Final_OCC_Treasury_RFI_Security_Purview.pdf

Request for Information (RFI)

Office of the Comptroller of the Currency (OCC) – Treasury

Subject: Secure Third-Party Collaboration Solutions to Support OCC Bank Audits

1. Introduction The United States Office of the Comptroller of Currency (OCC) is conducting market research to determine the feasibility for a potential procurement requirement. This is NOT a solicitation for proposals, proposal abstracts, or quotations. The purpose of this notice is to obtain information from industry contractors regarding their interest, capabilities, and recommendations for a third-party solution that extends Microsoft 365 for secure external collaboration with banks and other regulators. OCC examiners must securely exchange bank supervisory evidence and documentation with financial institutions while maintaining a closed-tenant security posture (i.e., no guest accounts in OCC’s Microsoft 365 tenant).

This RFI seeks information on vendor capabilities to provide solutions that:

• Simplify and enhance OCC’s bank supervision workflows.

• Leverage OCC’s Microsoft 365 (M365) investment without duplicating data into another platform.

• Integrate with Microsoft Purview Data Loss Prevention (DLP) and other compliance controls.

• Provide trusted, auditable, and branded collaboration mechanisms for OCC-bank interactions.

• Meet or exceed Federal information security requirements, including FedRAMP and

NIST standards.

This RFI is issued solely for information and planning purposes and does not constitute a solicitation or a commitment by the Government.

2. Background OCC bank supervisory personnel oversee and examine banks under OCC’s jurisdiction.

Collaboration during audits must balance security with efficiency. The goal is to extend

Microsoft 365’s native capabilities to avoid the risks associated with complex external-sharing configurations like Entra ID B2B guest accounts, or completely separate appliances and tools which are complex to integrate and maintain. Some challenges include:

• Difficulties in lifecycle management and risks associated with oversharing due to B2B guest accounts.

• Limited branding options, which can undermine recipient trust.

• Complex external-sharing administration with inconsistent auditability. OCC seeks third-party solutions that extend the native capabilities of Microsoft 365 services without requiring complex and risky B2B configurations.

• We aim to invest in solutions that build upon and enhance our existing Microsoft 365 infrastructure, thereby reducing the risks of added complexity.

• These solutions should facilitate secure collaboration during audits while ensuring full compliance and audit readiness.

3. Objectives

Through this RFI, OCC intends to:

1. Identify third-party solutions that extend M365 without guest accounts.

2. Ensure strong integration with Microsoft Purview DLP and OCC’s compliance controls.

3. Provide OCC with auditable, branded collaboration tools for supervisory personnel and banks.

4. Maintain OCC’s closed-tenant security posture and regulatory compliance.

5. Inform OCC’s acquisition strategy for secure, efficient audit collaboration platforms.

4. Requested Information from Vendors

A. Company and Product Overview

• Company background and experience in highly regulated industries.

• Overview of proposed solution(s).

B. Technical Capabilities

• Integration with OCC’s Microsoft 365 (SharePoint Online, OneDrive, Teams).

• Mechanisms to collaborate externally without guest accounts.

• Integration with Microsoft Purview DLP and audit/compliance frameworks.

• Support for branded, trusted sharing links (custom domains, OCC branding).

• Resilience when recipient institutions block M365 sharing links.

• Audit logging, lifecycle management, and conditional access support.

C. Operational Capabilities

• User experience for supervisory personnel and bank participants.

• Evidence request workflows, file uploads, versioning, and traceability.

• Scalable handling of large volumes of files and multiple concurrent audits.

• Comprehensive reporting and analytics (usage, anomalies, compliance).

D. Compliance and Security

• FedRAMP authorization or equivalent certification.

• End-to-end encryption (data in transit and at rest).

• Controls to prevent oversharing (no Anyone links).

• Legal hold, eDiscovery, and retention management integration with OCC systems.

• Support for OCC’s auditing and compliance policies.

E. Implementation and Support

• Deployment models (SaaS, hybrid, U.S.-based hosting).

• Implementation timeline and required resources.

• Training and ongoing support services.

F. Pricing Information

• High-level pricing model (licenses, subscriptions, usage-based).

• Availability under government pricing schedules (GSA, SEWP, etc.).

5. Vendor Demonstrations OCC may invite multiple vendors to demonstrate their solutions. Demonstrations will focus on how solutions integrate with M365, Purview DLP, and OCC’s security posture.

Demonstrations are for market research only and will not substitute for competitive procurement.

6. Response Instructions Provide your company profile information to include:

a. Company Name and Physical Address

b. Unique Entity ID (UEI) from SAM.gov

c. Small Business Size Status

d. Small Business Socioeconomical Status (if any)

e. Designated point of contact’s name, title, email address, and phone number

Responses should be submitted electronically in Word or PDF (20 pages max) to:

Danielle Peña

Contract Specialist

Administrative Operations – Acquisition Management

Office of the Comptroller of the Currency

Email: Danielle.Pena@occ.treas.gov

Response Due Date: Noon ET, Friday, September 12, 2025

7. Disclaimer This RFI is for information and planning purposes only. It does not obligate OCC to issue a solicitation or award a contract. Responses are not offers and cannot form binding agreements with the Government.

Attachment A – Minimum Product Requirements / Salient Characteristics

• No Microsoft B2B guest accounts or unauthenticated links permitted.

• Data remains in OCC’s M365 tenant (no duplication to external CSPs).

• Integration with Microsoft Purview DLP to enforce OCC data protection policies.

• Supports OCC-branded collaboration portals/links (not sharepoint.com).

• Resilient against scenarios where banks block Microsoft 365 sharing links.

• Comprehensive auditing, logging, and lifecycle management of external collaboration.

• FedRAMP-aligned security controls with support for encryption, legal hold, and eDiscovery.

• Supports evidence request workflows, versioning, and controlled file exchanges.

Attachment B – Vendor Response Template Vendors should complete the table below to align their solution with OCC’s requirements.

Requirement

Category

Requirement Meets /

Exceeds / Does

Not Meet

How

Requirement is

Addressed

Supporting

Evidence

Technical No guest accounts in OCC tenant

Security &

Compliance

Integration with Microsoft

Purview DLP

Operational Auditing and evidence request workflows