PBGC RFI TAS Managed Service.Final.pdf

Request for Information

Document Type: Request for Information (RFI) RFI Notice Number: 16PBGC23RFI0001 Program Title: RFI – Investment Portfolio Accounting Managed Service for PBGC’s Trust Accounting System (TAS)

Contracting Office:

Pension Benefit Guaranty Corporation (PBGC) Procurement Department

445 12th Street, SW Washington, DC 20024-2101

DISCLAIMER

This Request for Information (RFI) is not a Request for Proposal (RFP), may be canceled at any time, and may not result in the issuance of an RFP or award of a contract. This is a Request for Information ONLY and does not constitute a solicitation for proposal or any obligation on behalf of the Government. A response to this RFI is not an offer and cannot be accepted by the Government to form a binding contract. This RFI is issued solely for information and planning purposes-PBGC is not currently seeking proposals and will not accept unsolicited proposals. Respondents are advised that the Government will not pay for any information or administrative costs incurred in response to this RFI. All costs associated with responding to this RFI will be solely at the respondent's expense. All submissions, detailed below, become Government Property and will not be returned. Failure to respond to this RFI does not preclude participation in any future RFP, if any such request is issued. Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled in accordance with applicable regulations and statues. All personnel reviewing RFI responses understands their responsibility for proper use and protection from unauthorized disclosure of proprietary information as described in 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified. To the maximum extent possible, please submit non-proprietary information.

The information provided will not be used for any purpose other than for market research.

Please note: some respondents may be asked to provide a demonstration of their solution to PBGC for market research purposes.

BACKGROUND/CAPABILITIES SOUGHT

This Request for Information (RFI), as defined in Federal Acquisition Regulation (FAR) 15.201(e) is being issued to gather information relevant to Investment Portfolio Accounting solutions that are currently available. The Government will use any information submitted as market research to better appreciate the capabilities of the industry. PBGC is seeking information from potential sources that can provide an investment portfolio accounting subscription license solution through a secure hosted managed service/government cloud model. PBGC currently uses a cloud-hosted investment portfolio accounting system referred to as the “Trust Accounting System.” PBGC is seeking an Investment Portfolio Accounting Solution directly from the COTS Product Vendor offered as a managed service/government cloud solution. PBGC is requesting responses from COTS/Hosted solution vendors with a preference for Federal implementation experience and with the solution actively in use by Federal clients.

Accounting for terminated pension plans from the date of plan termination (DOPT) through the date of trusteeship (DOTR) and for the commingled trust portfolio assets is a critical component of PBGC’s financial responsibilities.

This trust accounting area involves a group of business processes that perform accounting for assets of terminated pension plans. This includes the transfer of assets to the PBGC custodian bank (currently State Street Bank), from other financial institutions after the DOTR, as well as the accounting for commingled assets at the PBGC custodian bank. This group of business processes is unique to PBGC and is performed by the Investment Accounting Branch (IAB within PBGC’s Financial Operations Department. IAB responsibilities include:

• Asset Accounting: IAB staff members record accounting transactions of terminated plans as of the date of plan termination (DOPT). Which can be considered an inception date.

• Current Value Accounting: IAB monitors and records the current value of assets, income, and expenses, after DOPT, until the assets have been transferred to PBGC’s custodian bank (State Street).

• Transfer of Plan Asset Accounting: IAB records all transfer of plan assets from a plan’s interim custodian bank to PBGC’s custodian bank (State Street) until all plan assets have been received and commingled with other PBGC managed assets.

• Commingled Asset Accounting: IAB monitors and records transactions for commingled assets after the date of commingling.

• Financial Reporting: IAB prepares, generates and reviews reports from the Trust Accounting system and PBGC’s Oracle eBusiness Suite General Ledger and submits to appropriate entities.

• Month, Quarter, and Year End Processing: These processes include verifying that all transactions have successfully posted, closing the current month, preparing, and submitting various financial reports and providing information needed by the Financial Reporting and Account Analysis Group (FRAAG) to prepare internal and external reports. The year-end closing process includes both manual and automated steps.

SUBMISSION INSTRUCTIONS & CONFIDENTIALITY

Please submit the following information:

1) Company name, Commercial and Government Entity (CAGE) code, Data Universal

Numbering System (DUNS) number, and your North American Industry Classification System (NAICS) economic activity number(s) related to this synopsis.

2) Name of authorized company representative(s) with title(s), mailing address, phone number(s), and e- mail address(es).

3) If the vendor is a small business concern, please identify your socio-economic category relative to your suggested NAICS.

4) If the vendor is on GSA, provide your GSA Schedule number.

5) Is your solution:

a) Yes or No. An Investment Portfolio Accounting COTS Product, where you are the vendor and not acting as a system integrator or third-party solution provider?

b) Yes or No. Implemented and in active use at a US Government Federal agency?

If so, please complete the following Capabilities Statement: Please include at most 3 relevant projects and the following information (in no more than 5 total pages):

(1) Project Title

(2) Federal Government Agency Name

(3) Federal Government Agency POC and Email

(4) Contract Number/Task Order Number

(5) Total Contract Value

(6) Period of Performance

(7) Is there a CPARS available, “Yes” or “No”?

(8) Was the solution implemented on premises or as a managed/SAAS service?

(9) Description of Services Provided.

6) Yes or No. Does the system have the ability to establish, maintain and distinguish between inception and non-inception accounting transactions by PBGC case number (portfolio) via interface, upload or entering directly? Note: There are currently 5,000+ cases.

7) Yes or No. Does the system have the ability to create customized and ad hoc reports that capture inception and non-inception entries and/or balances?

8) Yes or No. Does the system have the ability to perform investment accounting (buys/sells, calculation of gains and losses, interface with separate pricing vendor, maintain a security master file portfolio, calculation of accrued investment income)?

9) Yes or No. Is your solution FedRAMP authorized (https://www.fedramp.gov)?

a) If ‘yes,’ please provide the link to your authorization information on GSA's FedRAMP site.

b) If ‘no,’ is your solution on listed on the FedRAMP “In-Process list” as part of the

FedRAMP authorization process? If so, please provide the link to appropriate GSA FedRAMP site to show status.

https://www.fedramp.gov/

10) If your solution is NOT FedRAMP authorized and not on FedRAMP “In-Process list”, is your solution deployable locally at a client’s datacenter or deployable on client’s Azure Government Cloud? Yes or No.

11) If your solution is NOT FedRAMP authorized, but it is hosted (or if there is an option for hosting it), please respond to the following:

a) Yes or No. Is your solution registered with any other security registries (e.g. STAR Registry from Cloud Security Alliance)? If yes, which registry.

b) Describe how the solution and hosting services map and implement controls aligned to the National Institute for Standards and Technology (NIST) Special Publication 800-53 to allow this customer to achieve authority to operate (ATO). If using ISO/IEC 27000 please describe how this is implemented in relation to the NIST framework?

i) Yes or No. Do you have a cross walk between your security framework and the NIST framework that can be provided upon request.

c) For the following, do you have documentation that can be submitted as part of this response or provided upon request?

i) Continuous Monitoring and Controls Reporting - Describe your continuous monitoring process with specific reference to control testing and delivery of associated artifacts to clients for ATO.

ii) Configuration & Vulnerability Management - Describe the configuration and security vulnerability management program provided for clients and how these services are aligned to meet both NIST and Office of Management & Budget (OMB) directives. Please describe your scanning and patching schedule, how results are delivered to clients and confirm if your solution has software/hardware with known critical or high vulnerabilities in the National Vulnerability Database (NVD) or otherwise they have been reviewed with the risks accepted.

iii) Continuity of Services/Disaster Recovery – Describe how you have implemented continuity of services/disaster recovery for your solution. Does the solution have the ability to maintain a redundant configuration at an alternate site to allow for contingency operations planning based on the system classification?

iv) Information System Access Control – Describe how privileged and non-privileged access is implemented and controlled for your solution. Please describe how the solution:

(1) Utilizes security groups/rights and ensures FISMA and NIST compliance such as role-based access for various users, including administrators and provide read-only or read and write access types.

(2) Integrates with Active Directory and if multifactor authentication is implemented (or available).

(3) Provides the ability to enforce least privileges (need-to-know) for the performance of specified tasks based on job requirements and the ability to configure separation of duties (SOD) to prevent malevolent collusion.

(4) Has ability to configure to lock user accounts/access after 15 minutes of inactivity or 5 consecutive invalid login attempts and terminate user sessions after 30 minutes of inactivity.

(5) Provides information or reports on when user accesses have been newly added or removed or which users have superuser level role accesses.

v) Audit and Logging – Please describe the auditing and logging capabilities of your solution. This should include a description of the solution’s ability: 1) to generate audit records, including the capability and sufficient capacity to record events and if there is any type of administrative activities, 2) to protect application-specific audit information from unauthorized access, creation, modification, and deletion, 3) to monitor capabilities to track user access and log ins including the number of failed login attempts.

vi) PII and Data Protection - In relation to the elements contained in NIST SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organization, can you please describe how your organization protects data? Are your data centers located exclusively in the United States? Can you ensure that PBGC’s data is not commingled with that of other customers and that all client’s data storage is logically or physically distinct and separate from all other clients and stored exclusively within the United States? In addition, please specifically address your solution’s ability to:

(1) Do you store PII data as part of the solution? If so, please describe how the solution protects PII data using techniques such as limiting/reducing reliance on PII data, encrypting PII data at rest and in transit, displaying partial/masked PII values where presenting is mandatory

(2) Protect data per Federal Information Processing Standards (FIPS 140-2), including TLS 1.2 and support for TLS 1.3 by January 1, 2024.

(3) Ensure that the data clustering process includes data protection, including metadata and meta tagging.

(4) Provide secure API connections with interfacing applications.

(5) Ensure data input validations were applicable to ensure data integrity. The solution provides ability to meet general security and privacy requirements such that it can provide the ability to ensure that the third-party providers employ adequate security measures to protect outsourced information, applications, or services, if applicable, and it does not have software/hardware vendor on the

Office of Foreign Assets Control (OFAC) Sections List.

(6) Is configured based on necessary data persistence requirements.

d) PBGC’s Directive GA-10-12 Guidelines for Usage of Foreign Nationals in PBGC Contracts, establishes a uniform systematic process that allows program managers to appropriately identify, evaluate and mitigate risk with respect to contracts which may employ Foreign Nationals residing and performing PBGC services outside the U.S. and its territories, PBGCFAR and PBGC 52.239-7007 Managed IT Services (SEP 2020)PBGC is required to perform background screening on all contractor staff with access to data or resources containing PBGC information. Per PBGC Policy, this screening is performed by the Office of Personnel Management, National Background Investigations Bureau (OPM/NBIB). The OPM NBIB service is limited to background screening resources located in the United States. Are all personnel that would support PBGC’s use of your managed service based in the United States? If no, what percentage or approximate account of personnel are based outside of the United States and would you be willing to identify any security and operational roles performed by these personnel?

12) Yes or No. Does your solution comply with Section 508 of the Rehabilitation Act of 1973

(www.access-board.gov and www.section508.gov) as amended (29 V.S.c. 794 (d)) to provide for access by people with disabilities?

13) Yes or No. Are software releases of your solution tested periodically for compliance with

Section 508 of the Rehabilitation Act or against the World Wide Web Consortium’s Accessibility Guidelines? If yes, please provide your most recent accessibility compliance report (ACR) in the Voluntary Product Accessibility Template (VPAT) format.

14) Yes or No. Does system documentation such as user manuals or other instructions comply with the requirements of Section 508?

Responses to this RFI notice shall be provided via email to all the PBGC Procurement Department POCs listed below, no later than 12:00 PM EST on November 23, 2022.

Proprietary information and trade secrets, if any, must be clearly marked on all materials.

All information received that is marked Proprietary will be handled accordingly. Please be advised that all submissions become Government property and will not be returned.

All government and contractor personnel reviewing submissions resulting from this RFI will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as described 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified. To the maximum extent possible, please submit non-proprietary information.

If you have questions prior to submission, please send your written questions via e-mail to the following POCs:

Brittany Helmkamp, Contracting Officer E-mail: helmkamp.brittany@pbgc.gov

Alternate Contact:

Amanda VanderVeen, Contracting Officer E-mail: vanderveen.amanda@pbgc.gov

Confidentiality: No classified or confidential information should be included in your response. The Government reserves the right to use any non-proprietary technical information in any resultant solicitation(s). Any proprietary information should be clearly marked.

[End of document] mailto:helmkamp.brittany@pbgc.gov mailto:vanderveen.amanda@pbgc.gov