 30 days prior to the scheduled release of advertising or publicity materials. The vendor agrees to include this clause in all its subcontracts under this contract.

Nothing in the foregoing releases vendor from its obligations under the confidentially provision above.

26. APPENDIX A

Listing of “Day 1” Dashboards the Vendor will Design as Part of the Solicitation There are four main sources where we get information from and use it to create reports:

1.…