HE1254-18-R-9000_Amend_0001.pdf

HE125418R9000

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83)

Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of this amendment is as follow s:

1. Provide a response to vendor questions

2. Add the requirement for oral presentations of Factor I (Technical)

3. Revise the PWS

4. Update the evaluation criteria

All changes to the PWS and the solicitation are highlighted in blue.

1. CONTRACT ID CODE PAGE OF PAGES

Z 1 42

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 19-Dec-2017

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X HE125418R9000

X 9B. DATED (SEE ITEM 11)

08-Dec-2017

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

19-Dec-2017

CODE

DOD EDUCATION ACTIVITY PROCUREMENT DIV

ATTN: EDDIE TAVARES

4800 MARK CENTER DRIVE

ALEXANDRIA VA 22350

HE1254 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

The following have been modified:

PERFORMANCE WORK STATEMENT

Engagement of Other Defense Organizations Information Technology Systems

Department of Defense Education Activity

4800 Mark Center Drive

Alexandria, VA 22350

FOR

Engagement of Other Defense Organizations Information Technology Systems

1. General Information and Scope of Work.

1.1 The Department of Defense (DoD) and Its Mission: The DoD is America’s oldest and largest government agency. With a budget of $419.3 billion, the DoD employs over 1.3 million men and women on active duty, and 742,000 civilian personnel. Another 826,000 serve in the National Guard and Reserve forces, and more than 2 million military retirees and their family members receive benefits. The mission of the DoD is to provide the military forces needed to deter war and to protect the security of our county.

1.2 Background: For an organization as large and complex as the DoD, achieving an audit ready state has been a long-term, challenging endeavor. However, all DoD financial statements are statutorily required to be audit ready by September 30, 2017. The primary and most visible measure of audit progress is the extent to which the

Department's organizations are under some form of a financial audit regimen. That audit will be the largest, single consolidated financial statement audit in the world.

The DoD groups the Military Departments, Defense Agencies, and other reporting entities into four tiers based on materiality, and whether the entity is required by the Office of Management and Budget to undergo an audit or is already undergoing a stand-alone audit of its financial statements. This engagement will focus on the Tier

3 and Tier 4 agencies. A list of Tier 3 and Tier 4 agencies can be found at Attachment 1. The four tiers of the

DoD and their associated percentages of budgetary resources and assets are:

Tier 1 – Military Services and the Military Retirement Fund – Account for about 72 percent of budgetary resources and 82 percent of assets.

Tier 2 – Large Defense Agencies – Account for about 23 percent of budgetary resources and 15 percent of assets.

Tier 3 – Mid-Sized Defense Agencies – Account for about 4 percent of budgetary resources and 2 percent of assets.

Tier 4 – Remaining Defense Agencies and Funds – Account for about 1 percent of budgetary resources and 1 percent of assets.

The Department’s Information Technology (IT) systems environment includes numerous legacy systems, core enterprise systems, and Enterprise Resource Planning systems that support the major end-to-end processes.

Most of the business legacy systems were originally designed to support specific functional purposes, such as human resource management, property management, and logistics management, and not designed for auditable financial statement reporting. As a result, transactions pass through several different systems as they move through the different functional areas. In FY 2017, the Department had 30 contracts for Statement on Standards for Attestation Engagements (SSAE) 16/18 examinations for various systems and assessable units.

1.3 Scope of work: The Contractor shall perform a performance/program audit on the anSSAE 18 Service

Organization Control (SOC) reports, Complementary User Entity Controls (CUECs), and Complementary

Sub-Service Organization Controls (CSOCs) engagement on select Other Defense Organizations (ODO) information technology systems outlined in Attachment 3 of the Performance Work Statement (PWS) for the base year. The system/accessible unit engagements for each option year are dependent on the

SSAE 18s that are available to review.

2. Requirement (Objectives).

2.1 Statement on Standards for Attestation Engagements (SSAE) No. 18 Engagement (Objective 1) - The contractor shall determine the sufficiency and appropriateness of evidence provided by Service

Organization Control (SOC reports. The contractor shall identify and assess the risks of material misstatement, and design and perform further procedures responsive to those risks. The following tasks serve to provide the contactor with a better understanding of the Objective. The activities associated with this objective shall result in the submission of corresponding deliverables identified in section five (5) of the PWS.

Supporting Tasks (Objective 1)

2.1.1 (Task 1): Determine the sufficiency and appropriateness of the evidence provided by SOC reports. (AICPA Clarified Statements on Auditing Standards (AU-C) 402.13).

a. Obtain assurance of service auditor’s professional competence and independence from the service organization.

b. Obtain assurance on the adequacy of standards under which the SOC report was issued.

2.1.2 (Task 2): Evaluate the SOC report as evidence to support the understanding about the design and implementation of controls at the service organization. (AICPA AU-C 402.14).

a. Evaluate whether the SOC report is as of a date or for a period that is appropriate for the user’s purposes.

b. Evaluate the sufficiency and appropriateness of evidence provided by the report for the understanding of the user entity’s relevant internal controls.

c. Determine whether complementary user entity controls identified by the service organization are relevant in addressing the risks of material misstatement relating to the relevant assertions in the user entity’s financial statements and, if so, obtain an understanding of whether the user entity has designed and implemented such controls.

2.1.3 (Task 3): Perform appropriate tests of controls at the service organization.(AICPA

AU-C 402.16)

Performance Standards and Acceptable Quality Levels (Objective 1)

The following applies to Objective 1:

2.1.1 Performance Standard (PS1) – The Contractor will complete all tasks by the required date and in accordance with OIG policies and procedures.

Acceptable Quality Level (AQL 1) - 100 % of tasks will be completed by the required completion date.

2.1.2 PS2 - Deliverables will be provided IAW task requirements.

AQL 2- 10% of deliverables will be rejected no more than once.

2.1.3 PS3 - Meet project milestones.

AQL 3- Meet 100% of established project milestones.

2.2 Complementary User Entity Controls (CUECs) Engagement (Objective 2) - The contractor shall determine whether the applicable CUECs that correspond to the Service Organization’s controls have been implemented by user entities. The contractor shall also test and determine the effectiveness of the CUECs.

(See PWS Attachment 2) The activities associated with this objective shall result in the submission of corresponding deliverables identified in section five (5) of the PWS.

Supporting Tasks (Objective 2)

2.2.1 (Task 1): Obtain an understanding of the user entity. (AICPA AU-C 402.09)

a. Obtain an understanding of the nature of the services provided by the service organization and the significance of those services to the user entity, including their effect on the user entity’s internal control.

b. Obtain an understanding of the nature and materiality of transactions processed or accounts or financial reporting processes affected by the service organization.

c. Obtain an understanding of the degree of interaction between the activities of the service organization and those of the user entity.

d. Obtain an understanding of the relationship between the user entity and the service organization, including the relevant contractual terms for the activities undertaken by the service organization.

e. Determine whether user entity has established controls to provide reasonable assurance that the CUEC is in place to achieve the control objectives in the SOC report.

2.2.2 (Task 2): Obtain an understanding of relevant internal controls. (AICPA AU-C 402.10)

a. Evaluate the design and implementation of relevant controls at the user entity that relate to the services provided by the service organization, including those that are applied to the transactions processed by the service organization.

2.2.3 (Task 3): Determine whether a sufficient understanding of the nature and significance of the services provided by the service organization and their effect on the user entity’s relevant internal control has been obtained to provide a basis for the identification and assessment of risks of material misstatement. (AICPA AU-C 402.11)

2.2.4 (Task 4): Respond to assessed risks of material misstatement. (AICPA AU-C 402.15)

a. Determine whether sufficient appropriate evidence concerning the relevant financial statement assertions is available from records held at the user entity.

b. Perform further procedures to obtain sufficient appropriate evidence.

2.2.5 (Task 5): Inquire of user entity’s management about whether the service organization has reported to the user entity, or whether the user entity is otherwise aware of, any fraud, noncompliance with laws and regulations, or uncorrected misstatements affecting the financial statements of the user entity. Evaluate how such matters, if any, affect the nature, timing, and extent of further procedures, including the effect on the conclusions and report. (AICPA AU-C

402.19)

Performance Standards and Acceptable Quality Levels (Objective 2)

The following applies to Objective 2:

2.2.1 Performance Standard (PS1) - The Contractor will complete all tasks by the required date

Acceptable Quality Level (AQL 1) - 100% of tasks will be completed by the required

2.2.2 PS2 - Deliverables will be provided IAW task requirements.

2.2.3 PS3 - Meet project milestones.

2.3 Complementary Subservice Organization Controls (CSOCs) Engagement (Objective 3) - The contractor shall determine whether the applicable CSOCs that correspond to the Service Organization’s controls have been implemented by the subservice organizations. The contractor shall also test and determine the effectiveness of the CSOCs. The activities associated with this objective shall result in the submission of corresponding deliverables identified in section five (5) of the PWS.

Supporting Tasks (Objective 3)

2.3.1 (Task 1): Identify additional subservice organizations used by the service provider (if any) that require CSOC engagements.

2.3.2 (Task 2): Obtain an understanding of the user entity. (AICPA AU-C 402.09)

a. Obtain an understanding of the nature of the services provided by the service and subservice organization and the significance of those services to the user entity, including their effect on the user entity’s internal control.

b. Obtain an understanding of the nature and materiality of transactions processed or accounts or financial reporting processes affected by the service organization.

c. Obtain an understanding of the degree of interaction between the activities of the service and subservice organization and those of the user entity.

d. Obtain an understanding of the relationship between the user entity and the service and subservice organization, including the relevant contractual terms for the activities undertaken by the subservice organization.

2.3.3 (Task 3): Obtain an understanding of relevant internal controls. (AICPA AU-C 402.10)

a. Evaluate the design and implementation of relevant controls at the user entity that relate to the services provided by the service organization, including those that are applied to the transactions processed by the service organization.

2.3.4 (Task 4): Determine whether a sufficient understanding of the nature and significance of the services provided by the service and subservice organization and their effect on the user entity’s relevant internal control has been obtained to provide a basis for the identification and assessment of risks of material misstatement. (AICPA AU-C 402.11)

2.3.5 (Task 5): Respond to assessed risks of material misstatement (AICPA AU-C 402.15)

a. Determine whether sufficient appropriate evidence concerning the relevant financial statement assertions is available from records held at the user entity.

b. Perform further procedures to obtain sufficient appropriate evidence.

c. Determine the carved-out services and controls to understand what additional information is needed pertaining to the subservice organization to assess the risk of material misstatement of the reporting entity’s financial statements.

2.3.6 (Task 6): Inquire of user entity’s management about whether the service or subservice organization has reported to the user entity, or whether the user entity is otherwise aware of, any fraud, noncompliance with laws and regulations, or uncorrected misstatements affecting the financial statements of the user entity. Evaluate how such matters, if any, affect the nature, timing, and extent of further procedures, including the effect on the conclusions and report.

(AICPA AU-C 402.19).

Performance Standards and Acceptable Quality Levels (Objective 3)

The following applies to Objective 3:

2.3.1 Performance Standard (PS1) - The Contractor will complete all tasks by the required date

Acceptable Quality Level (AQL 1) - 100 % of tasks shall be completed by the required

2.3.2 PS2 - Deliverables will be provided IAW task requirements.

2.3.3 PS3 - Meet project milestones.

2.4 Travel: Travel may be required for objectives in this PWS on an as needed basis.

Travel will consist of one CLIN with two SCLINS.

SCLIN 1 (Airfare/Car Rental)

The first SCLIN for travel shall be for airfare and car rental. The contractor will be asked to provide the airfare price for each travel event. The Government will then use independent market research to determine the reasonableness of the price. The Government will only reimburse the contractor for the agreed upon airfare determined prior to travel. Airfare shall only be purchased at economy/coach class levels unless the contractor can present evidence, which the Government can confirm, on the unavailability of economy/coach class seating options for a specific trip. Car rental: no car larger than an economy size should be rented. Rental above economy size shall be justified prior to travel.

Claims for rental car gasoline shall be supported by original receipts.

SCLIN 2 (Per Diem)

The second SCLIN shall be for Per Diem which shall be calculated using GSA’s annual rates at time of travel found at https://www.gsa.gov/perdiem. For example, a trip to Los Angeles, CA has a 2017

Per Diem rate of $158 for the month of April. Any Government approved travel occurring during the month of April in 2017 shall have a fixed Per Diem rate of $158 per GSA’s established rates at time of travel.

No other expenses outside of Airfare and Per Diem shall be reimbursed resulting from travel associated with the contract.

Travel Plans: The contractor shall provide a detailed travel plan in support of the objective(s) to the

COR no less than ten (10) business days prior to travel unless the travel is in response to an emergency as determined by the Government. The travel plan shall include the name of the traveler(s), location, purpose, and dates of travel; and a breakdown of anticipated travel expenses

(rental car, airfare, etc.). The Contractor shall coordinate with the Office of the Chief Information

Officer to ensure site notification no less than ten (10) business days prior to the requested travel date.

The Contractor shall prepare and submit site visit letters (See PWS Attachment 9) to each site no less than ten business days prior to the requested travel date.

2.5 General Requirements (not separately priced)

The following requirements are applicable to all objectives in the PWS.

2.5.1 Kickoff Meeting/Entrance Conference - The Contractor shall hold a kickoff meeting with the COR, Contracting Office, and select administrative DOD OIG personnel within ten (10) business days of award. The meeting will provide the Contractor an opportunity to discuss contractual requirements, security requirements, and other concerns with the COR. The Contractor shall prepare and provide a kickoff meeting agenda to the COR via email, two (2) business days prior to the meeting. Within two (2) business days after the kickoff meeting, the Contractor shall provide the

COR with the meeting minutes and the list of attendees. The date for the entrance conference will be determined in conjunction with the COR during the kickoff meeting. The formal entrance conference will provide the Contractor and DOD OIG opportunity to discuss requirements and any other pertinent information and to plan field and site visits. For the entrance conference, the

Contractor shall submit an agenda to the COR via email, two (2) business days before the conference for review and comment. Five (5) business days following the entrance conference, the Contractor shall provide meeting minutes and list of attendees to the COR.

2.5.2 Engagement Plan - The Contractor must provide to the COR a draft engagement plan within thirty (30) business days of issuing the task order. A final engagement plan will be provided within fifty (50) business days of issuing the task order IAW Section 5 – Contract Deliverables. The engagement plan shall identify the proposed approach and time schedule for the engagement.

Milestones and due dates of all deliverables must be included in the plan. The COR will review the engagement plan and provide comments to the Contractor. The final engagement plan must be approved by the COR before the Contractor proceeds to testing.

2.5.3 Engagement Test Plan - The Contractor shall prepare and provide to the COR a draft test plan within thirty (30) business days of issuing the task order. A final test plan must be provided within fifty (50) business days of issuing the task order IAW Section 5 – Contract Deliverables.

The COR is responsible for the review, comment and approval of the draft and final test plans as well as updates to the test plan. The test plans must include detailed information regarding the sampling methodology, assumptions, and any other pertinent details that will assist the COR to understand and replicate the plan, if needed. The final test plan must be approved by the COR before the Contractor proceeds to the testing phase.

2.5.4 Memorandum on Controls: The Contractor shall provide a memorandum no later than ten

(10) business days after the completion of the planning phase. The memorandum shall contain the

Contractor’s initial conclusions on the fairness of the presentation and suitability of design of key controls to achieve the examination control objectives, and to the extent possible the operating effectiveness of the controls specified by the DoD as of the date the memorandum is prepared.

2.5.5 Progress Reporting and Other Meetings - The progress report shall communicate the

Contractor’s progress/performance, identification of performance problems, recommended corrective actions, and other pertinent issues. At the COR’s discretion, progress reports can be provided using video teleconferencing, telephone, or in person. The Contractor shall provide progress reports biweekly IAW Section 5 – Contract Deliverables. All meetings will be held with the Contractor and the COR, biweekly at a location determined by the COR. The Contractor must prepare and provide an agenda to the COR three (3) business days prior to the meeting. Within two (2) business days after the meeting, the Contractor shall provide the COR with the meeting minutes and the list of attendees.

2.5.6 In Process Briefings/ Exit Conference - A formal In Process Review (IPR) with DOD OIG and the COR will be held at the end of the planning and testing phases. The IPRs with DOD OIG will be held while on site with the schedule to be determined by the COR and senior DOD OIG staff.

A formal exit conference will be held to allow the Contractor to report the findings to DOD OIG and the COR. The deliverable on the exit conference will be in writing and be to such detail as to discuss findings and recommendations on areas of disagreement.

2.5.7 Engagement Working Papers - The Contractor shall provide the COR with copies of all working papers, preferably in electronic form. The required documentation shall be provided no later than ten (10) business days after the completion of testing or within ten (10) business days of COR request. The COR may review specific work papers at any time during the engagement. The COR will review and provide feedback within (5) business days after receipt.

2.5.8 Summary Working Paper: The Contractor shall provide a summary working paper by an agreed upon date as specified in Section 5 – Contract Deliverables. The summary working paper shall provide final conclusions on the fairness of the presentation, suitability of design of key controls and, to the extent possible, operating effectiveness of controls. All working papers must be referenced to supporting documents in accordance with Section 3.1 and show evidence of supervisory approval (or interim supervisory review for those working papers in progress). The

COR will review the summary working paper and provide feedback to the Contractor.

2.5.9 Reporting: The Contractor shall provide the COR a report addressed to DoD OIG management by October 15, 2018, as specified in Section 5 – Contract Deliverables. The report for the base year will cover a nine (9) month period beginning February 1, 2018 and ending October 30, 2018 for the base year. The report for option year one (1) will cover a twelve (12) month period beginning November 1, 2018 and ending October 30, 2019 for the option year. The report for option year two (2) will cover a twelve (12) month period beginning November 1, 2019 and ending October

30, 2020 for the option year. The report will identify (a) key/relevant system inputs (including automated and manual), (b) edit checks, (c) system interfaces, (d) system outputs (including files and reports), and the methods/rationale that DoD management used for identifying each of these four items.

The Contractor shall provide the COR with the draft report after the Contractor has referenced the report to the source working papers in accordance with the requirements set forth in Section 3.1.

The COR will review the draft report and provide feedback to the Contractor. Once approved by the

COR, the Contractor will issue the final report to DoD OIG management and provide an electronic copy and two (2) copies of the report with original signature to the COR.

2.5.10 Notice of Findings and Recommendation (NFR): NFRs will be prepared by the Contractor as the mechanism of communicating to DoD management the discovery of findings throughout all engagement phases. The NFR will contain a description of the (a) condition, (b) criteria, (c) effect,

(d) cause, and (e) recommendation. The NFR must be referenced to detailed working papers and supporting documentation and reviewed by Contractor in accordance with Section 3.1. Following are requirements for the NFRs:

All NFRs must be approved by the COR before issuance to the DoD POC for response.

All NFRs prepared by the Contractor will be UNCLASSIFIED.

Any NFR concerning CLASSIFIED information must be prepared by DoD OIG.

Authorized Contractor personnel will be permitted to review and provide input to the

CLASSIFIED NFRs prepared by DoD OIG.

NFR numbering will be unique enough as to not have duplicated numbering of NFRs between multiple fiscal years.

All NFRs will be provided to the DoD POC in a timely manner following discovery of a finding. The Contractor will provide a letter to the COR containing all NFRs issued during the engagement within three (3) days of discovering the finding. All NFRs previously approved by the COR will be provided to the DoD POC in a timely manner following discovery of a finding and prior to the submission of the NFR Letter, as applicable.

3. Constraints.

3.1 Engagement Documentation - The Contractor shall prepare engagement documentation in accordance with Government Auditing Standards, AICPA standards (to include AU-C 600 and AU-C 402), and GAO/PCIE

FAM; and shall submit the documentation to the COR IAW PWS Section 5 – Contract Deliverables, within ten (10) business days after each site visit and/or at the COR request. At a minimum, the engagement documentation shall:

Document the procedures of how the work was performed by describing the purpose, source, scope, methodology, criteria, and conclusions, and recommendations;

Fully support conclusions reached with results and documentation of detailed testing procedures;

Include planning documentation, assessment program guides, checklists, engagement documentation, summaries, flowcharts and related documentation, risk assessment matrices, and evidence of supervisory review;

Contain all contributing elements (condition, cause, criteria, and effect) for control weaknesses, significant deficiencies, and other findings, as well as recommendations. Other potential material weaknesses and significant deficiencies must be summarized separately; and, Reference to programs, related documentation, and the Contractor’s reports.

The engagement documentation must contain sufficient details to enable an experienced auditor, having no previous connection with the engagement, to understand and ascertain:

The nature, timing and extent of the procedures performed;

The results of the procedures performed;

The evidence obtained and the source of information; and, Significant findings and issues arising during the engagement, the conclusions thereon, and professional judgments.

The Contractor shall provide references within each deliverable to identify the specific section within

Contractor-prepared working papers and supporting documentation that support the deliverable content

(including all statements of fact, conclusions, and opinions). All working papers supporting a contract deliverable must show evidence of supervisory approval (or interim supervisory review for those working papers in progress) by Contractor personnel.

Table 1: Engagement Guidance and Websites

GUIDANCE WEBSITE

GAO-12-331G, Government Auditing Standards http://www.gao.gov/products/GAO-12-331G

GAO-08-585G, Financial Audit Manual https://www.gao.gov/financial_audit_manual/overview

AICPA Codified Professional Auditing Standards http://www.aicpa.org/Pages/default.aspx

3.1.1 Access to Contractor Prepared Engagement Documentation - The Contractor shall provide the COR and DoD OIG personnel, as coordinated by the COR, unrestricted access to the engagement documentation and

Contractor personnel throughout the duration of the contract/task order to ensure compliance with applicable standards. The Contractor shall provide the progress of the engagement documentation file as requested by the

COR. The COR may request to review sample engagement documentation at any time during the engagement.

The Contractor must provide the COR with the requested documentation within ten (10) business days of a

COR request.

In addition to DoD OIG, GAO may oversee this engagement. The Contractor shall only communicate with and through the COR and is only to perform at the request of the COR or Contracting Officer. As the principal auditor for the financial statements of the U.S. Government, GAO is responsible for determining whether they can rely on the work performed by other auditors. The Contractor is an “other auditor” with respect to the GAO audit of the FYs 2018-2022 U.S. Government financial statements. Accordingly, and only through proper coordination for action communicated though the COR, the Contractor must provide the following information:

1. Subject to auditing standards, GAO will have timely unrestricted access throughout the engagement to Contractor and DoD OIG engagement personnel, draft and final documents, working papers, and evidence necessary for re-performance purposes.

2. GAO will be provided, at no costs to the Government, with necessary software, training, and access to Contractor and DoD OIG electronic documentation and working paper system(s) used on the engagement.

3. GAO will be placed on all notification and distribution mailing lists, and invited to participate in all key meetings between the auditee's management, the Contractor, the DoD OIG, or any combination of the preceding, held for the purpose of discussing engagement and/or accounting issues, including but not limited to:

Initial approach, planning, and scoping, Subsequent change(s) to the nature, timing, and extent of procedures, Agency and site entrance and exit briefings, Applications of auditing and/or accounting standards, Progress, status, and problem resolution meetings, Briefings to Contractor and/or DoD OIG by management on agency operations and significant changes in account balances, and

Other discussions of significant issues arising during the engagement.

After coordination with and direction from the COR, the Contractor must make all engagement documentation available to DoD OIG and GAO at no additional cost. Access means providing copies (electronic or hard copy) as well as view access to specified software used by the Contractor to create, analyze, and store engagement documentation. The Contractor shall provide access to the engagement documentation to GAO after coordination with the COR.

3.1.2 UNCLASSIFIED Engagement Documentation Retention - All engagement documentation is the property of DoD OIG and will be retained by DoD OIG and will be designated as “For Official Use Only

(FOUO).” The Contractor may not transfer DoD-owned data onto other non-Government networks or hardware not associated with the self-certification provided in Section 3.1.4. This includes but is not limited to personal computers and other electronic devices used for personal use (i.e., home computers, iPads, tablets, and smartphones). The Contractor may retain copies of UNCLASSIFIED engagement documentation for their files.

These files are not for public distribution without Government consent through the DoD Freedom of

Information Act and the DoD OIG legal offices. If the Contractor is required to disclose UNCLASSIFIED DoD

OIG documentation by law or legal process, the Contractor will promptly notify DoD OIG of such requirements prior to disclosure. Disclosures made in accordance with applicable professional standards will first be requested and approved by DoD OIG. UNCLASSIFIED engagement documentation will not contain any proprietary or restricted use data from the Contractor. The Contractor shall handle all documentation using security procedures for FOUO information as appropriate. Review Volumes 3 and 4 of DoD Regulation

5200.1-R, Information Security Program; and DoD Regulation 5400.11, DoD Privacy Program for proper handling of material.

3.1.3 Engagement Documentation Markings - The Contractor will deliver a complete set of all original

UNCLASSIFIED engagement documentation (electronic or hardcopy) marked as “U.S. Property of DoD” to the DoD OIG prior to DoD OIG publishing of the final report. The Contractor shall handle all documentation using security procedures for FOUO or CLASSIFIED information as appropriate. The Contractor shall comply with Volumes 3 and 4 of DoD Regulation 5200.1-R, Information Security Program, DoD Manual 5105.21, Sensitive Compartmented Information (SCI) Administrative Security Manual, and DoD Regulation 5400.11, DoD Privacy Program for proper handling of material.

3.1.4 Contractor Provided Equipment - The Government may perform random checks of the Contractor’s systems to verify the Contractor’s self-certification that they meet the requirements outlined in National

Institute of Standards and Technology (NIST) Special Publication (SP) 800-171. The method of these checks will be mutually agreed to between the Contractor and the Government, will include sufficient advance notice, and will not include access to the Contractor’s network by the Government. Any changes to the Contractor’s information system security that impact compliance with NIST SP 800-171 while working on an active task order must be reported to the COR immediately. If the Government determines the Contractor does not meet security requirements, the Contractor shall provide a plan within three (3) calendar days of notice from the COR or Contracting Officer for Government approval to achieve compliance. If the Contractor’s system is found to not be in compliance at any time during the performance of the contract, the Government has the right to invoke disciplinary actions that may include but are not limited to the loss of privileges to process and store data on networks and equipment not owned by the Government.

The Contractor is also required to provide any needed Compact Discs (CD) and Digital Versatile Discs (DVD) encrypted to DoD standards as outlined in DoD Instruction 8582.01, dated June 6, 2012, to accommodate the staffing of a task order. The Contractor is authorized to use the CDs and DVDs to collect data during the engagement.

3.1.5 Electronic Data Transmissions - The Contractor may not electronically transmit any data associated with a task order onto other non-Government networks or hardware not associated with the self-certification provided in Section 3.2.9. This includes but is not limited to personal computers and other electronic devices used for personal use (i.e., home computers, iPads, smartphones, and tablets).

3.2 Security Requirements:

3.2.1 The highest level of security required under this contract is SECRET. A DD254 has been provided as

PWS Attachment 10.

3.2.2 Facility Security Clearance - The Contractor shall possess an active facility clearance of SECRET from the Defense Security Service (DSS) Facility Clearance Branch at the time of its proposal and maintain the clearance throughout the contract period. Subcontractor(s) facility clearance levels must be commensurate with the level of classified material to be accessed during the contract term. While DoD OIG will initiate a DD 254 to the prime Contractor, the Contractor will create DD 254s for subcontractor(s) and DoD OIG will review the

DD 254s prior to awarding to the subcontractor(s). DoD OIG will review all DD 254s. A draft DD254 will be attached to the solicitation for information purposes.

3.2.3 Personnel Security - The Contractor is responsible for providing personnel with the appropriate security clearance to access DoD information and facilities that may require a security clearance to perform work within the scope of this requirement. Key Personnel shall maintain an active security clearance of SECRET at all times during the performance of the contract. Non-Key Personnel shall at a minimum possess an INTERIM-SECRET clearance. The Contractor will initiate requests for security clearances at the SECRET level. Access to

CLASSIFIED information will not be allowed until an interim SECRET or higher clearance has been granted.

Individuals with an interim SECRET will be authorized access to information at the SECRET level.

Only U.S. citizens may be assigned to these engagements. Therefore, Contractor personnel who currently hold dual citizenships and/or active foreign passports will not be permitted to work under this contract. The

Contractor is responsible for ensuring that all persons working on this effort are U.S. citizens. In accordance with DSS requirements dated November 20, 2009, the Contractor must provide reliable documentary evidence that a dual citizen's foreign passport has been destroyed, invalidated or surrendered, prior to being permitted to perform on this program.

The Contractor and/or subcontractor(s) are responsible for submitting a visit authorization letter via the Joint

Personnel Adjudication System (JPAS) to the FMO Audit Response Team and XXXXXXX Programs &

Resources, Central Administrative Office, Administrative/Security Officer after personnel have been approved to perform on the contract. Alternate methods of submission may be permitted on a case by case basis. The

Contractor shall also prepare and submit site visit letters no less than fifteen (15) business days prior to the requested travel date.

The Contractor is responsible for providing the government a quarterly roster of its entire staff supporting the contract. In addition, the Contractor will ensure that new additions to the contract complete all the applicable security training. The Government reserves the right to direct any Contractor personnel to be removed from performance, directly or indirectly, whenever there is probable cause to believe, on the basis of all facts available, that such action is warranted in the interest of national security. This action may be made whether or not the cause is deemed of sufficient severity to warrant action to terminate the Contractor's Facility Clearance or individual's security clearance. The Government also reserves the right to remove any Contractor personnel for the purpose of conducting any investigation of alleged misconduct which may, in the opinion of the

Contracting Officer, jeopardize the security of the project. All security incidents will be reported to both

Government Security Offices and the Defense Security Service.

3.2.4 Identification Badges/Common Access Card (CAC) - All CACs and Badges will be issued to

Contractor personnel: (1) approved to perform on this contract, and (2) cleared through the DoD OIG security office. Contractor personnel that require access to DoD facilities by access badge must complete and submit a

"Visit Request" form through the JPAS {SMO: PENAFFM}. An “In-processing Form” will be issued for completion and must be submitted to the DoD OIG security office. Upon completion of (1) Visit Request form through JPAS, and (2) Inprocessing Form, the Contractor will be directed by the DoD OIG security office how to accomplish final processing.

All CACs and badges issued to select Contractor personnel are Government property and must be returned either upon departure from the program or at the conclusion of the contract, whichever comes first, to the current CAC sponsor:

DoD OIG Security Office

Contractor personnel whose CAC card is lost or stolen must present documentation to the current CAC sponsor confirming that the CAC is missing and describing the circumstances under which the loss occurred. The COR will generate a memorandum required by DoD OIG security office, in order to issue a new CAC. The CAC contains personally identifiable information and must be treated as a controlled item. Contractor personnel must not share their CAC and passwords with anyone else. The COR will report any violation or suspected violation to the Contracting Officer and the DoD OIG Office of Security. Any violators will be temporarily or permanently removed from the project. If a Contractor employee has a CAC issued from a previous engagement with another agency that CAC must be returned to that agency before issuance of a DoD sponsored

CAC.

Contractor Identification – All Contractor personnel are required to identify themselves as Contractors when attending meetings, answering government telephones or where their Contractor status is not obvious to third parties (i.e., e-mail). Contractors are also required to mark any documents as being Contractor-prepared or ensure that their participation as a Contractor is appropriately disclosed.

Contractors supporting the DoD and having access to the DoD Network must complete Information Protection training within seven (7) business days of receiving access to the NIPRnet. Contractor personnel with access to the DoD Network must complete DoD quarterly security training as directed by the DoD OIG.

3.2.5 Information Security - On August 14, 2014, the Deputy Secretary of Defense issued, Unauthorized

Disclosures of Classified Information or Controlled Unclassified Information on DoD Information Systems, which outlined requirements for safeguarding CLASSIFIED information and controlled UNCLASSIFIED information. All Contractor personnel shall review the requirements and understand the consequences of any security violations outlined in the memorandum.

3.2.6 Non-Disclosure Requirements: The Contractor will ensure that all Contractor personnel approved to perform on this engagement and who will access CLASSIFIED information sign a SF 312, “Classified

Information Nondisclosure Agreement” (See PWS Attachment 5). Contractor personnel performing at the

UNCLASSIFIED level must sign a Non-Disclosure Agreement (See PWS Attachment 6). The Contractor

Facilities Security Officer will execute the non-disclosure agreement and provide a copy of the SF 312 to the

DoD OIG Office of Security or a copy of the UNCLASSIFIED Non-Disclosure Agreement to the COR, as applicable, no later than twenty (20) business days after the individual is approved to work on this contract.

When transmitting the copy of the agreement, the Contractor Facilities Security Officer must safeguard personally identifiable information (PII) by securing the attached copy either by encryption or password protection. The Contractor will ensure that Contractor personnel no longer supporting this contract are properly debriefed. The Contractor will ensure that Contractor personnel who accessed CLASSIFIED information complete the Security Debriefing Acknowledgement on the SF 312. The Contractor will ensure that Contractor personnel who accessed UNCLASSIFIED information complete a Security Termination Form administered by the DoD OIG (See PWS Attachment 7).

3.2.7 Access to and Storage of CLASSIFIED Information - While access to CLASSIFIED information is permitted under this contract, the Contractor is NOT permitted to take possession of any CLASSIFIED information. Access to and storage of all CLASSIFIED information associated with this contract will occur at approved Government facilities. The Government will facilitate Contractor access to all installations/bases necessary to complete this engagement. The Government will oversee handling and storage of CLASSIFIED information and provide appropriate storage capability for all CLASSIFIED material. All CLASSIFIED information (including notes and working papers) must be returned to the Government prior to departing

Government premises at the end of each day. The Contractor and/or Sub-Contractor(s) are responsible for submitting a visit authorization letter via JPAS to the DoD OIG security office, Executive Services Office, Security Manager after personnel have been approved to perform on the contract. The Contractor will also prepare and submit site visit letters no less than ten (10) business days for CONUS and forty-five (45) calendar days for OCONUS prior to the requested travel date. For OCONUS visits, a theatre clearance will be required.

3.2.8 Security of UNCLASSIFIED DoD Information on Non-DoD Information Systems - It is DoD policy to provide adequate security for all UNCLASSIFIED DoD information on non-DoD information systems in accordance with NIST SP 800-171, issued in June 2015. UNCLASSIFIED DoD information may be disseminated by the Contractor ONLY to the extent required to further the contract objectives provided that the information is disseminated within the scope of assigned duties and with a clear expectation that confidentiality will be preserved.

The DoD plans to use a SharePoint website during the engagement to provide Contractor personnel with requested UNCLASSIFIED documentation. In addition, the DoD will allow direct access to its systems as necessary to support the engagement where there is a clear need and requirement. The Contractor must complete the appropriate security documentation to meet the system account management policies. Contractor personnel will be required to read and sign applicable "System Rules of Behavior" and security briefings.

Specific documents can vary depending on specific location requirements. Contractors shall plan for fifteen to thirty (15-30) calendar days after submission of paperwork to be granted direct access to these systems.

3.2.9 Security of Contractor Hardware and Networks Processing and Maintaining UNCLASSFIED

Information - The Contractor is only permitted to process and maintain UNCLASSIFIED information on its

Contractor-provided hardware and networks. At the beginning of each period of performance, the Contractor is required to provide an annual self-certification memo to the DoD OIG providing assurance and addressing how the Contractor intends to meet the information safeguards required by NIST SP 800-171, as applicable. The self-certification must include but is not limited to assuring that patches and anti-virus software on each of the

Contractor provided user hardware is current and will continuously remain up-to-date throughout the entire performance of the contract. The Contractor will present scan results upon request.

Subsequent to the receipt and acceptance of the annual self-certification, the Contractor will be permitted to use

Contractor networks, Contractor-owned hardware and associated software for performance on this contract.

The Contractor-owned hardware is not authorized to be connected to any network other than the Contractor’s corporate network unless otherwise permitted in this PWS. Connections to networks for the sole purpose of establishing a secure internet connection to the Contractor’s corporate network are permissible. Access to

UNCLASSIFIED information in a DoD network using the Contractor-owned hardware may be authorized as permitted by the DoD. Contractor-owned hardware must be CAC enabled in order to directly obtain

UNCLASSIFIED information from Government systems.

Before access to DoD information is granted to Contractor employees, evidence that the mandatory training courses listed in Mandatory Annual Trainings to Perform on DoD Contracts (See PWS Attachment 8 have been completed must be provided to the COR and the DoD Information Assurance POC. Certificates of completion shall be provided to the COR no later than twenty (20) business days after being approved to work on this contract. PWS Attachment 8 includes current training whereas other training, to include any additional established training deemed mandatory by the DoD, may be identified.

The Contractor is required to safeguard personally identifiable information (PII) in accordance with the Privacy

Act of 1974, 5 U.S.C. § 552a, and DoD Regulation 5400.11-R during the period of performance. The DoD OIG must be informed within 24 hours of the Contractor learning that DoD PII data was compromised, lost, or stolen. Depending on the nature of information compromised, lost, or stolen, the Government has the right to invoke disciplinary action which may include civil and criminal penalties as outlined in DoD Regulation

5400.11-R, September 1, 2011.

3.3 Independence/Quality Control Assurance (Applicable to all CLINS) - The Contractor shall represent its independence as it relates to the work performed on…