RequestForProposal_2031JW21R00010.pdf

2031JW21R00010

SOLICITATION, OFFER AND AWARD

4. TYPE OF SOLICITATION2. CONTRACT NUMBER 3. SOLICITATION NUMBER

7. ISSUED BY CODE 8. ADDRESS OFFER TO (If other than Item 7)

ORDER UNDER DPAS (15 CFR 700)

6. REQUISITION/PURCHASE NUMBER

NOTE: In sealed bid solicitations "offer" and "offeror" mean "bid" and "bidder".

NEGOTIATED (RFP)

SEALED BID (IFB)

5. DATE ISSUED

1. THIS CONTRACT IS A RATED RATING PAGE OF PAGES

1 85

C. E-MAIL ADDRESS

EXT.NUMBERAREA CODE

B. TELEPHONE (NO COLLECT CALLS)A. NAME

10. FOR

INFORMATION

CALL:

CAUTION: LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

(Date)(Hour) local timeuntildepository located in copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if hand carried, in the

SOLICITATION

9. Sealed offers in original and

PART IV - REPRESENTATIONS AND INSTRUCTIONS

OTHER STATEMENTS OF OFFERORS

EVALUATION FACTORS FOR AWARD

INSTRS., CONDS., AND NOTICES TO OFFERORS

REPRESENTATIONS, CERTIFICATIONS AND

LIST OF ATTACHMENTS

CONTRACT CLAUSES

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACH.

I

J

K

L

M SPECIAL CONTRACT REQUIREMENTS

CONTRACT ADMINISTRATION DATA

DELIVERIES OR PERFORMANCE

INSPECTION AND ACCEPTANCE

PACKAGING AND MARKING

DESCRIPTION/SPECS./WORK STATEMENT

SUPPLIES OR SERVICES AND PRICES/COSTS

SOLICITATION/CONTRACT FORM

PART II - CONTRACT CLAUSESPART I - THE SCHEDULE

H

G

F

E

D

C

B

A

SEC. DESCRIPTION PAGE(S) (X) DESCRIPTION SEC. (X)

11. TABLE OF CONTENTS

18. OFFER DATE17. SIGNATURE

SUCH ADDRESS IN SCHEDULE.

IS DIFFERENT FROM ABOVE - ENTER

15C. CHECK IF REMITTANCE ADDRESS

EXT.NUMBERAREA CODE

15B. TELEPHONE NUMBER

(Type or print)AND

ADDRESS

OF

OFFEROR

CODE FACILITY

16. NAME AND TITLE OF PERSON AUTHORIZED TO SIGN OFFER15A. NAME

DATEAMENDMENT NO.DATEAMENDMENT NO.

and related documents numbered and dated):

amendments to the SOLICITATION for offerors

(The offeror acknowledges receipt of

14. ACKNOWLEDGEMENT OF AMENDMENTS

CALENDAR DAYS (%)30 CALENDAR DAYS (%)20 CALENDAR DAYS (%)10 CALENDAR DAYS (%)

(See Section I, Clause No. 52.232.8)

13. DISCOUNT FOR PROMPT PAYMENT

designated point(s), within the time specified in the schedule.

by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

OFFER (Must be fully completed by offeror)

IMPORTANT - Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice.

28. AWARD DATE

(Signature of Contracting Officer)

27. UNITED STATES OF AMERICA

25. PAYMENT WILL BE MADE BY

26. NAME OF CONTRACTING OFFICER (Type or print)

CODE 24. ADMINISTERED BY (If other than Item 7)

ITEM

(4 copies unless otherwise specified)

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

41 U.S.C. 253 (c) ( 10 U.S.C. 2304 (c) (

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

21. ACCOUNTING AND APPROPRIATION20. AMOUNT19. ACCEPTED AS TO ITEMS NUMBERED

AWARD (To be completed by government)

CODE

07/21/2021 X

OCC

Comptroller of the Currency Acquisitions Management

400 7TH STREET SW

Washington DC 20219

1500 ET 08/20/2021

TANYA S NEWLAND-SENIOR

TANYA.NEWLAND@OCC.TREAS.G

OV

X

X

X

X

X

X

X

X

X

X

X

X

X

PAGE(S)

BEREL DORFMAN

AUTHORIZED FOR LOCAL REPRODUCTION

Previous edition is unusable

STANDARD FORM 33 (Rev. 9-97)

Prescribed by GSA - FAR (48 CFR) 53.214(c)

12. In compliance with the above, the undersigned agrees, if this offer is accepted within _____0_________ calendar days (60 calendar days unless a different period is inserted

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

2 85

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

2031JW21R00010

(A) (B) (C) (D) (E) (F)

This Request for Proposal (RFP) is for the Office of the Comptroller of the Currency National Bank

Examination Services. The Contractor shall provide the services described in the enclosed

Statement of Work titled "Bank Examination

Services" (BES).

Period of Performance: 01/01/2022 to 12/31/2026

OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

NSN 7540-01-152-8067

RFP 2031JW21R00010

National Bank Examination Services

PART I: THE SCHEDULE

SECTION B – SUPPLIES OR SERVICES AND PRICES/COSTS

B.1 SCHEDULE OF SUPPLIES/SERVICES

In accordance with the contract, the Contractor shall furnish all labor, equipment, facilities and materials (except that which will be furnished by the Government), and shall do that which is necessary or incidental to the satisfactory and timely performance of the National Bank Examination related services described in Section C – Statement of Work at the fixed hourly rate shown under the Contract Line Item Number (CLIN) for each year of this contract.

This acquisition is a total Small Business Set Aside, in accordance with FAR 52.219-6, Notice of Total Small Business Set-Aside (NOV 2020).

B.2 CONTRACT TYPE AND SHARED CEILING:

This is a Multiple Award, Indefinite-Delivery Indefinite-Quantity Time-and-Materials (T&M) contract utilizing fixed labor rates applied to Firm-Fixed-Price (FFP) Task Orders. The services to be furnished under this contract may be ordered by issuance of task orders pursuant to Section I.2 52.216-18. Ordering commencing with the date of contract award. The ordering period applicable to this contract is five (5) years. At the Government’s discretion, the agency may also utilize Time-and-Materials type orders, as warranted.

The total estimated value for this requirement is $4,200,000.00. This amount represents a shared cumulative ceiling amount across all IDIQs. The total estimated ceiling amount will be derived by calculating the number of Key Personnel proposed (maximum of 1,500 hours in Year One and 5,040 in Years Two thru Five) times the rate of each period of performance plus the amount for travel and training, as applicable.

The maximum (not-to-exceed) labor hours for each key personnel (bank examiner) is 1,500 hours for Year One and 5,040 hours in Years Two thru Five. (See Section H.11)

Travel requirements will be set forth in individual task orders. Reimbursement for travel shall be in accordance with the Federal Travel Regulations (FTR) and Clause G.4 of this contract.

YEAR ONE: January 1, 2022 - December 31, 2022

CLIN Description Unit Estimated Quantity Labor Hour Rate

Bank Examination Services HR

1,500 per Key Personnel

Travel (as determined by the Government prior to award)) LOT

YEAR TWO: January 1, 2023 - December 31, 2023

5,040 per Key Personnel

Travel (as determined by the Government prior to award)) LOT

YEAR THREE: January 1, 2024 - December 31, 2024

Travel (as determined by the Government prior to award)) LOT

YEAR FOUR: January 1, 2025 - December 31, 2025

Travel (as determined

YEAR FIVE: January 1, 2026 - December 31, 2026

CLIN Description Unit Estimated Quantity Labor Hour Rate

Travel (as determined

[END OF SECTION B]

SECTION C – DESCRIPTION/SPECIFICATIONS/STATEMENT OF WORK

BANK EXAMINATION SERVICES

STATEMENT OF WORK

C.1. BACKGROUND

The Office of the Comptroller of the Currency (OCC), a bureau of the United States Department of the Treasury, is the primary regulator of all national banks and federal savings associations. The OCC is responsible for promoting the safety and soundness of the country’s national banks and federal savings associations and maintaining its competitiveness, efficiency, integrity, and stability in the financial marketplace.

C.2. OBJECTIVE

The OCC requires contract assistance for National Bank Examination Services and other bank examination related tasks throughout the United States. Additionally, the OCC requires contractor support services for commercial related credit training throughout the United States. The purpose of the training events is to provide trainees hands-on experience in evaluating credit risk in commercial credits.

C.3. SCOPE OF WORK

In support of its mission, the OCC will award this indefinite delivery indefinite quantity contract for Bank Examination Support for a maximum of 1,000 hours annually for a five

(5) year period of performance. The Contractor shall provide support services on an as needed basis in accordance with the task order award procedures stated in this scope of work. The scope, timing and location of such work will be determined on a task-by-task basis by the OCC. The contractor shall utilize the OCC’s training materials. Access to OCC examination information, reference materials, training information, and any information will be provided to the Contractor, as necessary, at the time of any task award.

The Contractor shall perform tasks or work, when tasked, related to the bank examination function that may involve one or more of the following - or similar - types of tasks:

• Assisting in the examination of selected banks and thrifts by evaluating or verifying functions, condition, or performance,

• Analyzing and assessing examination reports,

• Researching the causes and potential impact of financial and non-financial events and issues,

• Researching and analyzing information on emerging and systemic risks in the financial services industry,

• Identifying specific weaknesses in bank and thrift processes and recommending corrective action where warranted,

• Assisting in commercial related credit training,

• Participating in special projects.

C.4. CONTRACT TASK AREAS

As the contractor assists in providing bank examination support services across the various task areas the following is representative of the technical knowledge and skills needed to perform those activities. The list is not all-inclusive, and bank examination support requirements may vary depending on the specific task to be performed at the request and direction of the OCC on a case-by-case basis.

C4.1 Credit Analysis

• Credit risk management practices and policies

• Applicable laws and regulations covering credit activities

• OCC handbooks, advisories, alerts, and bulletins related to credit activities

• Examination techniques

• Underwriting

• Strategic factors

• External factors

• Credit quality factors

• Classification and loan write-up

• Documentation

• File reading

C.4.2 Operational Risk

Audit/Accounting

• Audit effectiveness and audit’s analysis of internal controls for a risk-based audit function.

• Key components of current accounting and regulatory reporting requirements and their applicability to banks.

• Sarbanes Oxley (SOX) internal controls over financial reporting.

Governance/Enterprise Risk Management

• Board oversight, committee structure, and board practices.

• Key risk culture and risk governance concepts.

• Enterprise risk management processes, including identification, measurement, control, and reporting throughout the organization.

• Heightened Standards requirements and their application at midsize and large bank institutions.

• Effectiveness of bank risk assessments and implementation of the three lines of defense framework.

• Operating and control processes involving specialized businesses, product lines, or delivery channels and the related risk monitoring.

• New product and services governance processes.

• Third party risk management programs.

• Risk data collection, aggregation and risk reporting.

• Bank strategic and capital planning and the governance requirements for stress testing in capital planning.

• Dodd-Frank Act stress testing governance and model risk management processes.

• Talent management and compensation programs.

• Payment systems and fraud risk management programs.

• Operational loss data processes and litigation risk management.

C.4.3 Retail Credit Analysis

• Retail credit products, portfolios, functional areas such as underwriting, credit scoring, collections), or risk management;

• Mortgage and home equity lending;

• Credit card lending or other revolving lending products (other than home equity products);

• Other types of direct and indirect retail lending, such as auto lending;

• Brokers, dealers, or other third-party loan originators and servicers;

• Higher risk or sub-prime lending;

• Predatory lending issues and regulations;

• Unfair/deceptive practices issues;

• OCC handbooks, advisories, alerts, and bulletins related to the above areas including Uniform

• Retail Credit Classification and Account Management Guidance, Interagency Guidance for Subprime Lending, Interagency Expanded Guidance for Subprime Lending Programs, and the Account Management and Loss Allowance Guidance.

C.4.4 Consumer Protection/Fair Lending/Community Reinvestment Act

• Consumer protection laws and their implementing regulations, including, but not limited to: Equal Credit Opportunity, Fair Housing, Home Mortgage Disclosure, Community Reinvestment, Unfair or Deceptive Acts or Practices, Fair Credit Reporting, Flood Disaster Protection, Truth in Lending, Real Estate Settlement Procedures, and Consumer Privacy.

• Consumer compliance examination policies, procedures and techniques, including the Comptroller’s Handbook for Consumer Compliance Examination and related OCC bulletins, advisories and alerts.

• Compliance risk management systems, including board and management oversight, compliance organizational structure and staffing, compliance policies, procedures, and processes, compliance training programs, and compliance audit functions.

C.4.5 Bank Secrecy Act/Anti-Money Laundering/Office of Foreign Assets Control

• The Bank Secrecy Act (BSA), related Anti-Money Laundering (AML) laws and regulations, and Office of Foreign Assets Control (OFAC) regulations.

• FFIEC BSA/AML Examination Manual, related OCC bulletins, advisories, and alerts, and Financial Crimes Enforcement Network (FinCEN) and OFAC interpretations and guidance. BSA/AML compliance risk management systems, including board and management oversight, organizational structure and staffing, risk assessment, customer due diligence, suspicious activity monitoring, training programs, and independent testing.

Additional specialized experience required for Consumer and BSA is experience as an auditor, Compliance Officer, or examiner of consumer compliance activities.

C.4.6 Asset Management

The Contractor shall have specialized experience required for Asset Management is experience as an auditor, manager or examiner of fiduciary related activities in trust departments of national banks and/or thrift institutions. Asset Management is not the administration of a real estate portfolio.

C.4.7 Capital Markets

The Contractor shall have experience required for Capital Markets as an auditor, manager or examiner of balance sheet management of a national bank and/or thrift institution. The essential knowledge and skills include interest rate risk (IRR) concepts, techniques, and models used to monitor IRR; and investment securities and equity markets.

C.4.8 Bank Information Technology (BIT)

The Contractor shall have specialized experience required for BIT as an auditor, specialist/analyst or examiner of information technology related activities in national banks and/or thrift institutions. The knowledge and skills of bank operations and associated technology is essential.

C.4.9 Commercial Related Credit Training

The contractor must have experience facilitating or instructing in a setting that builds foundational credit analysis competencies Including relevant experience gained working at OCC or other bank supervision or oversight organizations or financial institutions. The contractor will assist with facilitating the training course with an on-site seasoned National Bank Examiner or Associate National Bank Examiner, who i possesses the knowledge required to instruct course. As detailed above, Credit Analysis, is representative of the technical knowledge needed to perform these tasks.

C.4.10 Bank Examiner Position Description

The Contractor must have at least eight years specialized experience, preferably gained in the Federal service in Federal Financial Institutions Examination Council (FFIEC) regulatory agencies, and in the practical application and administration of FFIEC and corresponding agencies’ rules, regulations, policies and procedures. This experience must be within the past five years to be considered relevant.

C.5. DELIVERABLES

Any and/or all work prepared, produced or performed by the Contractor in the performance of Services of this contract, including but not limited to, analysis, working papers, reports, recommendations, conclusions, memoranda and proposed report comments, and any other work products (hereinafter “Deliverables”) shall be the exclusive intellectual property of the OCC with all rights, title, interest, and/or ownership vested wholly and exclusively with the OCC.

C.6. ICT ACCESSIBLITY REQUIREMENTS

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities. As such, the following requirements apply to this solicitation:

1) Products, platforms and services delivered as part of this work statement that are ICT, or contain ICT, must conform to the Revised 508 Standards, which are located at 36 C.F.R. § 1194.1 & Apps. A, C & D, and available at https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines

2) E102 / 702.10 – Web Content Accessibility Guidelines (WCAG) success criteria level A & AA are incorporated as a requirement. The referenced WCAG criteria is available at http://www.w3.org/TR/WCAG20/

3) E202 – No General Exceptions Authorized by OCC The following items are identified as containing ICT:

• Web-based Intranet and Internet Information and Applications

• Information, Documentation, and Support

Applicable Functional Performance Criteria: All functional performance criteria apply when using an alternative design or technology that achieves substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4-6 of the Revised 508 Standards, or when Chapters 4-6 do not address one or more functions of ICT.

Applicable requirements for software and Web products:

• E207 – WCAG Level A & AA Success Criteria

• E302 – Functional Performance Criteria

• E502 – Interoperability with Assistive Technology

• E503 – Application

• E501 – Web-based applications, independent of platform services

Applicable requirements for electronic documents and/or support services:

• E205 – WCAG Level A & AA Success Criteria

• E302 – Functional Performance Criteria

• E602 – Support Documentation

• E603 – Support Services - the Contractor shall ensure that all Electronic and Information

Technology (EIT) meets all applicable functional and technical standards required by Section 508 of the Rehabilitation Act of 1973, as amended. IT Accessibility standards codified in 36 CFR 1194 and the technical standards can be read at www.access-board.gov.

C.7 SECURITY AND PRIVACY REQUIREMENTS

A. Compliance with Applicable Laws, Regulations, and Standards

Federal Laws. The contractor and all of its respective subcontractors shall follow and remain compliant at all times with the Federal Acquisition Regulation (FAR), Privacy Act of 1974 (5 U.S.C. 552a -the Act), Federal Information Security Modernization Act of 2014 (Public Law 107-347) (FISMA).

FIPS. The contractor and all of its respective subcontractors shall follow Federal Information Processing Standards (FIPS), National Institute of Standards and Technology (NIST) standards and guidelines, and other laws, mandates, or executive orders pertaining to the development, operations, and protection of information systems and sensitive information and data.

OCC Policies and Procedures. The OCC understands that there are limitations in applying agency-specific policies to systems and environments shared with other organizations or customers. The requirements in this OCC Policies and Procedures subsection applies to all activities specifically performed for the OCC by the contractor (e.g., professional services to develop or customize a component for the OCC). The intent of this section is to require contractor compliance with OCC policies and procedures for those activities, tasks, and deliverables specifically and uniquely performed and/or completed for the OCC by the contractor that is not a typical service or component of the existing contractor system/solution, including, but not limited to the secure access and use of OCC information resources (i.e., OCC network, systems, laptops, other IT equipment, and/or OCC information).

The contractor and all of its respective subcontractors shall comply with all Office of the Comptroller of the Currency (OCC) security and privacy policies and standards in effect at the time of the award of the contract, as well as those requirements that may be added during the contract.

The contractor/service provider shall conform to OCC administrative regulations, policies, and procedures, as listed in section [cite corresponding location in contracting document], in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. The contractor shall work with OCC internal organizations, as needed, to ensure that policies, procedures, configuration control, and product life-cycle requirements are fulfilled to the satisfaction of OCC ITS.

B. General Requirements

Location. Information collected, used, stored, maintained, or otherwise processed by the contractor in the performance of this contract shall be accessed, transferred, stored or processed only within the United States. In addition, the maintenance and support operations of the contractor's technology and information must take place, and originate from, within the United States.

Authorization to Use, Store, or Share Sensitive Information. The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract.

The contractor shall also protect all government data, equipment, etc.

by treating the information as sensitive. All information gathered or created under this contract shall be considered as Controlled but Unclassified (CUI) information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets.

Confidentiality. The contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

Non-Disclosure Agreement. Each individual who has access to sensitive OCC data and/or the OCC network, systems, applications, laptops, or other OCC information resources that may process, store or transmit sensitive OCC data under this contract shall execute a Non-Disclosure Agreement before being allowed such access.

Deliverables. The deliverables in this contract will be considered sensitive and shall not be shared with any other organization without prior approval from the OCC CO.

C. Security and Privacy Authorization

D. Configuration Management

E. Continuous Monitoring

Compliance Reviews and Audits. The contractor shall permit and support compliance reviews and audits under applicable laws to allow the OCC to meet legal and compliance obligations and shall implement processes that allow visibility into the privacy and security controls employed and their effectiveness. The contractor shall provide the OCC or authorized designated officials with information requested by auditors in a timely manner, consistent with the respective auditor's deadline, in support of security compliance reviews and various annual audits, e.g., FISMA, Financial Statement Audit, A-123, etc.

F. Data Protection

Data Encryption. Where encryption is required, as specified by the OCC, the contractor shall ensure that encryption is established and maintained for data at rest and in transit for the duration of the contract. The encryption employed shall be equivalent to those approved in Federal Information Processing Standards (FIPS) Publication 140.

Need to Know. Sensitive information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis.

The contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected.

General Use of Personally Identifiable Information (PII). The contractor shall not use any PII, including low-sensitivity PII (e.g., E-mail Groups and Lists), for any purpose other than those activities necessary to the performance of this contract.

Use of Contractor Equipment. Use of contractor-owned laptops or other equipment (e.g., media storage devices, servers, etc.) to process, transmit, or store OCC information or to access the OCC network or other OCC information resources without OCC's formal authorization is prohibited. This does not include the use of non- OCC laptops or PCs to use OCC-approved virtual desktop infrastructure to remotely access the OCC network.

G. Incident Response

Notification. The contractor must report all information security incidents that potentially or actually cause the compromise of OCC information, even if the contractor believes the security incident may be limited, small, or insignificant with respect to OCC data or systems. The OCC will determine when the contractor's reported security incident requires additional focus and attention.

Within one hour from the time the contractor validates that an information security incident has occurred, the contractor must report the security incident information to the OCC Cyber Defense Center

(CDC): Computer.Security@occ.treas.gov, (202) 649-7930, regardless of day or time.

The contractor must provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC with the following text in the subject line of the email:

“Supplementary Information/Report related to previously reported incident # [insert number].”

Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

When notifying the OCC CDC, copy the Contracting Officer if possible or, if reporting by phone or Contracting Officer's email is not immediately available, contact the Contracting Officer immediately after reporting the incident to the OCC CDC.

Information, System and Tool Availability. The contractor shall make available any information, systems and tools necessary for the OCC to respond to incidents in a manner consistent with NIST SP 800-61, as amended. In the case of a reported security incident, the contractor shall provide the OCC with access to the contractor's system and/or facilities within 72 hours of the OCC's request.

H. Information Ownership

Government Access. The government will retain unrestricted rights to government data. The OCC retains ownership of any user created/loaded data and deliverables (e.g., documents, applications, custom code, diagrams, workflows, data sets, etc.) hosted on contractor's equipment, systems, infrastructure, etc., as well as maintains the right to request full copies of these at any time.

Removal of OCC Data. The contractor acknowledges the OCC's exclusive right of ownership of the information and is required to transfer, return, and/or delete all agency data collected, processed, stored or maintained by the contractor on behalf of OCC upon termination of services, and shall provide written certification and supporting documentation attesting to the transfer, return and/or deletion of agency information or data generated, collected, processed, maintained, or stored by the contractor and any subcontractors, per instructions the "Security and Privacy Vendor Deliverables" section.

Documents and Deliverables. The preliminary and final OCC-specific deliverables and all associated working papers and other material deemed relevant by the agency that have been generated in the performance of this contract, are the property of the U.S.

Government. The contractor shall not release any information without the written consent of the Contracting Officer. All work papers, preliminary and final deliverables must be submitted to the COR at the conclusion of the contract in an acceptable and usable format, which may include the original format.

eDiscovery. The contractor must ensure data preservation requirements (i.e., halt destruction and maintain data the contractor may not otherwise have to maintain) related to litigation holds are met. The contractor shall also ensure that metadata associated with litigation holds are preserved. Metadata is electronically-stored information that describes the history, tracking, or management of an electronic document. It is created automatically when a user creates, modifies, accesses, or takes other actions with respect to an electronic document.

The contractor shall provide immediate access to all government data and government-related data impacting government data for review or scan, or conduct of a forensic evaluation, and physical access to any contractor facility with government data.

I. System Access

Government Right to Terminate Access. The OCC, at its discretion, may suspend or terminate the access to any systems and/or facilities when an information security incident or other electronic access violation, use or misuse issue gives cause for such action. The suspension or termination may last until such time as OCC determines that the situation has been corrected or no longer exists.

J. Training Requirements

Security Awareness Training. All contractor personnel with access to OCC data and systems must complete OCC-provided mandatory security and privacy training prior to gaining such access. Non-compliance may result in revocation of system access.

Role-Based Training. The contractor shall ensure that IT personnel supporting this contract complete eight (8) hours of role-based specialized IT security training on an annual basis. The contractor must identify the IT personnel and their respective IT role1 that they serve in support of this contract. The contractor shall provide the list of List of IT Personnel on this Contract and Respective Role and the Completion Report for Role-Based IT Security Training per directions in the "Security and Privacy Vendor Deliverables" section.

1IT Personnel include systems engineers; software developers;

systems security engineers; privacy engineers; system, network, and database administrators; personnel conducting configuration management activities; personnel performing verification and validation activities; personnel with access to system-level software;

personnel with contingency planning and incident response duties;

personnel with privacy management responsibilities; personnel with access to personally identifiable information; and system security officers.

K. Supply Chain Risk Management

Not Applicable

L. Security and Privacy Vendor Deliverables

Non-Disclosure Agreement (NDA) [Vendor or Contractor Access to OCC Information Resources]

Section Deliverable Frequency Due Date

B. General Requirements. Non- Disclosure Agreement

Non-Disclosure Agreements for each contractor personnel working in support of this contract Once

Prior to accessing OCC information resources

Removal of Data [All Form 78 – Part 2 Requests]

Section Deliverable Frequency Due Date

H. Information Ownership. Removal of OCC Data F. Data Protection.

Contractor Equipment [Remove “Section F. Data Protection” text above, if this section did not appear in your Form 78 request];

Certification of OCC Data Removal from Contractor’s (including any subcontractors), Possession, Equipment, and/or Environment.

Data removal instructions include transfer of information to another party per specific instructions from the CO; return of information, deliverables, etc., to the CO; and deletion of OCC data from contractor equipment (e.g., laptops and other contractor-owned equipment previously approved by the OCC for this use) using NIST SP 800-88, Guidelines for Media Sanitization, as amended.

Once NLT 15 days after termination/expiration of contract

Training Requirements [Vendor or Contractor Access to OCC Information Resources] Section Deliverable Frequency Due Date

J. Training Requirements. Role- Based Training

List of IT Personnel on this Contract and Respective Role

Initially and as changes occur

Initial: [Within 2 weeks of Task Order

Award] J. Training Requirements. Role- Based Training

Completion Report for Role-Based IT Security Training Annually Annual NLT June 5th

[END OF SECTION C]

SECTION D – PACKAGING AND MARKING

[THIS SECTION INTENTIONALLY LEFT BLANK]

[END OF SECTION D]

SECTION E – INSPECTION AND ACCEPTANCE

E.1. FAR 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this address: https://www.acquisition.gov.

NUMBER TITLE DATE

52.246-4

52.246-6

INSPECTION OF SERVICES - FIXED-

PRICE

INSPECTION-TIME-AND-MATERIAL

AND LABOR-HOUR

AUG 1996

MAY 2001

[END OF SECTION E]

https://www.acquisition.gov/

SECTION F – DELIVERIES OR PERFORMANCE

F.1 FAR 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this address: https://www.acquisition.gov.

NUMBER

TITLE DATE

52.242-15 STOP-WORK ORDER AUG 1989

F.2 1052.242-8002 (OCC) PERIOD OF PERFORMANCE (SEP 2012)

The period of performance of this contract is from 01/01/2022 through 12/31/2026.

(End of Clause)

F.3 DELIVERABLES

Deliverables are described in Section C.5 of the SOW.

F.4 BUSINESS HOURS AND COVERAGE

The Contractor shall provide services between the hours of 7:00 AM - 6:00 PM EST, Monday thru Friday, excluding Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. Core Contractor hours are 9:30 AM to 3:30 PM EST. The Contractor will not be reimbursed when the government facility is closed for the above reasons. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined when the Government facility is not closed for the above reasons.

Operations and maintenance activities that may degrade the performance of OCC’s applications and/or infrastructure must be performed outside of normal business hours as required by the COR.

F.4 OPERATIONS DURING EMERGENCY SITUATIONS

Individual contingency operation plans shall be activated immediately after determining that an emergency has occurred, shall be operational within twelve (12) hours of activation, and shall be sustainable until the emergency situation is resolved and normal conditions are restored or the Task Order is terminated, whichever comes first. In case of a life-threatening emergency, the COR shall immediately make contact with the Contractor to ascertain the status of any Contractor personnel who were located in Government controlled space affected by the emergency. When any disruption of normal, daily operations occurs, the Contractor shall promptly open an effective means of communication and verify:

• Key points of contact (Government and Contractor)

• Temporary work locations (alternate office spaces, telework, virtual offices, etc.)

• Means of communication available under the circumstances (e.g. email, webmail, telephone, FAX, courier, etc.)

• Essential work products expected to continue production by priority

The Contractor, in coordination with the Government COR, must make use of the resources and tools available to continue OCC contracted functions to the maximum extent possible under emergency circumstances. The Contractor must obtain approval from the COR and Contracting Officer prior to incurring costs over and above those allowed for under the terms of this contract. Contractors performing work in support of authorized tasks within the scope of their contract shall charge those hours accurately in accordance with the terms of this contract.

F.3 LEGAL HOLIDAYS

The following legal holidays are observed:

New Year’s Day* January 1 Martin L. King’s Birthday Third Monday in January President’s Day Third Monday in February Memorial Day Last Monday in May Juneteenth* June 19 Independence Day* July 4 Labor Day First Monday in September Columbus Day Second Monday in October Veteran’s Day November 11 Thanksgiving Day Fourth Thursday in November Christmas Day* December 25

*Holidays that fall on Saturday are observed on Friday and holidays that fall on Sunday are observed on Monday.

In addition to days designated as holidays, the Government observes the following days as holidays:

• Any other day designated by Federal Statute

• Any other day designated by Executive Order

• Presidential Inauguration Day

• Any other day designated by the President’s Proclamation

It is understood and agreed between the Government and the contractor that observance of such days by Government personnel shall not otherwise be a reason for an additional period of performance, or entitlement of compensation except as set forth within the contract. In the event the contractor's personnel work during the holiday, they may be reimbursed by the contractor, however, no form of holiday or other premium compensation will be reimbursed either as a direct or indirect cost, other than their normal compensation for the time worked.

[END OF SECTION F]

SECTION G – CONTRACT ADMINISTRATION DATA

G.1 OCC 1052.201-8000 CONTRACTING OFFICER’S REPRESENTATION

(COR) DELEGATION AND AUTHORITY (DEC 2013)

(a) The contracting officer's representative will be identified via separate letter to the

Contractor.

(b) Performance of work under this contract is subject to the technical direction of the COR, as delegated in writing. The term "technical direction" includes, without limitation, direction to the Contractor that directs or redirects the labor effort, shifts the work between work areas or locations, fills in details and otherwise serves to ensure that tasks outlined in the work statement are accomplished satisfactorily.

(c) Technical direction must be within the scope of the specification(s)/work statement.

The COR does NOT have authority to issue technical direction that:

(1) changes any of the terms, conditions, or specification(s)/work statement of the contract;

(2) in any manner causes an increase or decrease in the contract price, or the time required for contract performance;

(3) interferes with the Contractor's right to perform under the terms and conditions of the contract; or,

(4) directs, supervises or otherwise controls the actions of the Contractor's employees.

(d) Technical direction may be oral or in writing. The COR shall confirm oral direction in writing within five work days, with a copy to the contract administrator.

(e) The Contractor shall proceed promptly with performance resulting from the technical direction issued by the COR. If, in the opinion of the Contractor, any direction of the COR, falls within the limitations in (c), above, the Contractor shall immediately notify the contracting officer no later than the beginning of the next Government work day.

(f) Failure of the Contractor and the contracting officer to agree that technical direction is within the scope of the contract shall be subject to the terms of the clause entitled "Disputes".

G.2 1052.204-8000 (OCC) – PROPER IDENTIFICATION OF CONTRACTOR

PERSONNEL (AUG 2020)

(a) All contractor personnel shall provide proper identification in both oral and written communications. Oral communications include, but are not limited to, in-person, Skype video and audio communications, and teleconference communications.

Additionally, when calling into meetings contractor personnel shall identify that they are a contractor by stating their name followed by stating contractor support for their respective OCC business unit.

(b) For written communications, all contractor personnel shall use a signature block that includes identification as a contractor, the name of the contractor personnel’s company, office telephone number, alternate contact (mobile) number (if applicable), and identification of the current assigned Contacting Officer Representative (COR) as stated in the contract.

Name: [Insert Name] Job Title: [Insert Title] (Contractor) Company Name: [Insert Name of Company] COR’s Name: [Insert Name of the current COR] Telephone: Office: (XXX) XXX-XXXX Work Cell: Mobile: (XXX) XXX-XXXX

G.3 OCC 1052.215-8003 KEY PERSONNEL (APR 2014)

(a) The Contractor shall assign to this contract the following key personnel: Bank

Examiner

(b) During the first ninety (90) days of performance, the Contractor shall make no substitutions of key personnel unless the substitution is necessitated by illness, death, or termination of employment. The Contractor shall notify the Contracting Officer within 15 calendar days after the occurrence of any of these events and provide the information required by paragraph (c) below. After the initial 90-day period, the Contractor shall submit the information required by paragraph (c) to the Contracting Officer at least 30 days prior to making any permanent substitutions.

(c) The Contractor shall provide a detailed explanation of the circumstances necessitating the proposed substitutions complete résumés for the proposed substitutes, and any in additional information requested by the contracting Officer. Proposed substitutes shall have comparable qualifications to those of the persons being replaced. The

Contracting Officer will notify the Contractor within 15 calendar days after receipt of all required information of the decision on substitutions. The contract will be modified to reflect any approved changes of key personnel.

(End of Clause)

G.4 OCC 1052.231-8001 REIMBURSEMENT OF TRAVEL COSTS (MAR

2014)

(a) Area of Travel. Performance under this contract/task order may require travel by contractor personnel. If travel is required, the contractor is responsible for making all necessary arrangements for its personnel.

(b) Travel Policy. The Government will reimburse the contractor for allowable travel costs incurred by the contractor in performance of the contract in accordance with FAR Subpart 31.205-46. Travel required for tasks assigned under this contract/task order shall be governed in accordance with Federal Travel Regulations.

(c) Travel and Per Diem. Travel and subsistence are authorized for travel whenever a contract/task order requires work to be accomplished at a temporary alternate worksite. No travel or subsistence shall be charged for work performed within a fifty-mile radius of the contractor’s office or for contractor personnel who reside in the metropolitan area in which the tasks are being performed. Travel performed for personal convenience or in conjunction with personal recreation, will not be reimbursed.

1. For travel costs other than described in paragraph (c) above, the contractor shall be paid on the basis of actual amount paid to the extent that such travel is necessary for the performance of services under the contract and is authorized by the Contracting Officer in writing.

2. The contractor shall use the lowest cost mode commensurate with the requirements of the mission as set forth in the basic contract and in accordance with good traffic management principles, including use of taxis versus rental car. The contractor shall use coach, economy class, or similar accommodations to the extent consistent with the successful and economical accomplishment of the mission for which the travel is being performed.

3. Meals and Incidental Expenses (M&IE) shall be paid to the contractor only to the extent overnight stay is required for contract performance. The authorized rate shall be the same as the prevailing M&IE rate of the worksite locality.

4. The contractor’s invoices shall include all non-M&IE receipts or other evidence substantiating actual costs incurred for authorized travel. In no event will such payments exceed the rates of common carriers.

G.5 OCC 1052.242-8000 EVALUATION OF CONTRACTOR PERFORMANCE

(DEC 2010)

A. The OCC will evaluate the Contractor’s performance after contract award. If this contract has option periods, interim evaluations will be conducted at the end of each option period and then a final evaluation report will be prepared at the completion of the entire contract. If this contract does not have renewal options, an evaluation will be conducted upon completion of the contract. Notwithstanding the preceding, the Contracting Officer may conduct evaluations more or less frequently, if the Contracting Officer deems appropriate.

B. Evaluations will be conducted using an electronic format as established by Contractor Performance Assessment Reporting System (CPARS), an internet-based database of Contractor performance information. The OCC will enter the information, gathered from the evaluation, into the CPARS.

C. If the Contractor responds to the evaluation, and the response rebuts any or all of the ratings, the Contracting Officer will attempt to reconcile the areas of disagreement with the Contractor. If agreement cannot be reached, the evaluation and response shall be reviewed at a level higher than the Contracting Officer and a final evaluation will be issued by the reviewing official. If the reviewing official finds, either all or in part, against the Contractor, the Contractor’s response shall become part of the final evaluation. The reviewing official’s final decision shall not be subject to dispute under the terms and conditions of the Disputes clause or subject to resolution in accordance with the terms and conditions of the Alternative Dispute Resolution clause. The reviewing official will provide the Contractor with a copy of the final evaluation.

D. Any government agency authorized to access the Past Performance Information Retrieval System (PPIRS) database will be able to view the performance information related to this contract. Any government agency may also receive a copy the Contractor’s performance evaluation, and any associated comments, by contacting the OCC. The OCC will also, upon request, provide copies of any and all of the Contractor’s evaluations to the Contractor.

G.6 OCC 1052.243-8001 AUTHORIZED CHANGES ONLY BY THE

CONTRACTING OFFICER (SEP 2016)

(a) Except as specified in paragraph (b) below, no order, statement, or conduct of Government personnel who provide technical direction or in any other manner communicates with contractor personnel during the performance of this contract shall constitute a change under the “Changes” clause of this contract.

(b) The Contractor shall not comply with any order, direction or request of Government personnel unless it is issued in writing and signed by the Contracting Officer (CO), or is pursuant to specific authority otherwise included as a part of this contract.

(c) The CO is the only person authorized to approve changes in any of the requirements of this contract and notwithstanding provisions contained elsewhere in this contract, the said authority remains solely the CO’s. In the event the Contractor effects any change at the direction of any person other than the CO, the change will be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in charges incurred as a result thereof. The primary CO will be identified via separate letter to the contractor. Any CO with appropriate warrant authority may direct changes through a modification to the contract.

G.7 DTAR 1052.232-7003 ELECTRONIC SUBMISSION OF PAYMENT

REQUESTS (APR 2015)

(a) Definitions. As used in this clause—

(1) “Payment request” means a bill, voucher, invoice, or request for contract financing payment with associated supporting documentation. The payment request must comply with the requirements identified in FAR 32.905(b), “Content of Invoices” and the applicable Payment clause included in this contract.

(b) Except as provided in paragraph (c) of this clause, the Contractor shall submit payment requests electronically using the Invoice Processing Platform (IPP).

Information regarding IPP, including IPP Customer Support contact information, is available at www.ipp.gov or any successor site.

(c) The Contractor may submit payment requests using other than IPP only when the Contracting Officer authorizes alternate procedures in writing in accordance with Treasury procedures.

(c) If alternate payment procedures are authorized, the Contractor shall include a copy of the Contracting Officer's written authorization with each payment request.

[END OF SECTION G]

http://www.ipp.gov/

SECTION H – SPECIAL CONTRACT REQUIREMENTS

H.1 RELEASE OF CLAIMS

After completion of contract and prior to final payment, the Contractor shall furnish to the Contracting Officer, a release of claims against any outstanding balances or claims arising out of the contract.