PWS TSP Fiduciary Oversight 12.22.23.docx

Performance Work Statement (PWS) For Fiduciary Oversight of the Federal Retirement Thrift Investment Board

EBSA

PART 1

General Information

Description of Services/Introduction:

The contractor shall provide all personnel, equipment, tools, materials, supervision, and other items and non-personal services necessary to perform the fiduciary oversight of the Federal Retirement Thrift Investment Board (FRTIB) delegated to the Employee Benefits Security Administration (EBSA) under the Federal Employees’ Retirement System Act of 1986, as amended (FERSA or the Act) as defined in this Performance Work Statement, except as Specified in section C-3 as government furnished property and services. The contractor shall perform to the standards in this contract action.

Background:

The Department of Labor through its EBSA administers a comprehensive program to protect the interests of participants and beneficiaries of employee benefit plans. On April 13, 1987, EBSA was delegated this new authority and assigned responsibility for Department of Labor’s administration of FERSA responsibilities. This work includes the review of records of participants in the federal retirement Thrift Savings Plan (TSP), a defined contribution pension plan with assets in excess of $810 billion and over 6.9 million participants. These requirements parallel, in many ways, the standards for fiduciary conduct which have been administered and enforced by the Department of Labor since the enactment of the Employee Retirement Income Security Act of 1974 (ERISA). FERSA Section 8477(g) requires the establishment of a program to carry out audits to determine the level of compliance with its fiduciary responsibilities and requirements to identify and correct prohibited activities of responsible fiduciaries. The Secretary of Labor may conduct the audits authorized under FERSA by contract using qualified non-governmental organizations to perform audits of the FRTIB’s compliance with FERSA. The Secretary of Labor may conduct the audits authorized under FERSA by contract using qualified non-governmental organizations to perform audits of FRTIB’s compliance with FERSA.

Objectives:

The Contractor shall assist the Department of Labor in carrying out the Department of Labor’s fiduciary compliance audit responsibilities under FERSA and delegated to EBSA. FERSA fiduciary compliance broadly includes the following business and technical objective areas:

Business Objectives:

Auditing the Board’s oversight duties and responsibilities to determine fiduciary compliance with FERSA - operating the Thrift Savings Plan in the best interests of participants and beneficiaries.

Auditing Risk Mitigation Processes to monitor the FRTIB’s efforts to close prior open recommendations and mitigate new audit risks.

Auditing Investment Management Strategies and Operations to determine whether the FRTIB is complying with its investment management parameters and metrics.

Technical Objectives:

Perform comprehensive, complex, audits on FRTIB and its vendors to ensure the information technology systems used to create, process, and store TSP-related data comply with government and industry standards, particularly the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Revision (Rev.) 5, Security and Privacy Controls for Information Systems and Oranizations. It must be understood that the current information system is a modernized, fully cloud-hosted systems-of-systems utilizing multiple infrastructure-as-a-service (IaaS) and software-as-a-service (SaaS) FedRAMP authorized providers to host and manage the technical information system and deliver Plan operations on behalf of FRTIB under a managed services model. Additionally, FRTIB contracts with the Interior Business Center (IBC), Department of Interior, for financial services and the Department of Justice for data security support.

Scope:

This work involves establishing and carrying out a series performance audits to determine the FRTIB’s level of compliance and proficiency with the administrative requirements of FERSA relating to fiduciary responsibilities and prohibited activities of fiduciaries in task areas including:

Task Area 1: Participant Website Controls - determines whether the Agency and its vendors developed and implemented policies and procedures to secure participant communications and transactions via the Web through identification and authentication protocols and configurations settings, system edit checks, regarding certain indicative data updates and transaction types; and managing website configurations changes. Assess the status of prior EBSA open recommendations in this area, if any.

Task Area 2: Mainframe Configuration - reviews policies and procedures related to establishing and monitoring controls over the mainframe configuration settings at the Multiple Virtual Storage (MVS) operating system level. Assess the status of prior EBSA open recommendations in this area, if any.

Task Area 3: Mobile Device and Security Governance Review - reviews the Agency’s mobile device security and governance controls. Assess the status of prior EBSA open recommendations in this area, if any.

Task Area 4: Insider Threat Controls - determines whether the Agency and its vendors developed and implemented controls to prevent, monitor, detect, and respond to insider threats. Assess the status of prior EBSA open recommendations in this area, if any.

Task Area 5: Participant Support/Contact Center Operations - determines whether the Agency and its vendors developed and implemented policies and procedures to provide timely and accurate information to plan participants and beneficiaries. Assess the status of prior EBSA open recommendations in this area, if any.

Task Area 6: Loan Operations - determines whether the Agency and its vendors developed and implemented policies and procedures to promptly and accurately process loan transactions in accordance with regulations. Assess the status of prior EBSA open recommendations in this area, if any.

Task Area 7: Account Maintenance - determines whether the Agency and its vendors developed and implemented policies and procedures to accurately reflect in participant accounts contributions, daily valuation, and the appropriate fund balances as elected by participants. Assess the status of prior EBSA open recommendations in this area, if any.

Task Area 8: Withdrawals - determines whether the Agency and its vendors processed TSP withdrawal transactions promptly and accurately in individual participant accounts. Assess the status of prior EBSA open recommendations in this area, if any.

Task Area 9: Lifecycle Funds Operations - determines whether the Agency and its vendors developed and implemented policies and procedures to rebalance the L Funds on a daily basis to reflect each fund’s target allocation for the current quarter. Assess the status of prior EBSA open recommendations in this area, if any.

Task Area 10: Treasury "G" Fund Investment Operations - determines whether Treasury developed and implemented policies and procedures to accurately calculate the G Fund interest rate and interest earned on GFund investments. Test compliance of the TSP G Fund investment operations with FERSA. Assess the status of prior EBSA open recommendations in this area, if any.

Task Area 11: Investment Manager Operations - determines whether the investment manager(s) developed and implemented policies and procedures to promptly and accurately deposit TSP investments in authorized investment funds. Assess the status of prior EBSA open recommendations in this area, if any.

Task Area 12: Annuity Operations - determines whether the Agency and its vendors developed and implemented policies and procedures to process annuity payments and payments to beneficiaries promptly and accurately. Assess the status of prior EBSA open recommendations in this area, if any.

Task Area 13: Board Staff - determines whether the Agency developed and implemented policies and procedures: to maintain standards of conduct and provide ethics training; delegated authority; and to provide for succession planning. Assess the status of prior EBSA open recommendations in this area, if any.

Task Area 14: Assessment of FRTIB Independent Verification & Validation and Penetration Test Results: - determines whether the Agency and its vendors developed and implemented policies and procedures for independently verifying and validating security controls and properly managing the planning and implementation of corrective actions to resolve findings including those from Third Party Assessment Organizations (3PAOs) and penetration testing (both crowd-sourced and otherwise acquired). Assess the status of prior EBSA open recommendations in this area, if any.

Task Area 15: Service Provider TSP Operations (Civilian) – determines whether the civilian payroll service provider(s) developed and implemented policies and procedures over the account maintenance, loans, and withdrawals operations. Assess the status of prior EBSA open recommendations in this area, if any.

Task Area 16: Service Provider TSP Operations (Military) – determines whether the military payroll service provider developed and implemented policies and procedures over the account maintenance, loans, and withdrawals operations. Assess the status of prior EBSA open recommendations in this area, if any.

Task Area 17: Cyber Policies – Access and Data Security – determines whether the Agency and its vendors developed and implemented cybersecurity policies and procedures over user and administrative access controls, physical access controls, and data encryption. Assess the status of prior EBSA open recommendations in this area, if any.

Task Area 18: Cyber Policies – Information Protection Processes and Procedures - determines whether the Agency and its vendors developed and implemented cybersecurity policies and procedures to maintain and manage the protection of information systems and assets. Assess the status of prior EBSA open recommendations in this area, if any.

Task Area 19: Cyber Policies – Detection and Monitoring - determines whether the Agency and its vendors developed and implemented cybersecurity policies and procedures over the detection and monitoring of TSP information systems and assets. Assess the status of prior EBSA open recommendations in this area, if any.

Task Area 20: Vendor Risk Management and Agency Oversight Controls - determines whether the Agency developed and implemented oversight policies and procedures over vendor service level agreements and contractual compliance. Assess the status of prior EBSA open recommendations in this area, if any.

Task Area 21: Status of Prior Year Findings - determine and validate whether recommendations the Agency views as effectively resolved have been resolved. Conduct procedures over certain prior year recommendations to determine whether each recommendation has been closed, partially closed, remains open, or may have been potentially overtaken by events. Assess the status of prior EBSA open recommendations in this area, if any.

Period of Performance:

The period of performance shall be for one (1) Base Period of 12 months and four (4) 12-month option periods. The Period of Performance reads as follows:

The government reserves the right to extend the term of this contract action at the prices set forth in Section B in accordance with the terms and conditions contained in clause 52.217-9 entitled, “Option to Extend the Term of the Contract”.

General Information Quality Control:

The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is the means by which he assures himself that his work complies with the requirement of the contract. As a minimum, the contractor shall develop quality control procedures that address the areas identified in Technical Exhibit 1, “Performance Requirements Summary”. After acceptance of the quality control plan, the contractor shall receive the Contracting Officer’s acceptance in writing of any proposed change to his QC system. The Quality Control Plan is to be delivered with the contractor’s proposal.

Quality Assurance:

The government shall evaluate the contractor’s performance under this contract action in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s) as indicated in Technical Exhibit 1.

Section 508 Compliance

Section 508 Background

Electronic and Information Technology (EIT)/Information and Communication Technology (ICT) greatly affects how federal agencies, and their employees achieve agency goals, do their daily work and serve the American people. EIT/ICT is also a major gateway to employment opportunities in both the public and private sectors, and it is key to how information is shared with employees, how employees are productive in the workplace, and how they advance in their careers.

General Requirements All EIT/ICT deliverables produced by the CONTRACTOR shall be accessible, usable by assistive technologies, and meet the baseline criteria outlined in Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220) August 7, 1998, the Web Content Accessibility Guidelines 2.0 (WCAG 2.0) Level AA and the Department of Labor Management Series (DLMS) Section 7, Chapter 600. EIT/ICT deliverables include but are not limited to: websites, software, mobile applications, webcasts, webinars, multimedia (e.g. charts, graphs, graphics, videos, audio tracks, and animation), social media, collaborative workspaces and tools, documents (e.g. PDF, PowerPoint, Excel, and Word), forms and field elements, data tables, image maps, and any training and related training materials.

Print materials must be made available in an alternate accessible format when requested. By submitting deliverables pursuant to this contract, CONTRACTOR is certifying that such deliverables are conformant with the accessibility guidelines referenced above.

Accessibility Requirements for Deliverables

Accessible Formats

All documents and deliverables prepared for or provided to the Government must be in accessible formats (as indicated in the next paragraph). All materials submitted in hardcopy must be provided in an accessible electronic copy at the same time of hard copy submission or alternate accessible format when requested. Any multimedia must include synchronized captions that include all relevant audible information (dialog and sounds), include audio descriptions (when relevant visual information is not otherwise relayed audibly), and be navigable by assistive technologies. Any multimedia interactive interface elements (e.g., user controls) must be navigable by assistive technology and include proper name, role, and/or state properties. Audio-only content shall be accompanied by an accessible screen text or transcript that is an accurate and complete representation of that audio content. The contrast ratio between all content background and foreground colors shall be at least 4.5:1.

All pages within PDFs created for or provided to the Government (to include those created from scanned documents) must be accessible, the content within must be tagged correctly, and must return no potential errors in the Adobe Acrobat Pro’s Accessibility Full Check “Accessibility Report” when tested against the “Adobe PDF” checking option and all of its tests. All graphics, charts, and graphs marked as images/figures within a PDF must be tagged with appropriate, descriptive alternate text conveying equivalent meaning. All text content in the PDF must be readable with assistive technology (e.g. JAWS screen reader) on each page in a comprehensive and sequential manner, to include all information provided in any alternate text descriptions for graphics. Tag order of content (found in the Adobe Acrobat Pro “Navigation Pane”) must match the Reading Order (found in the Adobe Acrobat Pro “Order Pane”) of content through manual verification. Tables shall be tagged properly including column headers, row headers, and assigned scope. Decorative elements that convey no meaning should be marked as Artifacts. Any fillable form fields and buttons must have appropriate form tags, associated tooltips conveying all information needed to correctly complete the field, have a tab order that matches the visual reading order, and be accessible and usable by keyboard only and other assistive technology.

Government Remedies:

The Contracting Officer shall follow FAR 52.212-4, “Contract Terms and Conditions-Commercial Items” or 52.246-4, “Inspection of Services-Fixed Price” for contractor’s failure to perform satisfactory services or failure to correct non-conforming services.

Recognized Holidays:

The contractor is not required to perform services on Federal recognized holidays.

Presidential Inauguration Day Most Federal offices in the District of Columbia/Maryland/Virginia (DMV) metropolitan area are closed on the day a President is inaugurated on January 20th for each fourth year after 1965 (see 5 U.S.C. 6103(c)). Please check with the COR for confirmation.

Place of Performance:

The Contractor is able to perform its audit functions over sensitive data remotely using secured file transfer protocols established between the Contractor and the FRTIB.

The Contractor shall be reimbursed for the direct costs of transportation, lodging, meals and incidental expenses of personnel who are authorized for out-of-town and/or overnight travel. Such costs shall be reimbursed in accordance with the Federal Travel Regulations, Joint Travel Regulations, or Standardized Regulations prescribed by the General Services Administration under Travel Costs, FAR 31-205-46, 31.3, 31.6, or 31.7 as applicable. Costs incurred for lodging, meals and incidental expenses shall be reimbursed only to the extent that they do not exceed on a daily basis the maximum per diem rates in effect at the time of travel as set forth in the Federal Travel Regulations, Joint Travel Regulations or Standardized Regulations. Airfare costs in excess of the lowest customary standard coach or equivalent airfares offered during normal business will not be reimbursed. In virtually all cases, travel requirements will be known sufficiently in advance to allow the most economical fares. When the Contractor is given sufficient advance notice of travel requirements to obtain reduced fares, but fails to do so, the Government will reimburse only the amount of the lowest available fares.

The Contractor will be reimbursed for the cost of out-of-town and/or overnight travel performed by its personnel in their privately owned automobiles at the current rate set forth in the Federal Travel Regulations not to exceed the cost of the most direct economy air route between points traveled. If more than one person travels in such automobiles no additional charge will be made by the Contractor for such travel.

The government shall reimburse no travel costs for Contractor personnel travel from place of residence to and from normally assigned worksite.

Contractor requests for reimbursement must contain legible copies of individual receipts for all miscellaneous items of $50 value or higher. Each miscellaneous item of less than $50 value must be documented but may be included on a mass voucher rather than individual receipts.

The Contractor is not offered alternate work schedules or overtime.

Type of Contract:

The Government awarded a BPA XXX against a GSA Tier II Professional Services (PSS) Contract with five series of BPA calls against the BPA as either Firm Fixed Price (FFP) or Labor Hour (LH) orders. Tasks identified in Part 5 are anticipated to be firm fixed price tasks ordered through a Tier II BPA.

Security Requirements:

Contractor staff must have or be eligible to obtain a satisfactory Minimum Background Investigation, Level II clearance to have direct on-site access to FRTIB information systems. The Contractor must adhere to established FRTIB DOL protocol agreement for FRTIB and FRTIB Contractor facility access. The FRTIB will provide the agreement for access to its facilities.

Physical Security The Contractor shall be responsible for safeguarding all Government and Agency property provided for Contractor use. At the close of each work period, Agency facilities, equipment, and materials shall be secured.

Key Control The Contractor shall establish and implement methods to make sure all keys/key cards issue to the Contractor by the FRTIB are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys must include key cards. No keys issued to the Contractor by the FRTIB shall be duplicated. The Contractor shall document key control issuance procedures and include the control standards in its Quality Control Plan. Such written procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicated keys/key cards to the Contracting Officer. All keys/key cards shall be surrendered to the issuer (i.e., FRTIB) within 10 (ten) calendar days of the contract expiration date.

Lost Keys In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the Contracting Officer, re-key or replace the lock or locks affected; however, the Government, at its option, may replace the affected lock or locks or re-key them. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

Key Use The Contractor shall prohibit the use of FRTIB issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the Contracting Officer.

Lock Combinations.

This provision does not apply.

Conservation of Utilities.

This provision does not apply.

Special Qualifications:

The Contractor agrees that the performance of work pursuant to the requirements of this contract shall conform to the applicable professional standards.

Post Award Conference/Periodic Progress Meetings:

The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The Contracting Officer, Contracting Officer’s Representative (COR), and other government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings, the Contracting Officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

Contracting Officer’s Representative:

A COR will be delegated separately.

Approval of Contractor Personnel by the Government.

The Government reserves the right to review qualifications of Contracted personnel proposed for assignment and to ensure they conform to minimum preferred qualifications required of persons working in the labor categories shown below. The Contractor shall furnish staff resumes for each of the personnel in each of the labor categories. The Contractor shall furnish the resumes to the COR within two (2) Government business days. The COR’s written approval of all Contractor personnel prior to their performance under a BPA Call Order is required. The Contractor shall remove from work under this contract those Contractor personnel that the Government has found to be unacceptable within 14 calendar days after being notified in writing by the Government to do so.

Key Personnel:

The Government considers the following labor categories be Key Personnel and essential for the successful completion of all work assigned under the BPA and succeeding orders:

Key Personnel Labor Categories

Prior to removal or diversion of any of the specified Key Personnel to other programs, the Contractor shall provide the Government notification of at least fourteen (14) calendar days to the COR and shall supply written justification (including proposed substitutions) as part of this notice in sufficient detail as to permit evaluation of the impact on the program. The Contractor shall provide name(s) of the proposed substitute or replacement and shall include such information on each new person as to education, work experience, certifications, etc. No diversion shall be made by the Contractor without the COR’s written consent, ratified by the Contracting Officer.

Duties and Preferred Qualifications by Key Personnel

Partner/Principal: Duties include periodic liaison with the COR at least monthly and final review of reports, quality control, and presentation of compliance and audit findings.

Minimum qualifications:

Must have a position within the Contractor’s organization as a Partner or Principal; Must have five (5) years auditing or consulting experience in the field of large defined contribution pension plans (plans with assets over 500 million); A Licensed Attorney; a Certified Public Accountant (CPA); or in the case of being Management Advisory Services (MAS) Partners or Certified Management Consultants, accreditation shall include certification as a certified data processor (CDP) or a Certified Employee Benefit Specialist (CEBS) or equivalent professional experience; and eight (8) years’ experience in management of service engagements.

Preferred qualifications:

At least three (3) years of service engagements of large retirement benefit plans with plan assets in excess of 750 million and participant counts over 1,000, especially auditing 401(k) type plans.

Manager/Associate: Duties include managing several on-site audit teams.

Minimum qualifications:

Must have a position within the Contractor’s organization as of Manager/Associate.

Accreditation as an attorney, a CPA, CMA, DDP, CEBS or equivalent professional experience; minimum of five years’ general audit experience is required, including two years’ government audit experience.

Preferred qualifications:

Minimum five (5) years of professional or personal skills with extensive experience including: a demonstrated ability to write clearly and to make effective and informative presentations before corporate boards and fiduciary trustees. At least three (2) years of service engagements of large retirement benefit plans with plan assets in excess of 750 million and participant counts over 1,000, especially auditing 401(k) type plans.

Supervisor: Duties include on-site supervision of an audit team or teams on segments of the project.

Minimum Qualifications:

Person shall be in a position titled as a “senior” within the Contractor’s organization with a minimum of three (3) years audit or consulting experience including one year of government auditing experience in the areas of IT, Performance Audits and Asset Management. Bachelor’s Degree.

Preferred Qualifications:

Person will have additional professional accreditation (attorney, CPA, CMA, CEBS, CDP, or other appropriate professional certification or commensurate degrees/experience). A Minimum of (2) years for day-to-day responsibilities to carry out selected phases of large, complex audit, consulting, tax, or MAS engagements; and technical expertise in at least one specialty (accounting, auditing, tax, MAS, computer science, or employee benefits).

Computer Systems Analyst: Duties include evaluating both existing and proposed computer-based information processing systems on the (1) Effectiveness of internal controls for automated systems, (2) Flow of (posting of) data through the systems; (3) Efficiency of coding or design proposals; and (4) Other ADP systems life cycle issues.

Developing effective computer programs (using report generation software; high level computer languages, e.g., SQL, Oracle, MySQL, DB2 on mainframe) to retrieve and to array different electronically encoded data basis. Analysis of computer performance, determining effective loading, and developing sizing requirements; and also analyzing alternative approaches for transferring data from input point to computer, computer to computer, and computer to end-user from the following perspectives: (1) networking strategies, (2) security, (3) cost effectiveness, (4) line speeds, (5) protocols, and (6) other communications issues.

Minimum Qualifications:

A bachelor’s degree in an Information Technology discipline, or a bachelor’s degree augmented with sufficient academic studies equivalent to a major in an Information Technology discipline; and five (5) years’ technical experience in the areas of systems security; systems recovery; data input, processing and output controls.

Preferred Qualifications:

At least 3 years’ technical experience analyzing complex information systems of large (over 1 billion in assets) financial institutions.

Duties and Preferred Qualifications of Other Personnel.

Senior Accountant: Duties include performing audit steps under the supervision of a supervisor or a Senior Accountant.

Minimum Qualifications:

A Senior Accountant in the Contractor’s organization; a total of twenty-four (24) semester hours of college credit in accounting and auditing; a bachelor’s degree from an accredited college or university; and at least (2) years of auditing experience including one year of Government auditing experience.

Staff Accountant: Duties include performing audit steps under the supervision of a supervisor or a Senior Accountant.

Minimum Qualifications:

A total of twenty-four (24) semester hours of college credit in accounting and auditing; As well as a bachelor’s degree in accounting or business from an accredited college or university. Eligibility to sit for an applicable state CPA examination.

Junior Computer Systems Analyst: Duties include (1) evaluating both existing and proposed computer-based information processing systems and reviews the (a) effectiveness of (automated) internal controls; (b) flow of (posting of) data through systems; (c) efficiency of coding or design proposals; and (d) as well as other ADP systems life cycle issues. (2) Develops or uses commercially available off-the-shelf software programs for IT generated system reports; high-level computer languages or Data Base Management System inquiry command languages, (e.g., SQL, Oracle, MySQL, DB2 on mainframe), Interactive Data Extraction Analysis to retrieve and to perform data analyses for internal control substantive testing. Analyzes computer performance, determines effective loading, and develops sizing requirements; and analyzes alternative approaches for transferring data from input point to computer, computer to computer, and computer to end-user from the following perspectives: (a) networking strategies, (b) security, (c) cost-effectiveness, (d) line speeds, (e) protocols, and (f) other communications issues.

Minimum Qualifications:

A bachelor’s degree in an Information Technology discipline, or a bachelor’s degree augmented with sufficient academic studies equivalent to a major in an Information Technology discipline.

Preferred Qualifications:

One to three years of experience in performing any of the following:

(1) IT Audit Work – experience in risk assessments, control reviews, audit planning and systems development reviews; knowledge of application, package implementation, operational and /or platform reviews; background in information systems audit, penetration studies and business process control assessments. Control review includes evaluation, testing, and concluding of the effectiveness of general and application specific controls, General automated controls include: (a) logical and physical access controls, (b) application change and software development lifecycle controls, (c) security and continuity planning and related controls, and (d) system software controls. Application controls include evaluating application security, input, processing, and output controls for a given transaction.

(2) System Implementations – Knowledge in the design/implementation of Information Technology controls; security experience in the design/implementation/support of commercially available off-the-shelf (COTS) packages, applications, databases, operating systems and network security.

(3) Information Security – experience in penetration studies, security administration, security policy development, risk assessments, firewall design and architecture development, IT audit or systems integration background and system implementation experience. A thorough understanding of system and business process analysis and design, implementation of COTS packages, and familiarization of computer programming techniques. In addition, possessing knowledge of mainframe, client server, and PC based technologies, local area (LAN), wide area (Wan), and virtual private (VPN) networks, and web based and voice response system technologies.

Identification of Contractor Employees:

All contract personnel attending meetings, answering government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. [Indicate if contractor personnel will be required to obtain and wear badges in the performance of this service.]

Organizational Conflict of Interest:

Contractor and subcontractor personnel performing work under this contract action may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI), as defined in FAR Subpart 9.5. The contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may affect other remedies as he or she deems necessary, including prohibiting the contractor from participation in subsequent contracted requirements which may be affected by the OCI.

Phase In/Phase Out Period (If applicable): To minimize any decreases in productivity and to prevent possible negative impacts on additional services, the contractor shall have personnel on board during the [Insert the time period, i.e., sixty (60) day, thirty (30) day, etc.] phase in/phase out periods. During the phase in period, the contractor shall become familiar with performance requirements in order to commence full performance of services on the contract action start date.

Part 2 Definition & Acronyms

ADP. Automated Data Processing

Agency. Federal Retirement Thrift Investment Board (FRTIB)

APG. Audit Program Guide

Best Effort: That effort expended by the contractor to perform within the awarded ceiling price all work specified in this acquisition and all other obligations under this acquisition. This effort includes providing required qualified personnel, properly supervised, and following industry accepted methodologies and other practices. The effort is further characterized by operating at all times with the government’s best interest in mind, using efficient and effective methods, and demonstrating sound cost control. The effort must be identical to the effort that would be expended if this were a firm-fixed price acquisition and the contractor’s profits were dependent upon reducing costs while meeting the government’s requirements in terms and quality and schedule. Failure to provide this required effort may result in the withholding of payment for hours expended that do not qualify as best effort or a reduction in the rate per hour to reflect decreased value of services received.

Contracting Officer’s Representative. A representative from the requiring activity assigned by the Contracting Officer to perform surveillance and to act as liaison to the contractor.

CPA. Certified Public Accountant

Defective Service. A service output that does not meet the standard of performance associated with it in the Performance Work Statement.

EBSA. Employee Benefits Security Administration.

ERISA Employee Retirement Income Security Act.

FERSA. Federal Employees’ Retirement System Act of 1986, Public Law 99-335, 100 Stat 30 CFR 585.204

GAGAS. Generally Accepted Government Auditing Standards.

Government. U.S. Department of Labor

IT. Information Technology

PBC. Prepared by Client. Documents or artifacts furnished to the Contractor by the auditee

PWS. Performance Work Statement

Quality Assurance Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of Contractor performance.

Quality Assurance. Those actions taken by the government to assure services meet the requirements of the Performance Work Statement.

Quality Control. Those actions taken by a Contractor to control the performance of services so that they meet the requirements of the PWS.

MAS. Management Advisory Service

MBI. Minimum Background Investigation

Workpapers. A written document with which an Auditor records findings in working papers and schedules. Workpapers summarize audit actions, such as audit planning.

Part 3 Government Furnished Property, Equipment, And Services The U.S. Department of Labor does not anticipate furnishing property, services, or information to the Contractor; however, the Contractor employees with MBI level II clearance will have access to FRTIB information and data as well as access to office space for viewing the information and data on site at the Agency headquarters or remote and affiliate locations. In the case of unforeseen emergency (such as the 2020 COVID19 Pandemic), the FRTIB will be responsible for furnishing the Contractor with any equipment necessary for remotely accessing FRTIB information and data systems to perform the tasks assigned under a task order.

0. General:

The Government shall not provide facilities, equipment, materials, and/or services. However, the FRTIB will facilitate access to its facilities, equipment, information data systems, materials and/or services needed to perform EBSA’s FERSA fiduciary oversight compliance.

0. Equipment:

The FRTIB will provide access to data stations and temporary auditor space for accessing the FRTIB information systems. The FRTIB will provide necessary equipment to access the FRTIB data systems when otherwise available access to FRTIB workstations and auditor workspace for accessing the FRTIB information systems may be unavailable.

0. Services:

3.3.1 Utilities:

All utilities in the facility will be available for the Contractor’s use in performance of duties outlined in this PWS. The Contractor shall instruct employees in utilities conservation practices. The Contractor shall be responsible for operating under conditions that preclude the waste of utilities.

0. Facilities:

The FRTIB will furnish the necessary workspace for the Contractor staff to provide the support outlined in this PWS to include office space, telephones, computers and other items necessary to maintain an office environment.

Part 4 Contractor Furnish Items and Services

4.1 General:

Except for those items specifically stated to be government furnished in Part 3, the contractor shall furnish all other items required to perform the services in this PWS.

4.2 Clearance:

The Contractor staff shall possess or be eligible to receive and maintain a Minimum Background Investigation, Level II (MBI) clearance in order to have access to FRTIB information and data. The Contractor’s employees, performing work in support of this contract shall have MBI, Level II security clearances in order to have access to FRTIB information systems and data.

Part 5 Specific Tasks

5.1 Services:

The Department anticipates ordering the basic services tasks as Firm Fixed Price engagements against a Blanket Purchase Agreement.

Task Area 1: Participant Website Controls - determines whether the Agency and its vendors developed and implemented policies and procedures to secure participant communications and transactions via the Web through identification and authentication protocols and configurations settings, system edit checks regarding certain indicative data updates and transaction types; and managing website configurations changes. The Contractor will also determine the status of the prior EBSA open recommendations in this area, if any.

The objectives of this audit of the TSP participant website controls include determining whether the Agency implemented certain procedures to: (1) secure participant communications and transactions via the Web through identification and authentication protocols and configuration settings, system edit checks regarding certain indicative data updates and transaction types; and (2) manage website configuration changes.

Task Area 2: Mainframe Configuration - determines whether the Agency and its vendors developed and implemented policies and procedures related to: (1) establishing and monitoring controls over the mainframe configuration settings at the Multiple Virtual Storage (MVS) operating system level, including primary central processing unit (CPU), direct access storage drive hard drives (DASD), logical partitions (LPARs), and other associated central and peripheral areas; (2) establishing and monitoring access administration and configuration settings of data in production datasets and implementing controls for dataset copies in development, test, and quality assurance environments; and (3) establishing controls that may detect data exfiltration into non-mainframe environments. The Contractor will also determine the status of the prior EBSA open recommendations in this area, if any.

Task Area 3: Mobile Device and Security Governance Review - determines whether the Agency: (1) developed an effective mobile device security and governance program; (2) established controls for tracking and monitoring mobile devices; and (3) established controls for configuring, updating, and removing mobile devices from the Agency’s network. The Contractor will also determine the status of the prior EBSA open recommendations in this area, if any.

Task Area 4: Insider Threat Controls - determines whether the Agency and its vendors implemented controls: to prevent, monitor, and detect insider threats to TSP systems and data by Agency personnel and vendors; and perform limited social engineering procedures to test for the existence of insider threat controls. The Contractor will also determine the status of the prior EBSA TSP open recommendations in this area.

Task Area 5: Participant Support/Contact Center Operations - determines whether the Agency and its vendors developed and implemented policies and procedures to: (1) provide timely and accurate TSP information to participants; (2) prepare quarterly statements to participants that reflected the activity for the period; (3) prepare annual statements for participants that summarize all transactions made during the previous calendar year by transaction type; (4) respond to participants’ and congressional inquiries in an accurate and timely manner; (5) process confirmation and reject notices accurately, and distribute them in a timely manner; (6) enforce physical access controls at the contact centers; (7) enforce caller authentication and privacy controls at the contact centers; and (8) monitor the contact centers’ contractors for compliance with the terms of the contracts. In addition, the Contractor will test compliance of the TSP participant support process with FERSA, as amended, and Agency regulations. The Contractor will also determine the status of the prior EBSA open recommendations in this area, if any.

Task Area 6: Loan Operations - determines whether the Agency and its vendors developed and implemented policies and procedures to: (1) process TSP loan transactions promptly and accurately in individual participant accounts, and in the appropriate investment fund(s); (2) disburse TSP loans in accordance with regulations and participant authorizations; (3) limit participation in the TSP loan program to participants who meet eligibility criteria; and (4) accurately record loan activity in the TSP accounting records. In addition, the Contractor will test compliance of the TSP loans process with FERSA, as amended, and Agency regulations. The Contractor will also determine the status of the prior EBSA open recommendations in this area, if any.

Task Area 7: Account Maintenance - determines whether the Agency and its vendors developed and implemented policies and procedures to: (1) accurately reflect in participant accounts contributions as elected by participants, daily valuation, and the fund balances; (2) process TSP contributions, rollovers, breakage, adjustments, inter-fund transfers, forfeitures, and forfeitures restorations promptly and accurately in individual participant accounts and in the appropriate investment fund(s); (3) monitor manual adjustments made to transactions and participant accounts; (4) accurately record account maintenance activity in the TSP accounting records; 5) monitor for and detect potential fraudulent activity associated with participant accounts; 6) investigate and resolve potential fraudulent activity identified internally and/or reported by participants; and 7) revise or augment preventative procedures when fraudulent activity or other risk factors are identified. In addition, we will test compliance of the TSP account maintenance process with FERSA and Agency Regulations. The Contractor will also determine the status of the prior EBSA open recommendations in this area, if any.

Task Area 8: Withdrawals - determines whether the Agency and its vendors developed and implemented policies and procedures to: (1) process TSP withdrawal transactions promptly and accurately in individual participant accounts, (2) process authorized participant payments in accordance with applicable Agency regulations; (3) accurately record withdrawals activity in the TSP accounting records; and (4) test compliance of the Agency’s withdrawal process in accordance with FERSA and Agency Regulations. The Contractor will also determine the status of the prior EBSA open recommendations in this area, if any.

Task Area 9: Lifecycle Funds Operations - determines whether the Agency and its vendors developed and implemented policies and procedures to: (1) rebalance the L Funds on a daily basis to reflect each fund’s target allocation for the current quarter; (2) adjust the asset allocations of the L Funds each quarter based on each fund’s prescribed time horizon; (3) review the assumptions of the L Funds at least annually to determine whether any changes to the allocations are warranted; (4) conduct the most current assumptions review in accordance with the terms of the contract between the Agency and the vendor; (5) accurately calculate the published ratio of administrative expenses per $1,000 of account balance in the L Funds; and (6) verify that the published asset allocations for each L Fund agree to the actual asset allocation. The Contractor will also determine if the current assumptions used to develop the L Funds’ allocations are consistent with industry benchmarks, and will test compliance of the TSP’s L Funds process with applicable provisions of FERSA, as amended, and with applicable Agency regulations. The Contractor will also determine the status of the prior EBSA open recommendations in this area, if any.

Task Area 10: Treasury "G" Fund Investment Operations - determines whether Treasury developed and implemented policies and procedures to: (1) accurately…