NDIP Draft Statement of Work.pdf

STATEMENT OF WORK

NATIONAL DIVERSITY INTERNSHIP PROGRAM (NDIP)

Office of the Comptroller of the Currency

1.0 SCOPE

The Office of the Comptroller of the Currency (OCC) seeks recruitment services to provide intern candidates for the 2024 summer under the National Diversity Internship Program (NDIP).

2.0 BACKGROUND

The OCC charters, regulates, and supervises all U.S. national banks and federal thrifts. The OCC also supervises the federal branches and agencies of foreign banks. Headquartered in Washington, D.C., the

OCC has 80 offices around the country to supervise the activities of national banks and federal savings associations. Bank supervision is the core activity of the agency.

The OCC’s activities are predicated on four objectives that support the OCC’s mission to ensure a stable and competitive national banking system. The four objectives are:

• Ensure the safety and soundness of the national system of banks and savings associations.

• Foster competition by allowing banks to offer new products and services.

• Improve the efficiency and effectiveness of OCC supervision, including reducing regulatory burden.

• Ensure fair and equal access to financial services for all Americans.

In addition, the OCC is responsible for ensuring diversity in all employment ranks throughout the organization. Section 342 of the Dodd-Frank Wall Street Reform and Consumer Protection Act, 12 U.S.

Code § 5452, requires the agency to partner with organizations focused on developing opportunities for young minorities and women, by providing them employment opportunities via industry internships, summer employment, and full-time positions. Section 342 also stipulates that agencies shall recruit at historically black colleges and universities (HBCUs), Hispanic-serving institutions (HSIs), women's colleges, and colleges that typically serve majority minority populations.

External Outreach and Minority Affairs

To comply with the statute, the Office of External Outreach and Minority Affairs (EOMA) created and administers the NDIP. EOMA through the Office of Acquisition Management contracts with internship organizations that recruit students primarily from minority and women colleges and universities and institutions of higher education that have a high enrollment of these groups for internship opportunities.

The NDIP i provides students the opportunity to work in a professional environment and acquire skills to enhance their marketability for future jobs upon graduation.

The NDIP annually recruits interns from national internship organizations and places them in OCC business units nationwide. For the duration of the program, NDIP interns shall reside in a 50-mile radius of their OCC work site.

3.0 PERFORMANCE REQUIREMENTS

The Contractor shall provide intern candidates to the OCC in accordance with Attachment 1 “Managers

Requests.” The Contractor shall have an established internship program and process to recruit interns. The contractor shall provide a diverse pool of minority candidates, utilizing a variety of recruitment sources which includes, but not limited to, Historically Black Colleges and Universities, Women’s Colleges and

Universities, Native American Colleges and Universities, Hispanic-Serving Institutions, and colleges and universities with a high enrollment of minority students or typically serving a majority minority population.

3.1 INTERN REQUIREMENTS

The Contractor shall provide interns who meet the following requirements:

3.1.1 Be a U.S. citizen.

3.1.2 Must be currently pursuing a degree from an accredited college or university.

3.1.3 Have and maintain a minimum 3.0 grade point average.

3.1.4 Meet the requirements of the Office of Personnel Management’s Public Trust

Security Clearance.

3.1.5 Reside in or have housing in the geographical area of the internship site.

3.1.6 Available to work the required hours outlined in the Manager’s request.

3.1.7. Available to work both virtually and/or on-site at designated location.

3.2 TECHNOLOGY REQUIREMENTS

The contractor shall have access to internet within their telework location on file.

3.3 INTERN ROLE & RESPONSIBILITIES

The interns shall Support bank supervision processes for the team, including ongoing supervision activities, focused reviews, and/or target examinations. Review and analyze bank MIS/reporting and other critical information; attend and document bank meetings, support examiners in the completion of quarterly deliverables, review Internal Audit workpapers and board/management committee packages, and develop and present various analyses to leadership.

4.0 DELIVERABLES

Deliverable Delivery Date

Contractor shall provide a maximum of two resumés to each Manager’s Request. Each resumé may be submitted to only one manager for consideration.

15 days from award

Contractor shall confirm the accuracy of each intern candidate’s home address, e-mail address, phone number and internet access.

With Submission of Resume

Contractor shall attend the OCC-sponsored Introductory

Meeting per the instructions from the COR.

Within 10 business days of award

Contractor shall provide e-mail confirmation that interns have received Government-furnished

Information Technology equipment and certificates of completed OCC-required ITS training.

No later than May 17, 2024

Contractor shall provide the selected NDIP candidates to begin internship in accordance with OCC’s

Manager’s Requests and OCC COVID-19 guidance.

June 3, 2024

Contractor shall submit invoices and all supporting documentation and receipts monthly, but no later than the 10th day of the following month.

Monthly, no later than the 10th of the following month

Contractor shall provide e-mail confirmation and tracking information that interns have returned

Government-furnished Information Technology equipment via FedEx or UPS.

August 16, 2024

5.0 GOVERNMENT FURNISHED PROPERTY/INFORMATION

For interns selected as OCC Contractors, the OCC will provide laptops.

The OCC will provide workspace, limited office supplies, furniture, and access to telephone lines, printers, fax machines and copiers to interns selected as OCC contractors and performing work at OCC workspaces. Long-distance telephone access shall be limited to OCC business only. The OCC may provide, to the extent necessary, materials to support the needs of each business unit and access to the local network for email and public folder purposes.

The OCC may provide, to the extent necessary, materials to support the needs of each business unit and access to the local network for email and public folder purposes.

5.1 LAPTOPS FOR TELEWORKING

The OCC will provide laptops to each intern for the duration of this program. The OCC will ship all laptops directly to the intern and will include the contractor on all e-mail correspondences. The Contracting Officer

Representative (COR) will provide the Contractor and subcontractor (intern) the tracking information once the laptop has been shipped. All laptops will include a return shipping label. Upon completion of the program, the COR will initiate offboarding requests to provide guidance to the Contractor and intern on returning of the laptop. The Contractor shall coordinate with each intern to ensure acceptance and signature of the laptop followed by the return shipping of the government property.

Once accepted by the intern, the Contractor assumes all responsibility and liability of the Government-

Finished Property (laptop). The Contractor assumes the risk of, and shall be responsible for, any loss, damage, destruction, or theft of Government property upon its delivery to the Contractor as Government-

Furnished property. The Contractor is not responsible for reasonable wear and tear to the Government property or for Government property consumed in performing this contract. However, the contracting officer may revoke the Government’s assumption of risk when the property administrator determines that the contractor’s property management practices are noncompliant with contract requirements, are inadequate and /or present an undue risk to the Government. The Contractor is required to provide their property management practices for the purposes of this contract.

6.0 CONTRACTOR’S COMMUNICATION

The Contractor and Contractor personnel shall meet the following communication requirements:

6.1 CONTRACTOR PERSONNEL

All contractor personnel shall identify themselves as contractor personnel on all forms, whether in person, on the phone or in e-mail messages. Contractor personnel shall also display distinguishing badges or other visible identification for meetings with Government personnel or the general public.

6.2 CONTRACTOR

The Contractor shall notify the Contracting Officer’s Representative via e-mail whenever their intern will be unavailable to perform services.

7.0 POINT OF CONTACT (POC)

The vendor shall provide a POC responsible for communications with the OCC and management of the interns.

8.0 508 COMPLIANCE AND ACCEPTANCE

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities. As such, the following requirements apply to this solicitation:

1) Products, platforms and services delivered as part of this work statement that are ICT, or contain

ICT, must conform to the Revised 508 Standards, which are located at 36 C.F.R. § 1194.1 & Apps. A, C &

D, and available at https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines

2) E102 / 702.10 – Web Content Accessibility Guidelines (WCAG) success criteria level A & AA are incorporated as a requirement. The referenced WCAG criteria is available at http://www.w3.org/TR/WCAG20/

3) A completed Accessibility Conformance Report (ACR) found at https://www.itic.org/policy/accessibility/vpat, using Voluntary Product Accessibility Template (VPAT)

Revised Section 508 Edition, Version 2.4, is required to assist the Government in determining that the

ICT products or services support Section 508 accessibility standards.

4) E202 – No General Exceptions Authorized by OCC

The following items are identified as containing ICT: E602 – Support Documentation

Applicable Functional Performance Criteria: All functional performance criteria apply when using an alternative design or technology that achieves substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4-6 of the Revised 508 Standards, or when Chapters 4-6 do not address one or more functions of

ICT.

Applicable requirements for electronic documents and/or support services:

• E205 – WCAG Level A & AA Success Criteria

• E302 – Functional Performance Criteria

• E602 – Support Documentation

• E603 – Support Services - the Contractor shall ensure that all Electronic and Information Technology

(EIT) meets all applicable functional and technical standards required by Section 508 of the

Rehabilitation Act of 1973, as amended. IT Accessibility standards codified in 36 CFR 1194 and the technical standards can be read at www.access-board.gov.

9.0 TELEWORK

Unless otherwise directed by the Contracting Officer, the COR may authorize telework/remote work during periods in which work cannot be performed at OCC workspaces. The work authorized must be capable of being performed to meet the same standards as performed on the Government site. When telework is authorized, contractor employees shall adhere to the contractor’s policy and procedures.

10.0 SECURITY REQUIREMENTS

A. Compliance with Applicable Laws, Regulations, and Standards

Federal Laws. The contractor and all of its respective subcontractors shall follow and remain compliant at all times with the Federal Acquisition Regulation (FAR), Privacy Act of 1974 (5 U.S.C. 552a - the Act), Federal Information Security Modernization Act of 2014 (Public Law 107-347) (FISMA).

https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.access-board.gov%2Fguidelines-and-standards%2Fcommunications-and-it%2Fabout-the-ict-refresh%2Ffinal-rule%2Ftext-of-the-standards-and-guidelines&data=02%7C01%7CSusan.OBrien%40occ.treas.gov%7C57ec31d2d17c479fdbf808d76d258caa%7Cfd30c7091bb849f19c7edd8840c989d0%7C0%7C0%7C637097880354836254&sdata=7JnwLP%2B6fbjpueFFj8jBQftTv5w3dE9NXJ2AwTTNC8Q%3D&reserved=0 https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.access-board.gov%2Fguidelines-and-standards%2Fcommunications-and-it%2Fabout-the-ict-refresh%2Ffinal-rule%2Ftext-of-the-standards-and-guidelines&data=02%7C01%7CSusan.OBrien%40occ.treas.gov%7C57ec31d2d17c479fdbf808d76d258caa%7Cfd30c7091bb849f19c7edd8840c989d0%7C0%7C0%7C637097880354836254&sdata=7JnwLP%2B6fbjpueFFj8jBQftTv5w3dE9NXJ2AwTTNC8Q%3D&reserved=0 https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.w3.org%2FTR%2FWCAG20%2F&data=02%7C01%7CSusan.OBrien%40occ.treas.gov%7C57ec31d2d17c479fdbf808d76d258caa%7Cfd30c7091bb849f19c7edd8840c989d0%7C0%7C0%7C637097880354846251&sdata=F90EWonF%2FMda%2Bkzn8LLuXgoeQPPwO3o9D2lmn5ZNAmA%3D&reserved=0 http://www.access-board.gov/

FIPS. The contractor and all of its respective subcontractors shall follow Federal Information Processing

Standards (FIPS), National Institute of Standards and Technology (NIST) standards and guidelines, and other laws, mandates, or executive orders pertaining to the protection of sensitive information and information systems.

OCC Policies and Procedures. The OCC understands that there are limitations in applying agency-specific policies to systems and environments shared with other organizations or customers. The requirements in this

OCC Policies and Procedures subsection applies to all activities specifically performed for the OCC by the contractor (e.g., professional services to develop or customize a component for the OCC). The intent of this section is to require contractor compliance with OCC policies and procedures for those activities, tasks, and deliverables specifically and uniquely performed and/or completed for the OCC by the contractor that is not a typical service or component of the existing contractor system/solution. This section also applies to contractors with access and use of OCC information resources (i.e., OCC network, systems, laptops, other IT equipment, and/or OCC information).

The contractor and all of its respective subcontractors shall comply with all Office of the Comptroller of the

Currency (OCC) security and privacy policies and standards in effect at the time of the award of the contract, as well as those requirements that may be added during the contract.

The contractor/service provider shall conform to OCC administrative regulations, policies, and procedures, as listed in section [cite corresponding location in contracting document], in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. The contractor shall work with OCC internal organizations, as needed, to ensure that policies, procedures, configuration control, and product life-cycle requirements are fulfilled to the satisfaction of OCC ITS.

B. General Requirements

Location. Information collected, used, stored, maintained, or otherwise processed by the contractor in the performance of this contract shall be accessed, transferred, stored or processed only within the United States.

In addition, the maintenance and support operations of the contractor's technology and information must take place, and originate from, within the United States.

Authorization to Use, Store, or Share Sensitive Information. The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all government data, equipment, etc. by treating the information as sensitive. All information gathered or created under this contract shall be considered as Controlled but Unclassified (CUI) information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets.

Confidentiality. The contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

Non-Disclosure Agreement. Each individual who has access to sensitive OCC data and/or the OCC network, systems, applications, laptops, or other OCC information resources that may process, store or transmit sensitive OCC data under this contract shall execute a Non-Disclosure Agreement before being allowed such access.

Deliverables. The deliverables in this contract will be considered CUI and shall not be shared with any other organization without prior written approval from the [insert specific OCC role].

C. Security and Privacy Authorization

D. Configuration Management

E. Continuous Monitoring

Compliance Reviews and Audits. The contractor shall permit and support compliance reviews and audits under applicable laws to allow the OCC to meet legal and compliance obligations and shall implement processes that allow visibility into the privacy and security controls employed and their effectiveness. The contractor shall provide the OCC or authorized designated officials with information requested by auditors in a timely manner, consistent with the respective auditor's deadline, in support of security compliance reviews and various annual audits, e.g., FISMA, Financial Statement Audit, A-123, etc.

F. Data Protection

Data Encryption. Where encryption is required, as specified by the OCC, the contractor shall ensure that encryption is established and maintained for data at rest and in transit for the duration of the contract. The encryption employed shall be equivalent to those approved in Federal Information Processing Standards

(FIPS) Publication 140-2 or 140-3.

Need to Know. Sensitive information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected.

General Use of Controlled Unclassified Information (CUI). The contractor shall not use any CUI or CUI subcategories, including, Personally Identifiable Information (PII) or low-sensitivity PII (e.g., E-mail

Groups and Lists), for any purpose other than those activities necessary to the performance of this contract.

Use of PII Specific to this Contract's Scope of Work. The scope of work for this contract has specific business driven and functional requirements that involve PII. The contractor, contractor employees, and subcontractors must physically secure PII when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss. PII is no longer needed or required to be retained under applicable government records retention policies, it must be destroyed through means that will make the sensitive PII irretrievable. The contractor shall only use PII obtained under this contract for purposes of the contract and shall not collect or use such information for any other purpose without the prior written approval of the contracting officer. At expiration or termination of this contract, the contractor shall turn over all sensitive PII obtained under the contract that is in its possession to the government.

In accordance with OMB M-17-12 Preparing for and Responding to a Breach of Personally Identifiable

Information, the contractor and subcontractor(s) shall:

1. Properly encrypt PII in accordance with OMB Circular A-130 and standards per the "Data Encryption" subsection above.

2. Complete regular training on how to identify and report a breach;

3. Maintain capabilities to determine what Federal information was or could have been accessed and by whom, construct a timeline of user activity, determine methods and techniques used to access Federal information, and identify the initial attack vector;

4. Allow for an inspection, investigation, forensic analysis, and any other action necessary to assist with responding to a breach;

5. Adhere to notification and reporting requirements specified in Section G. "Incident Response" to effectively report and manage a suspected or confirmed breach as soon as possible (within 1 hour) and without unreasonable delay, consistent with the OCC's Incident Response Plan and US-CERT notification guidelines. Please note that a report of a breach shall not, by itself, be interpreted as evidence that the contractor or its subcontractor failed to provide adequate safeguards for PII.

Use of Contractor Equipment. Use of contractor-owned laptops or other equipment (e.g., media storage devices, servers, etc.) to process, transmit, or store OCC information or to access the OCC network or other

OCC information resources without OCC's formal approval is prohibited. This restriction does not apply to the use of non-OCC laptops or PCs to use OCC-approved virtual desktop infrastructure to remotely access the OCC network.

G. Incident Response

Notification. The contractor must report all information security incidents that potentially or actually cause the compromise of OCC information, even if the contractor believes the security incident may be limited, small, or insignificant with respect to OCC data or systems. The OCC will determine when the contractor's reported security incident requires additional focus and attention.

Within one hour from the time the contractor validates that an information security incident has occurred, the contractor must report the security incident information to the OCC Cyber Defense Center (CDC):

Computer.Security@occ.treas.gov, (202) 649-7930, regardless of day or time.

The contractor must provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC with the following text in the subject line of the email: “Supplementary

Information/Report related to previously reported incident # [insert number].”

Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive

Information, use FIPS 140-2 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

When notifying the OCC CDC, copy the Contracting Officer if possible or, if reporting by phone or

Contracting Officer's email is not immediately available, contact the Contracting Officer immediately after reporting the incident to the OCC CDC.

Information, System and Tool Availability. The contractor shall make available any information, systems and tools necessary for the OCC to respond to incidents in a manner consistent with NIST SP 800-61, as amended. In the case of a reported security incident, the contractor shall provide the OCC with access to the contractor's system and/or facilities within 72 hours of the OCC's request.

H. Information Ownership

Government Access. The government will retain unrestricted rights to government data. The OCC retains ownership of any user created/loaded data and deliverables (e.g., documents, applications, custom code, diagrams, workflows, data sets, etc.) hosted on contractor's equipment, systems, infrastructure, etc., as well as maintains the right to request full copies of these at any time.

Removal of OCC Data. The contractor acknowledges the OCC's exclusive right of ownership of the information and is required to transfer, return, and/or delete all agency data collected, processed, stored or maintained by the contractor on behalf of OCC upon termination of services, and shall provide written certification and supporting documentation attesting to the transfer, return and/or deletion of agency information or data generated, collected, processed, maintained, or stored by the contractor and any subcontractors, per instructions the "Security and Privacy Vendor Deliverables" section.

Documents and Deliverables. The preliminary and final OCC-specific deliverables and all associated working papers are the property of the U.S. Government. The contractor shall not release any information without the written consent of the Contracting Officer. All work papers, preliminary and final deliverables must be submitted to the COR at the conclusion of the contract in an acceptable and usable format, which may include the original format.

eDiscovery. The contractor must ensure data preservation requirements (i.e., halt destruction and maintain data the contractor may not otherwise have to maintain) related to litigation holds are met. The contractor shall also ensure that metadata associated with litigation holds are preserved. Metadata is electronically-stored information that describes the history, tracking, or management of an electronic document. It is created automatically when a user creates, modifies, accesses, or takes other actions with respect to an electronic document.

The contractor shall provide immediate access to all government data and government-related data impacting government data for review or scan, or conduct of a forensic evaluation, and physical access to any contractor facility with government data.

I. System Access

Government Right to Terminate Access. The OCC, at its discretion, may suspend or terminate the access to any systems and/or facilities when an information security incident or other electronic access violation, use or misuse issue gives cause for such action. The suspension or termination may last until such time as OCC determines that the situation has been corrected or no longer exists.

J. Training Requirements

Security Awareness Training. All contractor personnel with access to OCC data and systems must complete

OCC-provided mandatory security and privacy training prior to gaining such access. Non-compliance may result in revocation of system access.

Role-Based Training. The contractor shall ensure that IT personnel supporting this contract complete eight

(8) hours of role-based specialized IT security training on an annual basis. The contractor must identify the

IT personnel and their respective IT role1 that they serve in support of this contract. The contractor shall provide the list of List of IT Personnel on this Contract and Respective Role and the Completion Report for

Role-Based IT Security Training per directions in the "Security and Privacy Vendor Deliverables" section.

1IT Personnel include systems engineers; software developers; systems security engineers; privacy engineers; system, network, and database administrators; personnel conducting configuration management activities; personnel performing verification and validation activities; personnel with access to system-level software; personnel with contingency planning and incident response duties; personnel with privacy management responsibilities; personnel with access to personally identifiable information; and system security officers.

K. Supply Chain Risk Management

L. Security and Privacy Vendor Deliverables

Non-Disclosure Agreement (NDA) Deliverables Section Deliverable Frequency Due Date

B. General

Requirements. Non-

Disclosure

Agreement

Non-Disclosure Agreements for each contractor personnel working in support of this contract Once

Prior to accessing

OCC information resources

Removal of Data Deliverables Section Deliverable Frequency Due Date

H. Information

Ownership. Removal of

OCC Data

Certification of OCC Data Removal from

Contractor’s (including any subcontractors), Possession, Equipment, and/or Environment.

Data removal instructions include transfer of information to another party per specific instructions from the CO; return of information, deliverables, etc., to the CO; and deletion of OCC data from contractor equipment (e.g., laptops and other contractor-owned equipment previously approved by the OCC for this use) using NIST SP 800-88, Guidelines for Media Sanitization, as amended.

Once NLT 15 days after termination/expiration of contract

Training Deliverables Section Deliverable Frequency Due Date

J. Training

Requirements. Role-

Based Training

List of IT Personnel on this Contract and Respective

Role

Initially and as changes occur

Initial: 30 days from award; updates as needed

J. Training

Requirements. Role-

Based Training

Completion Report for Role-Based IT Security

Training Annually Annual NLT June 3th