PWS ID Protection ID Monitoring.pdf

PERFORMANCE WORK STATEMENT

IDENTITY PROTECTION/IDENTITY MONITORING SERVICE

DATE: November 14, 2024

1.0 INTRODUCTION

Governmental policy requires all federal agencies and bureaus to notify individuals when their Personally Identifiable Information (PII) has been compromised and placed them at risk of identity theft. In January 2017, OMB Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information (PII), rescinded and replaced OMB M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, instructing Federal agencies to enhance their safeguards for PII and to enact incident handling and data breach notification policies. It updated the existing OMB data breach notification policies and guidelines in accordance with the Federal Information Security Modernization Act of 2014 (FISMA), and implemented recommendations included in OMB Memorandum M-1604, Cybersecurity Strategy and Implementation Plan (CSIP) for the Federal Civilian Government.

Standard credit monitoring services assists individuals in early detection of instances of identity theft and typically notifies individuals of changes that appear in his/her credit report, such as the creation of a new account or new inquiries to his/her credit file. Due to the dramatic increase in attempts of identity theft, the IRS determined that a more appropriate offer for protection was to expand beyond the monitoring of information contained in a credit report (credit monitoring) and to provide three (3) years of coverage/protection. The government seeks a contract that includes other fraud detection services that monitor additional sources, e.g., internet sites, for compromised data so that an individual is fully protected.

Identity Protection and Identity Monitoring services monitor the use of an individual's overall identity beyond information contained in a credit report. This monitoring generally tracks whether the individual's information has been exposed online, in addition to monitoring other databases, which may include information related to change of address, court records, payday loans, health, criminal, and other identifying information beyond just financial credit information. These more comprehensive services mitigate risks of the non-credit identity thefts outlined above.

2.0 SCOPE

The contractor shall provide Identity Protection/ Identity Monitoring, with established appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of individual credit information and to protect against any anticipated threats or hazards to the credit information which could result in substantial harm, embarrassment, inconvenience or unfairness to any individual on whom information is maintained.

The contractor shall support an undetermined number of future data breaches for the period specified. These data breaches occur sporadically throughout the year and range from minor breaches consisting of 20 identities or fewer per week to major breaches consisting of 100,000+ identities. The coverage shall be continuous for a period of three (3) years from the date the impacted individual requests data breach analysis services.

3.0 PERFORMANCE REQUIREMENTS

The contractor shall provide Customer Support Services, Identify Theft Resolution,

3.1 Customer Support Services

3.1.1 A means of enrollment via internet, telephone, and live agent.

3.1.2 A dedicated toll-free customer assistance line available 24 hours a day, 7 days a week, for assistance with enrollment/authentication, product related questions, understanding the content of credit information, investigating information believed to be inaccurate, and identity theft resolution. The contractor shall provide qualified personnel to man the call center. All call centers and call center personnel shall be located in the United States.

3.2 Identity Theft Resolution

If a consumer is a victim of ID Theft, the contractor must offer assistance and remediation, as part of their membership service.

3.2.1 The contractor must provide access to dedicated Fraud Specialists who will work with the consumer through the process of working to clear up the damage caused by the theft of their identity. These Specialists must be available on a 24 x 7, 365-day basis.

3.2.2 The Fraud Specialists will:

3.2.2.1 Review the content of the consumer’s 3-in-1 Credit Report to identify all fraudulent tradelines and information that exists on their credit files at all three credit reporting companies

3.2.2.2 Initiate disputes of content of the credit report that may be inaccurate

3.2.2.3 Assist in Fraud Alert placement, if not already done by the consumer

3.2.2.4 Completing the Federal Trade Commission (FTC) Fraud Affidavit

3.2.2.5 File a police report

3.2.2.6 Notify Government Agencies (Federal Trade Commission (FTC), the Department of Health and Human Services (HHS), the FBI, Local Law Enforcement, etc.)

3.2.2.7 Notify credit grantors

3.2.2.8 Provide the consumer with Identity Theft Prevention Tips and content so they are fully educated on the process they are going through to clear up the ID theft situation and how to prevent further problems

3.3 Identity Support Services

3.3.1 Comprehensive daily credit file monitoring to adults (18+)

3.3.2 Automated daily alerts of key changes to Equifax, Experian, and TransUnion credit files via email, wireless alert or U.S. Mail (delivery method will be at the customers’ option). Alerts of key changes must be made (or sent) to the customer within 24 hours. Customizable alerts must also be available and include:

frequency of messaging and vehicle of delivery, at the enrollees/subscriber/customer choice.

3.3.3 The capability to advise and assist the customer in placing fraud alerts on the customer’s credit file at the request of the subscriber/customer. Fraud alerts to include changes to or applications for credit cards, bank accounts, driver’s license, etc. based on enrollees/subscriber/customer choice.

3.3.4 One 3-in-1 Credit Report. (also called a triple-bureau credit report)

3.4 Identity Protection/Identity Monitoring Services

3.4.1 Monitoring of PII in credit applications, public records, websites, and other places for any unusual activity that could be signs of identity theft and alerts you when your personal information, e.g., bank account information, Social Security number, driver’s license, passport, medical ID number, etc., is being used in ways that generally don’t show up on your credit report.

3.5 Identity Theft Insurance

3.5.1 A minimum of $1 million in identity theft insurance with $0 deductible, at no additional cost to the subscriber/customer. Coverage includes, but is not limited to:

postage, copying, notary costs, legal fees and other costs directly associated with reclaiming the subscriber/customer identity (e.g., replace important documents like the subscriber/customer driver’s license or passport), coverage for lost wages due to time taken off of work to deal with an identity fraud situation, reimburse the subscriber/customer for stolen funds caused by identity theft (up to $10k), etc.

3.6 Ordering Enrollment Codes (Individual Unique Identifiers)

3.6.1 Services will be ordered via a task order issued by the Contracting Officer in accordance with the terms outlined herein and will include estimated quantities of individual unique identifiers/enrollment codes to be provided and the ordering periods in accordance with the periods specified.

3.6.2 The contractor shall provide individual unique identifiers/enrollment codes that will be included on respective notifications to individuals impacted by a data breach.

3.6.3 The contractor shall be able to provide to the Program Office within ten (10) business days of a request, the quantity of enrollment codes (unique identifiers) requested. The preferred format is Excel.

3.6.4 Effective and expiration dates shall be identified with the individual unique identifiers/enrollment codes when provided to the IRS by the contractor.

3.6.5 In the event all unique identifiers/enrollment codes provided for the respective period are not used, the contractor shall provide the difference in the amount (number of unique identifiers specified above minus the number remaining from the previous period) for use in the subsequent ordering period when the option is exercised if requested by the Program Office.

3.6.6 The IRS notifies the impacted individuals of a data breach via Letter 4281C.

Impacted individuals wishing to take advantage of the offer are responsible to interact directly with the contractor to request services. Upon request from impacted individuals, the contractor shall provide services as outlined herein.

3.6.7 The IRS has identified three levels of identity protection and identity monitoring redemptions needed:

3.6.7.1 Day-to-day data breaches. The contractor must be able to support up to 1,500 redemptions. (Note: The number of redemptions is based on 7,500 notifications and a 20% redemption rate)

3.6.7.2 Large data breaches. The contractor must be able to support up to 360,000 redemptions. (Note: The number of redemptions is based on 1,800,000 notifications and a 20% redemption rate)

3.6.7.3 Catastrophic data breaches. The contractor must be able to support up to 15,638,500 redemptions. (Note: The number of redemptions is based on 78,192,500 notifications and a 20% redemption rate)

4.0 PROGRAM ENROLLMENT REPORT

By the end of the 7th business day of each following month or prior to invoice submission, the contractor must provide to the Contracting Officer Representative (COR) an enrollment report listing the Enrollment Codes (unique identifiers) redeemed, the Date of Activation, how the identifiers were redeemed (offline (by telephone) or online (via internet), and the subscriber/customer’s Last Name, First Name, and State of Residence.

Reports shall be provided in contractor generated format via Excel, subject to approval and feedback of Government. They shall clearly state the period start and end date/time of data contained in the report. All reports shall be provided via secure method such as encrypted email or by a secure web portal. Encryption requirements shall conform to IRS Cybersecurity approved methods.

5.0 QUALITY CONTROL PLAN (QCP)

The Contractor shall maintain and utilize a QCP which correlates to the Performance Requirements Summary (PRS) and Quality Assurance Surveillance Plan (QASP) throughout the life of the contract. The QCP must contain, at a minimum:

• A description of the inspection system to cover all services in the QASP. The description must include specifics as to the areas to be inspected on both a scheduled and unscheduled basis, frequency of inspection, and the title and organizational placement of the inspectors.

• A description of the methods used for identifying and preventing defects in the quality of service performed.

• A description of the records to be kept to document inspections and corrective or preventive actions taken.

The records must be kept and made available to the contracting officer, when requested, throughout the contract performance period and for the period after contract completion up to a retention period of six years in accordance with FAR 4.805.

6.0 VIRTUAL KICK-OFF MEETING

A “Virtual Kick-Off Meeting” will be scheduled no later than seven (7) business days from date of award.

7.0 DELIVERABLE SCHEDULE

Item No. Deliverable Due Date Deliverable Recipient

Deliverable Format

1. Virtual Kick-Off Meeting Not later than 7 business days after BPA award

COR Conference Call or Video Conference

2. Final Quality Control Plan Within 10 business days after kick-off meeting

COR MS Word or PDF

3. Program Office Enrollment Report

Within 7 business days of each following month

COR Excel

4. Unique Identifiers Within 10 business days of award

COR Excel

8.0 INSPECTION AND ACCEPTANCE

Inspection at the Government’s locations stated herein in accordance with FAR 8.406-2 “Inspection and Acceptance”

8.1 Specific Acceptance Criteria

The specific quality measures as set forth below will be applied to each deliverable received from the contractor under this contract. Any perceived conflict with the quality measures listed below should be immediately reported to the Contracting Officer.

• Accuracy – Deliverables shall be accurate in presentation, technical content and specifications and adherence to accepted elements of style.

• Clarity – Deliverables shall be clear and concise.

• Specifications Validity – All deliverables must satisfy the requirements of the

Government as specified herein.

• Format – Deliverables shall be submitted electronically as agreed to by the contractor and Government. Deliverables shall be produced using Microsoft Office 2000 Professional.

• Timeliness – Deliverables shall be submitted in accordance with the days identified in the chart above.

8.2 Rejection Procedures

Any deliverable that does not comply with the acceptance criteria outlined in Section 8.1, “Specific Acceptance Criteria” shall be considered rejected. The COR has 10 business days to inform the contractor that the deliverable is rejected, and the contractor has 5 business days to re-submit the deliverable for inspection and acceptance. The number of days allotted to the contractor for re-submission of deliverables maybe adjusted if agreed upon by both parties. This process will continue as required until acceptance has been issued by the COR.

8.3 Performance Requirements Summary

Required Service

Performance Standards

Acceptable Quality Levels

Method Of Surveillance

Incentive (Negative) (Impact on Contractor

Performance)

1. Reports (2b)

Reports contain the specified information with no duplicate or reused unique identifiers/ enrollment codes.

Reports received by the end of the 7th business day of each following month

95%

95%

100% Document review

100% Document review

Contractor

Performance

2. Ordering (2c)

Provide the program office with the requested number of unique identifiers/ enrollment codes within 10 days of a request.

95% 100% Document Review