FTC-18-Q-0004_Redress_Base_Solicitation_7-12-18.pdf

RFP# FTC-18-Q-0004 Page 3 of 91

Table of Contents

SECTION 1 – PERFORMANCE WORK STATEMENT

SECTION 2 – SERVICES AND PRICES

SECTION 3 – GENERAL TERMS AND CONDITIONS

SECTION 4 – FEDERAL ACQUISITION REGULATION (FAR) PROVISIONS AND

CLAUSES

SECTION 5 – FEDERAL TRADE COMMISSION (FTC) CLAUSES

SECTION 6 – LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

SECTION 7 – QUOTATION PREPARATION INSTRUCTIONS

RFP# FTC-18-Q-0004 Page 4 of 91

SECTION 1 – PERFORMANCE WORK STATEMENT (PWS)

1.1 INTRODUCTION

The Federal Trade Commission (FTC) has a mission to protect consumers by combating unfair business practices. The FTC’s Bureau of Consumer Protection (BCP) litigates cases that often result in monetary judgements that are used to provide redress to consumers.

Distributing these funds is a major undertaking. The FTC relies on private sector support for a portion of the administration of the claims processing and fund distribution.

This requirement is for delivery of services to support redress administration (claims processing and funds distribution). Specifically, contractors shall perform the following:

A. Operate efficient and cost effective claims administration, which permits claimants worldwide to receive redress from defendant-funded settlements. The FTC strives to complete a redress distribution within 6 months after of receiving the necessary funds and data;

B. Provide the FTC with access to current and historical case-specific claimant and financial data for both open and closed cases through standard and ad hoc reports that the contractor is to collect, configure and deliver; and

C. Receive and promptly process claimant inquiries using easily accessible points of contact and provide consistent, timely, and professional responses (via internet, telephone, postal channels and other contact methods as needed).

1.2 BACKGROUND

1.2.1 Bureau of Consumer Protection (BCP)

The FTC’s Bureau of Consumer Protection (BCP) litigates cases that, when favorably adjudicated, often result in the establishment of redress distribution funds that are used to provide redress to affected consumers. Each redress distribution fund constitutes a Qualified Settlement Fund (QSF) for tax and depository bonding purposes. Disbursement of redress funds is made pursuant to distribution plans that are approved, either by courts, administrative law judges, or at the FTC’s discretion pursuant to applicable laws. In some cases, if direct payment to consumers or indirect restitution is not practical, the redress money is used to fund a consumer education program. Proper redress administration requires timely and accurate claims administration and the protection of personally identifiable claimant information.

RFP# FTC-18-Q-0004 Page 5 of 91

1.2.2 Office of Claims and Refunds (OCR)

The Office of Claims and Refunds (OCR), which is part of BCP’s Division of Consumer Response and Operations, is responsible for administering and coordinating redress activities.

OCR’s objective is to return funds to approved claimants as expeditiously as possible. OCR’s goal is to complete a redress distribution within six (6) months after a case is assigned to the contractor, and to close all redress cases within twenty-four (24) months, unless special circumstances prevent completion within this time period. Longer periods can be planned—for example, when the payment of redress funds is made in installments over an extended period— or unplanned, for example, when claimant data is insufficient.

1.2.3 Historical Data

Currently, the OCR oversees four contractors that manage approximately 60 cases involving $460 million dollars in redress funds. Between June 2016 and July 2017, contractors processed approximately 28 distributions and mailed 6.2 million redress checks amounting to $391 million.

1.3 SCOPE OF WORK (GOVERNMENT NEEDS & CONTRACTOR

REQUIREMENTS)

This contract is for redress administration services (claims administration and funds distribution) in support of the FTC consumer protection mission. The FTC’s Designated Agency Representative (DAR) will assign new cases and create work assignments. The contractor shall provide efficient and cost effective claims processing and associated administrative, technical, and management services for claimants and victims located both within and outside the U.S.

The contractor shall service claims for all judicial districts, Puerto Rico, and other U.S.

territories. Although the majority of communications and interactions with claimants and victims will be within the U.S., there may be claimants and victims located outside the U.S., which will be noted in individual case assignments, as applicable.

A. The contractor shall provide all personnel, equipment, tools, supervision, and other items and services necessary to ensure efficient and cost effective claims administration, including online claim filing, which permits class members worldwide to receive redress from defendant-funded settlements;

B. Contractor Information Technology (IT) systems must be scalable to accommodate FTC needs and compatible with the FTC’s Redress and Enforcement Database and other systems, programs, and utilities the FTC uses. The contractor shall provide the FTC access to case-specific claimant and financial transaction information through accurate standard and ad hoc reports. All electronic documents shall use Microsoft Office software products (e.g., Word, Excel, Access), unless otherwise agreed to in writing by the COR;

RFP# FTC-18-Q-0004 Page 6 of 91

C. The contractor shall provide consistent, accurate, timely, and professional responses (internet, telephone and 1st class U.S. Postal Service (USPS) mail or foreign equivalent) to claimant inquiries using easily accessible points of contact;

D. All contractor-provided support staff shall be located within the United States (US). The government will not supply any workspace;

E. The contractor shall establish and maintain a Quality Control Plan (QCP) to use as a basis for the government’s monitoring of the contractor’s performance, so that it may assure itself that the requirements of this contract are provided as specified; and

F. The contractor shall complete all necessary tasks for a case and bill at the rate first assigned to the case. Task prices are determined when the case is assigned, not by the period in which the services are performed.

1.4 TASKS DEFINED - GOVERNMENT NEEDS

1.4.1 Task #1 – Money Management

When assigned a new case, the contractor shall open one case-specific, non-interest bearing Federal Deposit Insurance Corporation (FDIC) insured checking account for distribution. The contractor shall open the redress checking account within three (3) business days of receiving the case assignment by the DAR. The contractor shall close the redress checking account after the final distribution, upon the written instruction of the DAR. It is estimated that each redress checking account will remain open up to 24 months.

Note: If after opening a Work Assignment and/or transferring funds to the contractor, the government for whatever reason, does not perform any additional activity under the order within three hundred and sixty-five (365) days, the contractor may invoice the government for the management fee as listed on the pricing schedule.

A. The QSF bank account shall be established using the name of the assigned redress case in an

FDIC-insured domestic financial institution. Funds will be transferred from the government to the contractor, via electronic wire transfer into the case-specific QSF for distribution.

B. For each QSF bank account, the contractor shall:

1) Provide the Contracting Officer Representative (COR) and his/her representative with read-only rights to online banking;

2) Obtain the COR’s written approval and authorization of claims distribution in accordance with policy or the court or administrative order prior to any disbursements;

RFP# FTC-18-Q-0004 Page 7 of 91

3) Ensure that the bank returns to the contractor all original canceled checks (front and back) or clearly legible images of all original canceled checks (front and back) and/or bank drafts and bank statements. The contractor shall store these images and provide them to FTC;

4) Ensure that each checking account has “payee-name-and-check-amount-based-positive-pay” or similar services to combat check fraud;

5) Provide to the COR or a designee the following details within one (1) business day of bank account opening: date established, name of the account, account number and type, physical location of account, and signature cards;

6) Ensure that the COR receives bank statements each month by the fifteenth (15th) calendar day for the previous month;

7) Upon request, provide to the CO, COR, General Counsel (GC), and/or Inspector General (IG) any information requested that pertains to the bank records and fund activities;

8) Ensure that after receiving written notification of a needed correction to bank and/or financial statements that the appropriate corrections are made within forty-five (45) calendar days;

9) Prepare and provide to the COR a reconciliation of the prior month’s activity of each redress bank account on the following schedule – September, December, March and June. Reconciliations shall be provided on or before the 5th business day after the end of those months; all other reconciliations shall be provided on or before the 7th business day after the end of the month via secure email;

10) Prepare and maintain a check register in each case accounting for all checks printed which shall include, at a minimum, the check number, date issued and cashed, payee, and check amount. The contractor shall not maintain an inventory of unused check stock pre-printed with Magnetic Ink Character Recognition (MICR) account numbers and routing information. The contractor shall maintain the originals and/or images of all checks, which were voided or otherwise spoiled, and all checks that were returned by the Post Office and remained undeliverable. The contractor also shall maintain records of all checks issued but not cashed prior to the expiration date of the check; and

11) Prepare and maintain a register in each case accounting for all debit and purchase cards distributed which shall include, at a minimum, the card number, date issued and cashed, payee, and card value. The contractor also shall maintain records of all cards issued but not cashed prior to their expiration date.

RFP# FTC-18-Q-0004 Page 8 of 91

C. Tax Identification Number:

The contractor shall, within three (3) business days of receipt of the initial Work Assignment, obtain a Tax Identification Number (TIN) for each redress case assigned and send it to the

FTC.

The contractor also shall:

1) Prepare for the COR’s review, and after approval, timely file all necessary tax returns, forms, and reports with the appropriate government agencies;

2) Pay all required taxes, if applicable, from the redress fund and deposit any tax refunds into the QSF bank account or return the tax refund to the FTC if the related QSF bank account is closed; and

3) Deliver a copy of any required income tax returns to the COR at the time the contractor invoices for the associated tax preparation fees.

D. Liability Insurance and Employee Dishonesty Bonding:

1) The contractor shall obtain and maintain professional liability insurance and employee dishonesty bonding coverage at levels reasonable and customary in the banking industry. At a minimum, the contractor must carry liability insurance of ten million dollars ($10,000,000) and employee dishonesty bonding of five million dollars ($5,000,000). The blanket policies shall apply to all Work Assignments. The policies shall be executed in favor of both:

(a) the Federal Trade Commission for the benefit of the potential redress recipients pursuant to such judgment(s) administered under the Contract, and

(b) the potential redress recipients pursuant to such judgment(s).

2) The contractor shall ensure that the insurer is committed to provide 60 calendar days advance notice of policy, modification and/or cancellation. The contractor shall inform the CO and COR within ten business days if ever an occurrence arises in which the contractor’s existing bonding and insurance policy is insufficient to cover the Work Assignment(s) assigned. The policies, at a minimum, shall meet all government requirements listed herein; and

3) The surety on the bond must represent and warrant that it holds a Federal Certificate of Authority as Acceptable Surety On Federal Bond and Reinsuring under, and is in full compliance with, 31 U.S.C. §§ 9304 and 9308 and Treasury Department Circular 570. The insurance policy and bond shall apply to the contractor, its agents, and all employees performing services related to this contract. The insurance policy and bond shall cover errors and omissions, RFP# FTC-18-Q-0004 Page 9 of 91 employee dishonesty and any action or failure to act on the part of the contractor, its agents or employees relating to the redress bank account(s) including but not limited to failure to properly account for the redress funds, check fraud, failure to properly process claims, or any other action affecting the distribution of the redress fund, regardless of whether the action or inaction is the result of negligence or not.

E. Depository Bonding:

1) For each case assigned, the contractor(s) shall take all necessary administrative steps for the redress funds to qualify for the FDIC pass-through deposit insurance for beneficiary accounts. The FDIC coverage shall be based upon the ownership interest of each beneficiary for up to $250,000 in deposit insurance.

Note: All distributions requested by work assignment require prior written approval from the DAR.

1.4.2 TASK #2 - HELP SERVICES

At a minimum, HELP SERVICES shall include responding to requests and inquiries received via telephone or written mail (or e-mail) from potential claimants. The Contractors shall respond in either English or Spanish, depending upon the language the caller uses.

A. Interactive Voice Response (IVR): The contractor will be required to provide toll-free

IVR (24/7/365) services for consumers seeking information on the status of the redress distribution. This system shall be regularly updated to ensure the case information and status is up-to-date and claimants are provided with accurate information. The volume of calls will be dependent upon the size of the redress distribution.

1) IVR services will include FTC "pre-approved/scripted" responses to:

(a) requests for information;

(b) frequently asked questions;

(c) claimant registration;

(d) claim form fulfillment; and

(e) claim status.

2) The contractor also must provide the ability for the caller to opt out of the IVR and interact with a live operator during the hours of 8:00am - 5:00pm Eastern Time (ET), on the days that the Federal Government is in operation.

3) Occasionally, FTC staff receives consumer calls, which in turn, may be redirected to the redress contractor for official processing.

B. WEBSITE HOSTING: When assigned the task of website creation, the contractor shall create, develop and host a Section 508 compliant website. The website shall:

RFP# FTC-18-Q-0004 Page 10 of 91

1) be maintained, and as necessary, updated regularly ensuring the information, data, and forms are accurate and up-to-date; and,

2) at a minimum, provide the following information and documents, unless otherwise indicated by the COR:

(a) online claim filing;

(b) case status;

(c) web links to the FTC’s case specific Uniform Resource Locator (URL);

(d) case and contact information;

(e) relevant notification and details for potential claimants; and

(f) claimant rights and Privacy Act Statement.

Note: All websites must receive the COR’s written approval before going live. For all web-based features, the system shall be compatible with and have complete functionality using the latest version of the industry standard browsers and two previous versions (e.g., Firefox, Internet Explorer, Chrome, and Safari), and must be mobile optimized. See security requirements within FTC clauses.

1.4.3 TASK #3 - CLAIMS PROCESSING AND ELIGIBILITY

In accordance with the Work Assignment’s instructions, the contractor shall process and finalize the claimant list. Such electronic or manual processing may include one or more of the following items.

A. CLAIMS DATA (Care of): The DAR shall be the sole source of the initial existing claimant information and the contractor shall not accept the initial existing claimant information from any other internal or external source.

1) Electronic or manual formatting of the claimant data is subject to audit by the FTC.

The FTC will assign a unique identifier to each claimant before sending the list to the contractor. The contractor is required to keep this unique identifier attached to the claimant for the life of the case;

2) All electronic claimant data shall be encrypted for transmission between the FTC and the contractor or transferred via the FTC’s Secure File Transfer Protocol. Electronic data must also be encrypted at rest; and

3) Claimant data in hard copy format will be transmitted by OCR to the contractor via overnight delivery and shall be insured with and tracked by the delivery company.

The case will incur shipping costs of transporting such material.

B. DATA RECONCILIATION: The contractor shall utilize the existing claimant information to establish a preliminary list of potential redress recipients for each case assigned.

1) Depending on the nature and extent of the initial existing claimant information, the contractor may be required to prepare the data list for mailing;

RFP# FTC-18-Q-0004 Page 11 of 91

2) In some instances, the establishment of the preliminary list shall require the contractor to implement a Consumer Identification process (“Public Notice Campaign”) to identify potential redress recipients. See Task #5;

3) The contractor may be directed to obtain corrected names, mailing and email addresses using the USPS, Internet and other directory searches; and

4) The contractor may be directed to perform additional specialized searches if required by the Work Assignment.

C. INITIAL COR VERIFICATION OF CLAIM DATA: In a small number of cases, the contractor shall analyze all claim forms submitted by potential redress recipients, determine the sufficiency of supporting documentation, and develop and maintain a list of potential claimants who appear to meet all requirements for participation in the redress distribution. The contractor also shall calculate the projected dollar amount each proposed claimant is to receive from the redress fund. Method of calculation may vary according to the case.

The contractor may be instructed under the Work Assignment to:

1) Enable claimants to access and complete claim forms on-line;

2) Re-mail claim forms to victims whose correspondence was returned with an address correction/notification;

3) Contact potential redress recipients who appear to qualify for participation in the redress fund but whose documentation is lacking in some respect, and request they supply corrected documentation.

The contractor shall prepare and provide to the COR:

1) A list of persons whose claim forms are deficient. The COR may in-turn attempt to obtain the required eligibility verification from other sources. If the COR’s attempts are unsuccessful, the contractor may be instructed to notify the potential claimants that their claim has been denied. Eligibility requirements will be determined by the FTC on a case-by-case basis and will be communicated when a case is assigned.

2) Upon completion of the claims analysis and verification procedures, the contractor shall prepare and provide the COR:

(a) A proposed redress distribution list containing contact information along with the projected dollar amount each proposed claimant is to receive from the fund and

RFP# FTC-18-Q-0004 Page 12 of 91

(b) A proposed list of any persons or categories of persons who have filed a claim against the redress fund but who the contractor proposes will not receive a distribution for reasons including, but not limited to, the failure to provide the proper verification of their eligibility, or those cases where the available funds are not sufficient to provide a meaningful distribution because of the number of claimants.

D. CLAIM FINALIZATION: The COR shall review the proposed redress distribution list and if found acceptable, the COR shall provide in writing to the contractor approval to proceed with the distribution.

1) The contractor shall ensure that the eligible recipients receive only their entitled portion of the redress funds.

2) The contractor may be instructed to notify all persons filing a claim against the redress fund but who are not selected to receive a distribution. The notification shall be developed using legally correct, but easily understood language. All notifications to claimants must be reviewed and approved in writing by the COR.

3) The contractor, at a minimum, shall prepare and maintain logs of the following, where applicable:

(a) potential claimants who inform the contractor, in writing, of their desire not to participate in the redress fund distribution;

(b) potential claimants whose notification letters remain undeliverable even after attempts to obtain corrected name and address information;

(c) potential claimants who do not respond to the notification letter within the time period specified for filing claims against the redress fund;

(d) duplicate entries and claims not eligible to participate in the redress fund;

(e) potential claimants whose claim forms remain insufficient;

(f) number of valid claims submitted;

(g) total number of claims submitted and the method by which they were received;

(h) number of calls received from claimants;

(i) number of unique visits to the claim website, if one is developed; and

(j) number of address changes submitted and updated.

RFP# FTC-18-Q-0004 Page 13 of 91

E. Upon completion of all Claims Processing and Eligibility phase activities, the contractor shall prepare an invoice for the work performed in accordance with the processing terms of the contract.

Note: Written prior approval from the COR is required before the contractor can proceed with distributing any item.

1.4.4 TASK #4 – REDRESS DISTRIBUTION

In accordance with the Work Assignment’s instructions, the contractor shall prepare a distribution plan to administer funds in the QSF bank account to qualified claimants. The contractor is solely responsible for the accuracy of each redress distribution (based on the COR approved lists). The contractor is held accountable to correct contractor errors at the contractor’s own expense.

A. The contractor shall prepare checks, bank drafts, purchase cards, debit cards, coupons, or any other FTC-approved funds distribution instrument using commercially available means and as appropriate to the redress fund distribution requirements. At a minimum, the items shall contain the case name, expiration date, claimant name, or any other condition that must be complied with to receive money from the redress fund. Per the Work Assignment, the contractor may be tasked with producing, printing and duplicating correspondence, which may be in excess of two pages, i.e. additional cover letters, educational brochures, or other required documents as deemed necessary by the FTC for distribution with the above financial instruments. The FTC may direct the contractor to produce attachments as either double-sided, printed in black and white, or color.

B. The contractor shall distribute redress and include any accompanying cover letter, brochures and other documents up to 2 pages and charge the FTC no more than the U.S.

Postal Service "one ounce" rate charged for first class mail. If authorized by the COR, additional expense for including documents exceeding two pages may be charged to the government. Any additional postage expense (including the cost of international postage, if required) will be reimbursed at cost - without mark-up. See FTC Clauses.

1) Multiple distributions to claimants, up to 100% of loss, are sometimes required to exhaust refunds. Subsequent distributions shall follow the pricing schedule set forth in the original distribution and

2) Distributions of uncashed checks and/or returned checks may be requested by the

COR. Subsequent distributions shall follow the pricing schedule set forth in the original distribution.

C. In limited situations that require fund recipients to receive a tax form required for tax preparation, the contractor shall mail the appropriate IRS form (e.g., IRS Form 1099) and cover letter within 30 calendar days of the end of the corresponding tax year. When required the Work Assignment will cite this requirement. Postage expense (including the

RFP# FTC-18-Q-0004 Page 14 of 91 cost of international postage, if required) will be reimbursed at cost - without mark-up.

See FTC clauses.

Note: Written prior approval from the COR is required before the contractor can proceed with distributing any item.

1.4.5 TASK #5 – MARKETING AND OUTREACH

In accordance with the Work Assignment’s instructions, the contractor may be required to develop and implement, in conjunction with the FTC, Consumer Education and/or Consumer Identification (Public Notice) campaigns.

A. Campaign development includes, but is not be limited to, the contractor or its agent producing and providing to the COR:

1) proposed schedules showing projected media use, such as print, internet, postal mail, email or other marketing methods, suggested publications, projected insertion dates and run times;

2) projected costs for developing and placing materials within a maximum of ninety (90) calendar days of assignment; and

3) preliminary and final "drafts" of the proposed media and/or consumer education materials.

B. After receipt of the COR’s written approval accepting the final draft of campaign materials, project schedule and costs, the contractor shall proceed with implementing the campaign.

C. Upon completion of Consumer Identification or Education Program phase activities, the contractor shall prepare an invoice for the work performed in accordance with the Invoice processing terms of the contract.

Note: Prior written approval from the COR is required before the contractor or its agents shall produce, publish and/or distribute any outreach or marketing materials.

1.4.6 TASK #6 – MISCELLANEOUS SERVICES

If assigned this task, the contractor shall provide miscellaneous services, which may include asset management, liquidation, storage, and audit. Determination for use of this task will be based on the court or administrative order approving that the asset be used in whole or in part to fund a redress distribution and/or consumer education program. All requests for this task shall be pre-approved in writing by the COR prior to the contractor proceeding with such miscellaneous tasks.

RFP# FTC-18-Q-0004 Page 15 of 91

A. When miscellaneous services are requested, the contractor shall comply by providing a cost estimate to the COR.

B. When requested by the COR, the contractor shall provide written or oral testimony regarding claims processing actions performed by the contractor.

C. In some cases, the FTC requires specialized graphic design elements on claim forms and/or checks, such as color ink, colored paper, specialized envelopes, or other design elements.

1.4.7 TASK #7 – FINAL ACCOUNTING

A. Upon completion of all activities required to administer and disburse the redress fund money, the contractor shall prepare and provide to the COR an affidavit containing an accounting for all redress funds, including principal, additions to principal, expenses, distributions to redress claimants and/or for authorized consumer education, the amount of the residual funds remaining in the redress account to disburse, and any other information requested by the COR, in order to close the QSF bank account. The COR shall review and approve in writing (if found acceptable) the affidavit and use it to file any required final report with the court or administrative body ordering the redress distribution. If the COR finds the affidavit unacceptable, the contractor shall be requested to make the appropriate corrections and resubmit it.

B. Within 30 calendar days of direction from the DAR to close the case and its QSF bank account, the contractor shall prepare and forward to the DAR for approval, a closing package including the affidavit and final accounting detailing all completed work assignments for the case.

C. Prior to returning the remaining funds to the FTC and closing the bank account, the contractor must receive the DAR’s written approval.

1.4.8 TASK #8 – REPORTING AND GENERAL ADMINISTRATION

REQUIREMENTS

The contractor shall provide comprehensive, accurate, easy to understand, and timely reports.

The COR intends to request and receive only those reports that provide insight into the contractor’s level of performance in meeting contractual requirements and satisfying customer needs. The government may also request the contractor to provide management and operational reports on an ad hoc basis for purposes of gaining insight into specific redress program needs.

Specific report format, content, frequency, and delivery methods of all reports shall be coordinated with and approved by the COR on an individual report basis.

A. Monthly Reporting: At a minimum, the contractor shall provide monthly written status reports. These reports shall be brief, factual, and shall include, but not be limited to the following:

RFP# FTC-18-Q-0004 Page 16 of 91

1) The status of all on-going work pertaining to specific tasks listed in the Performance Work Statement (PWS) and National Institute of Standards and Technology (NIST) Certifications and Accreditation continuous monitoring requirements. See FTC clauses;

2) An estimate of the percent complete for each task;

3) A brief description of the work performed during the monthly reporting period just ended;

4) Work to be performed during the next monthly reporting period;

5) Any problems encountered with corrective action proposed or taken and a statement about the potential impact of the problem; and

6) Any government action requested.

The written report shall be provided to the COR on the following schedule – the September, December, March and June reconciliations shall be provided on or before the 5th business day after the end of those months; all other reconciliations shall be provided on or before the 7th business day after the end of the month.

B. Meeting Minutes: The contractor is expected to participate in meetings as required pertaining to the redress activities detailed in the PWS.

1) At a minimum, monthly meetings with the COR will be conducted to assess performance and discuss issues raised by both parties. Unless directed by the COR, all meetings shall be conducted via teleconference.

2) The contractor shall prepare and maintain minutes of meetings during which the progress of the work is discussed. The meeting minutes shall record the topics of discussion and any decisions that are made.

3) The contractor shall submit the meeting minutes to the COR within three business days after the subject meeting. These minutes will act as the documentation of these meetings. The COR reserves the right to approve the minutes.

C. Record Keeping: The contractor shall maintain and store—for searching purposes only—in an indexed and readily retrievable form, all records and documentation associated with the case for a period of six years following the closing of the QSF bank account, unless otherwise directed by the COR in writing. The records and documentation shall be maintained in electronic format and managed so that the information remains trustworthy throughout its entire life. Trustworthy records are characterized, according to ISO 15489-1, by being reliable (are complete and accurate), authentic (can be proven to be what it claims to be), having integrity (is unaltered), and usable (can be located, retrieved, presented and interpreted). At the end of the required retention period, the contractor shall

RFP# FTC-18-Q-0004 Page 17 of 91 transfer a trustworthy electronic copy of the records and documentation to the COR. After review and approval of the COR, the contractor shall destroy all records and documentation in its possession associated with the case, according to the guidelines set forth in NIST 800-88, Revision 1, Guidelines for Media Sanitization.

D. Invoicing: The contractor shall render itemized invoices, as described in FTC Clauses, upon successful completion of significant tasks, not more frequently than monthly and at least once a year. The COR will certify to the satisfactory completion of all work and services billed.

1.4.9 PERFORMANCE STANDARDS AND QUALITY LEVELS

PWS Reference Standard Acceptable Quality Level (AQL) Task #1 – Money Management, Section 1.4.1(A)

Bank Accounts Open case specific, non-interest bearing FDIC-insured checking account in accordance with PWS.

100% opening within three calendar days of assignment receipt

Task #1 – Money Management, Section 1.4.1(B)

(1) Provide the COR and his/her representative with read-only rights to online banking for the redress checking account assigned to a specific case.

Full access on all accounts

Task #1 – Money Management, Section 1.4.1(B)

(2) Obtain the DAR’s written approval and authorization of claims distribution in accordance with policy or the court or administrative order prior to any disbursements and transfers of claims funds, including the payment of all invoices for work performed under this PWS.

Obtain DAR’s written approval and authorization of claims distribution

Task #1 – Money Management, Section 1.4.1(B)

(3) Ensure that the bank returns to the contractor all original canceled checks (front and back) or clearly legible images of all original canceled checks (front and back) and bank drafts and bank statements.

100% return

Task #1 – Money Management, Section 1.4.1(B)

(4) Ensure that each checking account has payee name and check amount based positive pay or similar services to combat check fraud.

100% of accounts

Task #1 – Money Management, Section 1.4.1(B)

(5) Provide to COR or a designee the following details within one (1) business day of bank account opening:

date established, name of the account, account number and type, physical location of account, and signature cards

100% of accounts within three business days

Task #1 – Money Management, Section 1.4.1(B)

(6) Ensure that the bank sends a duplicate original bank statement - via express mail or as a PDF File – directly to the COR or a designee

100% of bank statements within ten (10) calendar days after the end of the month

Task #1 – Money Management, Section 1.4.1(B)

(7) Provide to the CO, COR, General Counsel (GC), and/or Inspector General (IG) any information requested pertaining to the bank records and activities.

Upon request

Task #1 – Money Management, Section 1.4.1(B)

(8) Ensure that after receiving written notification of a needed correction to bank and/or financial statements that the appropriate corrections are made

Within forty-five (45) calendar days.

Task #1 – Money Management, Section 1.4.1(B)

(9) Prepare and provide to the COR a reconciliation of the prior month’s activity of each redress bank account

On the following schedule:

September, December, March, June, on or before the 5th business day after the end of those months; all other reconciliations shall be provided on or before the 7th business day after the end of the month.

RFP# FTC-18-Q-0004 Page 18 of 91

Task #1 – Money Management, Section 1.4.1(B)

(10) Prepare and maintain a check register in each case accounting for all checks printed in accordance with the

PWS.

100% accurate information

Task #1 – Money Management, Section 1.4.1(B)

(11) Prepare and maintain a register in each case accounting for all debit and purchase cards distributed in accordance with the PWS.

100% accurate information

Task #1 – Money Management, Section 1.4.1(C)

Tax Identification Number Obtain a tax identification number for each redress case assigned

3 business days of receipt of the initial Work Assignment

Task #1 – Money Management, Section 1.4.1(C)

(1) Prepare and timely file all necessary tax returns, forms or reports with the appropriate authorities

100% of cases

Task #1 – Money Management, Section 1.4.1(C)

(2) Pay all required taxes, if applicable, from the redress fund and deposit any tax refunds into the redress account or return the tax refund to the FTC if the account is closed

100% of cases

Task #1 – Money Management, Section 1.4.1(C)

(3) Deliver a copy of any required annual income tax returns to the DAR at the time the contractor invoices for the associated tax preparation fees

100% of cases

Task #1 – Money Management, Section 1.4.1(D)

Liability Insurance and Employee Dishonesty Bonding

(1) Contactor shall obtain and maintain in accordance with PWS

N/A

Task #1 – Money Management, Section 1.4.1(D)

(2) Policy, modification and/or cancellation 60 calendar days’ notice of modification and/or cancellation.

The contractor shall inform the CO and COR within ten business days if ever an occurrence arises in which the contractor’s existing bonding and insurance policy is insufficient to cover the Work Assignment(s) assigned.

Task #1 – Money Management, Section 1.4.1(D)

(3) The surety on the bond must represent and warrant that it holds a Federal Certificate of Authority as Acceptable Surety On Federal Bond and Reinsuring

N/A

Task #1 – Money Management, Section 1.4.1(E)

Depository Bonding

(1) The contractor shall take all necessary administrative steps for the redress funds to qualify for the FDIC pass-through deposit insurance for beneficiary accounts. The FDIC coverage shall be based upon the ownership interest of each beneficiary for up to $250,000 in deposit insurance.

Qualifying for the FDIC pass-through deposit insurance for beneficiary accounts.

Task #2 - Help Services, Section 1.4.2(A)

IVR in accordance with PWS

100% accuracy to approved script

Task #2 - Help Services, Section 1.4.2(B)

Website Hosting in accordance with PWS Maintain over 99% website availability

Task #3 – Claims Processing and Eligibility, Section 1.4.3(A)

Claims Data (care of) in accordance with PWS 100% accuracy

RFP# FTC-18-Q-0004 Page 19 of 91

Task #3 – Claims Processing and Eligibility, Section 1.4.3(B)

Data Reconciliation - in accordance with PWS 100% accuracy

Task #3 – Claims Processing and Eligibility, Section 1.4.3(C)

Initial COR Verification of Claim data in accordance with PWS

If requested by government

Task #3 – Claims Processing and Eligibility, Section 1.4.3(D)

Claim Finalization In accordance with PWS 100% accuracy

Task #4 – Redress Distribution, Section 1.4.4(A)

Prepare checks, bank drafts, purchase cards, debit cards, coupons, or any other distribution financial instrument using commercially available means and as appropriate to the redress fund distribution requirements in accordance with PWS.

Contractor must use method determined by government for each case

Task #4 – Redress Distribution, Section 1.4.4(B)

Distribute - Redress and include any accompanying cover letter, brochures and other documents up to 2 pages and up to the U.S. Postal "one ounce" rate charged for first class mail

Within 6 months of receiving data and case assignment

Task #4 – Redress Distribution, Section 1.4.4(C)

Distribute – Limited situations that require fund recipients to receive tax form required for tax preparation, the contractor shall distribute the appropriate IRS form and cover letter.

Within 30 calendar days of the end of the corresponding tax year

Task #4 – Final Accounting Section 1.4.7

Prepare and provide to the DAR an affidavit containing an accounting for all redress funds including principal, additions to principal, expenses, distributions to redress claimants and/or for authorized consumer education.

Within 30 calendar days of direction of the DAR to close case

Task #4 – Reporting and General Administration Requirements Section 1.4.8 a Monthly Reporting – Prepare written monthly status report

b. Meeting Minutes for Monthly Reporting

c. Record Keeping

d. Invoicing

a. Monthly

b. Within three business days of monthly meeting

c. Keep records six years following the closing of QSF bank account unless otherwise directed by COR

d. Upon completion of significant tasks, not more frequently than monthly and at least once a year.

1.5 INFORMATION SECURITY AND PRIVACY REQUIREMENTS FOR

CONTRACTOR INFORMATION SYSTEMS

1.5.1 REGULATIONS

Each claims administrator selected will be required to protect the confidentiality of the information it collects, stores, and receives. The selected claims administrator will be required to demonstrate compliance with applicable laws, security, and privacy regulations including:

RFP# FTC-18-Q-0004 Page 20 of 91

1. Federal Information Processing Standards (FIPS) Publication 199, Standards for Security

Categorization of Federal Information and Information Systems (moderate confidentiality impact);

2. Federal Information Processing Standards (FIPS) Publication 200, Minimum Security

Requirements for Federal Information and Information Systems;

3. NIST Special Publication 800-53, Security and Privacy Controls for Federal Information

Systems and Organizations;

4. NIST Special Publication 800-60, Guide for Mapping Types of Information and

Information Systems to Security Categories

5. NIST Special Publication 800-171 Revision 1, Protecting Controlled Unclassified

Information in Nonfederal Systems and Organizations,

6. NIST Special Publication 800-122, Guide to Protecting the Confidentiality of Personally

Identifiable Information;

7. United States OMB Memorandum M-06-16.

8. The Privacy Act of 1974, and

9. And other data security or privacy requirements that may be specified by the commission to comply with the above authorities, including provisions relating to encryption standards, data breach notification, conflicts of interest, and other matters relating to data security and privacy that the commission may expressly incorporate into the contract or otherwise require.

1.5.2 NON-DISCLOSURE AGREEMENT

As noted elsewhere in this solicitation, contractor personnel shall be required to execute a nondisclosure agreement before being given access to commission information. The commission may also require criminal background investigations, credit checks, or other review of individuals or entities used by the contractor to perform this contract. Unless otherwise specified in the contract, compliance costs shall be borne by the contractor, and all data security and

RFP# FTC-18-Q-0004 Page 21 of 91 privacy requirements shall apply to the contractor, its employees, agents, and subcontractors in the performance of this contract. See Attachment 1, Non-Disclosure Agreement.

1.5.3 INFORMATION SECURITY

As a mandatory condition of performance, contractor shall be required, following award, to satisfy in a timely manner all applicable information security procedures and requirements, as determined by the FTC and the applicable laws and regulations.

The contractor shall safeguard and protect the confidentiality of the data according to NIST Special Publication 800-171 Revision 1 (NIST 800-171), Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.

NIST 800-171 describes fourteen families of security requirements (including basic and derived requirements) for protecting the confidentiality of Controlled Unclassified Information (CUI) in nonfederal systems and organizations. The security controls from NIST Special Publication 800-53 associated with the basic and derived requirements are also listed in NIST 800-171- Appendix D. Vendors can use Special Publication 800-53 to obtain additional, non-prescriptive information related to the security requirements. This information can help clarify or interpret the requirements in the context of mission and business requirements, operational environments, or assessments of risk. Nonfederal Organizations (NFO) can implement a variety of potential security solutions either directly or through the use of managed services, to satisfy the security requirements and may implement alternative, but equally effective, security measures to compensate for the inability to satisfy a particular requirement. To promote consistency, transparency, and comparability, compensatory security measures selected by organizations should be based on or derived from existing and recognized security standards and control sets.

Within thirty calendar days of award, the contractor must obtain an Authorization to Use (ATU) acceptable to the FTC. To receive this designation, contractor must have a system security plan acceptable to the FTC. The plan shall describe the system boundary; the operational environment; how the security requirements are implemented; and the relationships with or connections to other systems. Contractors shall develop plans of action that describe how any unimplemented security requirements will be met and how any planned mitigations will be implemented. Organizations can document the system security plan and plan of actions as two separate documents in Microsoft Word or Adobe PDF format.

The contractor shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls:

(i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems). (NIST 800-171 3.1.1);

(ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute. (NIST 800-171 3.1.2);

https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=b2ef9832bf94d483a3defd51e18280a5&term_occur=2&term_src=Title:48:Chapter:1:Subchapter:H:Part:52:Subpart:52.2:52.204-21 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=14b6c0e33967d51e70a16899cace0e57&term_occur=2&term_src=Title:48:Chapter:1:Subchapter:H:Part:52:Subpart:52.2:52.204-21 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=b2ef9832bf94d483a3defd51e18280a5&term_occur=3&term_src=Title:48:Chapter:1:Subchapter:H:Part:52:Subpart:52.2:52.204-21 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=14b6c0e33967d51e70a16899cace0e57&term_occur=3&term_src=Title:48:Chapter:1:Subchapter:H:Part:52:Subpart:52.2:52.204-21 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=14b6c0e33967d51e70a16899cace0e57&term_occur=4&term_src=Title:48:Chapter:1:Subchapter:H:Part:52:Subpart:52.2:52.204-21 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=b1fec257bbbf9339978b0004042258d1&term_occur=8&term_src=Title:48:Chapter:1:Subchapter:H:Part:52:Subpart:52.2:52.204-21 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=14b6c0e33967d51e70a16899cace0e57&term_occur=5&term_src=Title:48:Chapter:1:Subchapter:H:Part:52:Subpart:52.2:52.204-21

RFP# FTC-18-Q-0004 Page 22 of 91

(iii) Verify and control/limit connections to and use of external information systems. (NIST 800-171 3.1.20);

(iv) Control information posted or processed on publicly accessible information systems.

(NIST 800-171 3.1.22);

(v) Identify information system users, processes acting on behalf of users, or devices.

(NIST 800-171 3.5.1);

(vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems. (NIST 800-171 3.5.2);

(vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse. (NIST 800-171 3.8.3);

(viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals. (NIST 800-171 3.10.1);

(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices. (NIST 800-171 3.10.3, 3.10.4, 10.5);

(x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems. (NIST 800-171 3.13.1);

(xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. (NIST 800-171 3.13.5);

(xii) Identify, report, and correct information and information system flaws in a timely manner. (NIST 800-171 3.14.1);

(xiii) Provide protection from malicious code at appropriate locations within organizational information systems. (NIST 800-171 3.14.2);

(xiv) Update malicious code protection mechanisms when new releases are available.

(NIST 800-171 3.14.4); and

(xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed (NIST 800-171 3.14.5).

Other requirements. In addition to comply with the policies and regulations listed above, and the basic safeguarding of covered contractor information systems (JUN 2016) under FAR clause 52.204-21, the contractor shall:

1. Encrypt all sensitive data in the database (at rest) and in transmission employing FIPS-validated cryptography;

2. Allow entry into the systems only to authorized individuals and only during authorized times;

3. Maintain an audit logging capability to record access activity including the user ID, time and date of use, type of transaction, all log in/log out attempts, user submitted transactions, initiated transactions, system override events, and direct additions, changes or deletions to application maintained data; and…