RFI_Attach 2_DRAFT PWS_2031JW26N00006-CR.docx

DRAFT PERFORMANCE WORK STATEMENT

1.0 BACKGROUND

The Office of the Comptroller of the Currency (OCC) is an independent bureau of the U. S. Department of the Treasury with headquarters in Washington, D.C. and district offices in four major cities throughout the continental United States. The OCC is responsible for chartering and regulating the country’s national banks and federal savings associations.

2.0 SCOPE

2.1 The OCC requires nationwide court reporting services, including digital court reporting services, stenotype services, videographer services, and virtual court reporting services (defined below).

2.2 This requirement uses the following definitions:

2.2.1 Proceeding – an event (litigation/legal actions occurring in a courtroom or other venue, depositions, sworn statements, arbitration hearings, personnel grievances and appeals, conference, and committee meetings) that requires verbatim transcript

2.2.2 Stenotype services – any proceeding during which a court reporter uses a stenotype machine to produce a verbatim transcript

2.2.3 Virtual court reporting services – any proceeding that includes at least one participant (party, court reporter, attorney, deponent, etc.) who is not physically present in the same location as other participants and is transmitted via live, remote video. Involves production of a verbatim transcript using either digital court reporting or stenotype services

The Contractor will use its own devices and network connections to access OCC-provided technology (e.g., Zoom or Teams) for the audiovisual and document sharing platform(s) to conduct remote proceedings. The Contractor’s network connections must be sufficient to maintain attendance without disruption.

2.2.4 Telephonic court reporting – any proceeding that includes at least one participant on the telephone

2.2.5 Transcription services – recording a proceeding, transcribing the audio or video recording into a written transcript, and proofreading and delivering the transcript

2.2.6 Videography services – producing a fair, true, accurate, and complete high definition (HD) video recording of a proceeding. Video standards and guidelines are identified in Section 8.7 of this performance work statement (PWS)

2.2.7 Contractor – Contracting company or personnel performing the services on behalf of the contracting company

2.2.8 Contracting Officer’s Representative or COR – government employee authorized to request services and provide technical direction within the scope of the contract. The COR is not authorized to request services outside the scope of the contract.

2.2.9 Person-in-charge – presiding OCC attorney, judge, etc. onsite during the proceeding, who has the authority during virtual hearings or at the location/site of the proceeding, to issue technical direction related to that proceeding. The person-in-charge is not authorized to request services outside the scope of the contract or unrelated to the proceeding.

2.3 The Contractor will provide certified personnel to perform services and court reporters who are certified to administer oaths.

2.4 The Contractor’s services will meet the requested requirements at the firm fixed prices specified in the schedule.

2.5 If the request for service (see Section 4.0) placed by the COR covers more than one event and each event requires a separate transcript, then each event is a separate proceeding

3.0 SERVICE DELIVERABLES

3.1 Attendance by a certified court reporter to provide any ordered services identified in this contract. The OCC will specify when placing the order whether the attendance is to be in person or virtual

3.2 All court reporting services will include the following deliverables:

3.2.1 One (1) original certified electronic version of the transcript

3.2.2 One (1) electronic version suitable for loading into transcript management software (see Section 8.6 for specifications)

3.3 In addition to the above, when the OCC requests videographer or virtual court reporting services , a minimum order will include the following deliverable:

3.3.1 One (1) certified video recording of the proceeding suitable for loading into a transcript management software. Video standards and guidelines are identified in Section 8.7 of this PWS. The video recording will be of the witness for the duration of the proceeding, unless the Contractor uses equipment that allows for video of all participants.

3.4 In addition to the transcripts, when OCC requests stenotype services a minimum order will include the following deliverable:

3.4.1 One (1) rough transcript in American Standard Code for Information Interchange (ASCII) format provided within twenty-four (24) hours of the completion of the proceeding

3.5 The Contractor will, upon OCC request, deliver a paper version of the original certified transcript and/or additional paper copies of transcripts or exhibits to an address or addresses provided by the Contracting Officer’s Representative (COR)

4.0 REQUESTS FOR SERVICES

4.1 The COR will request transcription and videographer services as needed. The Contractor will accept and service all requests that are placed by 5:00 pm Eastern Time at least three (3) business days in advance of a proceeding’s scheduled start day:

4.2 The Contractor will not be required, but will make a reasonable effort, to accept and service any request for which the minimum three (3) business days advance notification requirement is not met.

4.3 For timely orders, the Contractor will provide the name and contact information for the assigned court reporter to the COR by 5:00 pm Eastern Time two business days before the hearing.

4.4 For orders the Contractor accepts with shorter notice, the Contractor will provide the name and contact information for the court reporter to the COR as soon as it is available.

4.5 The COR will provide the following information, in writing, when placing a request:

4.5.1 Location of proceeding

4.5.2 Date and time of proceeding

4.5.3 Approximate duration of proceeding

4.5.4 Each type of service required

4.5.5 Delivery type of transcript order needed (regular, intermediate, etc., as defined in Section 5.3)

4.5.6 Name of the OCC attorney (point of contact or POC)

4.5.7 Whether or not the proceeding is private or public

4.5.8 For virtual hearings, virtual meeting information/invitation

4.5.9 For in-person hearings, the name of the Person-in-Charge onsite during the hearing

4.6 Cancelation and Attendance Fee

4.6.1 The OCC will notify the Contractor of any cancelations no later than 5:00 pm Eastern Time the day before the scheduled proceeding. If the OCC does not notify the Contractor by this time and the proceeding is canceled before it begins, the Contractor may request the per proceeding cancelation fee, which will be the same amount as one-day's attendance

4.6.2 If a proceeding begins but is canceled, postponed, or concluded at any time during the first day, the OCC will pay the Contractor the one-day attendance fee and the fees for any transcripts produced from the day's proceedings

5.0 DELIVERY REQUIREMENTS

5.1 The Contractor will provide, via encrypted email or Compact Disc (CD) (electronic deliverables) or courier (paper deliverables):

5.1.1 An original certified electronic version of the transcript, see Section 8.5 of this PWS for technical requirements

5.1.2 A txt version suitable for loading into a transcript management software, see Section 8.6 of this PWS for technical requirements

5.1.3 All exhibits, if applicable, see section 9.0 of this PWS for technical requirements

5.1.4 A certified video recording synched to the certified electronic transcript, if the OCC requested videography, see Section 8.7 of this PWS for technical requirements

5.1.5 Paper copy, if requested, see Section 8.1 of this PWS for technical requirements

5.2 The delivery period begins the first day after the proceeding concludes (inclusive) and ends according to the schedule in Section 5.3 below. If the last day is a Saturday, Sunday, or federal holiday, the delivery period will end the next business day.

5.3 The Contractor will provide transcripts according to one of the following delivery schedules, which will be specified by the COR at the time the request is placed. All deliveries must occur between 8:30 am and 5:00 pm Eastern time, unless otherwise directed by the COR. OCC will not reimburse for postage or other delivery costs.

5.3.1 Regular Order - within twenty (20) calendar days of the conclusion of a proceeding.

5.3.2 Intermediate Order - within ten (10) calendar days of the conclusion of a proceeding.

5.3.3 Expedited Order - within five (5) calendar days of the conclusion of a proceeding.

5.3.4 Overnight Order - by 9:30 am Eastern time on the day following the proceeding.

5.4 If the OCC requests a paper copy in the initial request, the schedule above must be followed. If the OCC requests a paper copy after the initial request the paper copy will be provided within five (5) business days of the request.

5.5 The following Federal Holidays are observed:

*Holidays that fall on Saturday are observed on Friday and holidays that fall on Sunday are observed on Monday.

Additionally, should the President of the United States proclaim an additional federal holiday (e.g., Christmas Eve), that day will also be considered a federal holiday.

6.0 ON-SITE AT A PROCEEDING

6.1 The Contractor will be set up and be ready to begin on the date and at the start time designated for the proceeding.

6.2 For any proceeding that requires the court reporter to be physically present, the Contractor will present themselves to the Person-in-Charge upon arriving at the proceeding. The Person-in-Charge and/or COR will instruct the Contractor during the proceeding, consistent with the terms and conditions of this contract.

7.0 RECORDING METHODS

7.1 The Contractor will use a recording method that is legally sufficient.

7.2 If the Contractor uses electronic sound recording devices, the devices’ quality must ensure against error, misinterpretation, or loss of voice. Equipment must include simultaneous playback, listening, and speaker identification facilities and be monitored to ensure a proper recording.

7.3 The Contractor will ensure that a backup recording system is available and operational in the event of problems with the primary system. There will be no break in recording during transfer to the backup system.

8.0 TRANSCRIPT SPECIFICATIONS

8.1 Formatting

8.1.1 Transcripts will be in upper/lower case text

8.1.2 Pages will be 8-1/2" x 11" with a top margin of 1/2”, bottom margin of 1/2”, a left margin of 1”, and a right margin of 1/2”

8.1.3 Each page will have no fewer than 25 typed lines per page and no fewer than nine or ten characters to the typed inch

8.1.4 Transcripts provided in hard copy will be single-sided. The type will be 12-point font size, and the lines will be double spaced

8.1.5 Whenever testimony and/or speech is continuous, requiring more than one line, the typing will begin as close as possible to the left ruled marginal lines, words to be properly hyphenated when necessary

8.1.6 Numbers indicating each line of transcription upon each page (i.e., 1, 2, 3, …) will be printed at the left marginal line of the original transcript.

8.1.7 Pagination of the transcript will be in a single series of consecutive numbering, regardless of the number of days of the proceeding

8.1.8 Page numbers will be placed in the upper right-hand corner of each page

8.1.9 Each hard copy of the transcript will be enclosed in a protective cover, as approved by the COR

8.1.10 Each electronic or hard copy of the transcript will include a title page showing the name and docket number (if applicable) for the proceeding

8.1.11 Each transcript will include one complete index of speakers and/or witnesses. The index will identify the exhibits by number and what party introduced them

8.1.12 A word index should not be included at the end of the transcript and will not be included in the page count for billing

8.1.13 Paper copies, if the COR requests them, will be punched with three (3) holes at the left side; the upper and lower holes to be two (2) inches from the top and bottom of the page, third hole in the center of the resulting interval, and will be secured with a fastener.

8.2 Accuracy

8.2.1 The Contractor will provide complete transcripts that accurately replicate the full and complete verbatim record of the proceeding. The COR will review the initial submission of the transcript to evaluate the transcript for accuracy. Acceptable quality levels are described in Section 18.0.

8.2.2 Where errors, including typographical, impact the accuracy of the verbatim record of the proceeding, the COR may ask the Contractor to reproof the entire transcript, correct all errors found, and furnish a corrected transcript; the Contractor must comply with the COR’s request, provided the request is in accordance with the terms and conditions of this contract. The Contractor will provide, at no cost to the OCC, the corrected transcript within five (5) calendar days for Regular, Intermediate, and Expedited orders; and within one (1) business day for Overnight orders, from COR’s notification to the Contractor. Although the corrected transcript is required, the COR’s transcript accuracy performance evaluation, as described in Section 18.0, does not apply to the corrected transcript; i.e., performance standards in Section 18.0 are applied to the original submission only.

8.3 Authentication

8.3.1 Electronic Transcripts: The Contractor will place a signed and dated certification page at the end of the original electronic transcript to authenticate it. Unless the COR requests a different format, the certification page will include the following paragraph:

"This is to certify that the attached proceedings before (name of judge) in the matter of: (Docket Number, if applicable), (Place of Proceeding) (Date of Proceeding) were held as herein appears, and that this is the original transcription thereof for the file of the Comptroller of the Currency."

8.3.2 Video Transcripts: The Contractor will authenticate all video recordings produced by the Contractor by placing a certification document signed and dated by the videographer that states that the recording constitutes the complete original/master recording; the recording has not been altered in any way while in the videographer’s possession; and the recording is fair, true, accurate, and complete.

8.4 Copies

The Contractor will provide, if requested by the OCC, clearly legible copies of the transcript. The OCC will determine whether a document is legible or not. If the OCC finds one or more copies to be illegible, the Contractor will, within five (5) calendar days of receipt of notification and without additional cost to the OCC, replace the illegible copies with clearly legible copies.

8.5 Electronic Transcripts Format

8.5.1 The Contractor will deliver electronic transcripts via secure electronic transfer or, if requested, on a CD. The original certified transcript will be in PDF format and the electronic, working copy will be in ASCII Format, unless the COR requests otherwise before the transcript is delivered. The original certified PDF version must be formatted to prevent editing. The electronic versions and all removable media must be protected in storage, in process, and during transmission (i.e., at all times). The Contractor will protect data consistent with Federal Information Processing Standards (FIPS) 140-3 data encryption requirements and Office of Management and Budget (OMB) M-06-16.

8.5.2 The electronic transcript will have identical pagination and content of any requested printed transcript as specified in Section 8.1 above and conform to the following specifications:

8.5.2.1 Only one (1) proceeding will be stored on the electronic medium.

8.5.2.2 The electronic transcript will be created with a unique file name as designated by the COR or Person-in-Charge.

8.6 Electronic Transcripts Format for Loading to Transcription Software

8.6.1 Acceptable formats

8.6.1.1 .txt

8.6.1.2 .ptf

8.6.1.3 .xmptf

8.6.1.4 .rtf

8.6.1.5 .trn

8.6.1.6 .xmef

8.6.2 Text Files Considerations

8.6.2.1 .txt File Considerations

8.6.2.1.1 Transcripts application completes a header validation for .txt files. (Please see the attached sample .txt file as an example)

8.6.2.1.2 The first five lines of a text file need to be one of the three options below:

8.6.2.1.2.1 Number space text

8.6.2.1.2.2 Number symbol space text

8.6.2.1.2.3 Space number space text

8.6.2.2 .ptf File Considerations

8.6.2.2.1 .ptf files will normally have the same file format that includes the following three lines:

8.6.2.2.1.1 Begin=Head

8.6.2.2.1.2 Type=ptf

8.6.2.2.1.3 Begin=text

8.6.2.3 .xmptf File Considerations

8.6.2.3.1 .Xmptf files will normally have the same file format that includes the following three lines:

8.6.2.3.1.1 Begin=head

8.6.2.3.1.2 Type=ptf

8.6.2.3.1.3 Begin=text

8.6.2.3.2 To differentiate from .ptf files, these also contain the following lines:

8.6.2.3.2.1 Linesnames=

8.6.2.3.2.2 Linetimestamps=

8.6.2.4 .rtf File Considerations

8.6.2.4.1 With .rtf files, all transcripts must contain one of the following headers:

8.6.2.4.1.1 \rtf1\ansi\ansicpg1252\deff0\deflang1033

8.6.2.4.1.1.1 Transcript lines end on \line.

8.6.2.5 .trn File Considerations

8.6.2.5.1 Transcripts application supports .trn files that adhere to the following requirements:

8.6.2.5.1.1 Start with an XML element

8.6.2.5.1.2 Contain a <TRN> element.

8.6.2.5.1.3 Contain a <Transcript> element.

8.6.2.5.1.4 Contain a control character for line page divider.

8.6.2.6 .xmef File Considerations

8.6.2.6.1 Transcripts application supports .xmef files that are zip file and contain any of the following files:

8.6.2.6.1.1 .ptf

8.6.2.6.1.2 .xmptf

8.6.2.6.1.3 .txt

8.7 Video Recordings

8.7.1 HD video recordings, synced to the transcript, will be delivered on a CD, digital video disc (DVD) or other encrypted media. The original certified synced transcript must be formatted to prevent editing. The electronic versions and all removable media must be protected in storage, in process, and during transmission (i.e., at all times). The Contractor will protect data consistent with FIPS 140-3 data encryption requirements and OMB M-06-16. The electronic copy will conform to these specifications and be identical in pagination and content to any requested printed transcript as specified in 8.1 above:

8.7.1.1 Only one (1) proceeding will be stored on the electronic medium (i.e., each proceeding will be on its own electronic medium)

8.7.1.2 Exhibits/inserts, if requested, must be on the electronic version of the transcript

8.7.1.3 The electronic transcript will have a unique file name, which will be provided by the COR or Person-in-Charge

9.0 EXHIBITS

9.1 The COR or Person-in-Charge may direct the Contractor to copy exhibits into the record to accompany the transcripts. If so, the Contractor will:

9.1.1 Mark and number or letter each exhibit and arrange them in numerical/alphabetical order, unless specifically directed by the COR or Person-in-Charge not to. The marking will indicate clearly who offered the exhibit

9.1.2 Identify each exhibit by number and title or description, indicating the page number on which the exhibit was identified and the page number on which it was admitted or rejected

9.1.3 Scan them to PDF for non-virtual proceedings and provide them with the applicable transcript, regardless of the transcript format (electronic, paper)

9.1.3.1 Electronic transcripts – exhibits must be included with the transcript. The agency’s preference is to convert the PDF exhibit(s) to a format that can be loaded into transcription software (see Section 8.6)

9.1.3.2 Paper Transcripts - If the OCC requests a paper transcript with exhibits, the exhibit will be made part of the transcript and securely bound or collected in a looseleaf binder with a list of exhibit numbers and their titles or descriptions.

9.1.4 Transmit the exhibits, if the proceeding is virtual, as directed by the COR or Person-in Charge. Examples are emailing the marked exhibits back to the attorney or including them with the transcript package to the COR.

10.0 DATA.

All transcripts, recordings, records, exhibits, and any other material which is part of, or relates to, any action recorded by the Contractor is the property of the OCC. At the termination of the contract, or upon request, the Contractor will destroy all OCC data stored on its servers and provide the OCC with certification of the destruction (Attachment A). At any time during which the Contractor remains in possession of property belonging to the OCC, that information will not be shared with any third party, except as provided for in 12 Code of Federal Regulations (CFR) 4.37(b).

11.0 COMPUTATION OF TIME.

Whenever a proceeding is continued, recessed, or adjourned for a period of five (5) or more calendar days, that portion of the transcript of a proceeding held prior to such continuance, recess or adjournment will be considered a complete proceeding for the purpose of computing time for delivery of the transcript and rates per page.

12.0 HOURS OF SERVICE.

12.1 Proceedings are normally held between the hours of 8:00 a.m. and 6:00 p.m. Monday through Friday, local time, except holidays. The Contractor is required to work at a proceeding outside the hours of 8:00 a.m. and 6:00 p.m. Monday through Friday, upon request of the COR or his/her designee.

12.2 If the Contractor is required to attend proceedings outside of normal hours (Saturdays, Sundays, federal holidays or from 6:00 p.m. to 8:00 a.m., Monday through Friday) the OCC will pay the Contractor the expedited transcript rate for the pages transcribed outside of normal hours. If an overnight transcript is required, the OCC will pay the Contractor for the pages transcribed outside of the normal hours at the fixed, per-page price specified in the contract.

13.0 SALE OF TRANSCRIPT COPIES TO THE RESPONDENT AND GENERAL PUBLIC

13.1 The Contractor may sell copies of PUBLIC HEARING transcripts (including linked video recording, where applicable) to the general public (defined as persons other than the OCC or Respondent) without prior approval from the COR or Contracting Officer (CO). When a proceeding is designated as a PRIVATE HEARING, the Contractor will only provide transcripts to the OCC and will only sell copies of the transcript to the Respondent or parties of the private hearing.

13.2 NOTE: During the course of an OCC investigation, the person being deposed is NOT entitled to a copy (purchased or otherwise) of the transcript or video of the Proceeding.

13.3 The COR will notify the Contractor, prior to the proceeding, whether the proceeding is private or public. When the proceeding is private, the COR or CO will identify to whom the transcript copies may be sold.

14.0 CONFIDENTIALITY REQUIREMENT

14.1 The Contractor, its agents, employees, and subcontractors (if any) will, in accordance with the provisions of the “Conditional Access to Sensitive but Unclassified Information Non-Disclosure Agreement,” (Attachment B) hold in the strictest confidence all information that may be gained in the performance of duties under this contract. This confidentiality requirement does not expire.

14.2 The Contractor, its agents, employees, and subcontractors (if any) will sign the “Conditional Access to Sensitive but Unclassified Information Non-Disclosure Agreement” (NDA) if they do any work under this contract. For all Contractor staff identified at the time of contract award, the NDAs will be submitted within seven (7) calendar days after the award of the contract. Each Contractor’s personnel must sign and return the NDA to the COR prior to performing any work under this contract.

15.0 CONFLICT OF INTEREST

The Contractor, its agents, employees, and subcontractors (if any) must not have a conflict of interest related to the proceedings with individuals involved in the proceedings. If a possible conflict of interest exists, the Contractor will immediately notify the COR.

16.0 LEGAL REQUIREMENTS AND PERMITS:

The Contractor will obtain, at the Contractor's expense, all necessary licenses and permits, including a notary public license when necessary, and will conform to all laws, regulations, and ordinances applicable to performance of this Contract.

17.0 POINT OF CONTACT

17.1 The Contractor will provide a Contract Administrator to serve as a single point of contact for the coordination of all contract activities. The Contractor will also designate an Alternate Contract Administrator to perform the duties in the Contract Administrator’s absence.

17.2 The Contractor will notify the COR in writing when it intends to replace the Contract Administrator or Alternate Contract Administrator.

18.0 PERFORMANCE REQUIREMENTS SUMMARY

The following factors are key performance factors for this requirement. The standards are set for each factor, and the measurement is the most likely surveillance method the OCC will use. The acceptable quality level describes the level the Government will accept. If any of the acceptable quality levels are not met during performance evaluation, the Government may note this in the Contractor’s performance evaluation.

Video recording (when applicable) will be delivered on-time in accordance with section 8.6.

(3) Contractor on-site (when applicable) and ready to record at start of proceeding

19.0 IT Accessibility Requirements

19.1 Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities. As such, the following requirements apply to this solicitation:

19.1.1 Written Deliverables. Reports, transcripts, depositions, court orders, sworn statements shall be produced as Section 508 compliant Microsoft Word or Adobe PDF documents. The format and structure of these written deliverables shall adhere with the OCC’s Guide for Crafting Section 508 Compliant Word/PDF Documents (Attachment C).

19.1.2 Video or Pre-recorded Media Deliverables. All deliverables that are, or contain, video, photo, or pre-recorded media of meetings, hearings, presentations, lectures, or panel discussions shall include content-relevant voice over or text captions throughout the deliverables.

20.0 IT SECURITY Requirements

20.1 Compliance with Applicable Laws, Regulations, and Standards

20.1.1 Federal Laws. The Contractor and all of its respective subcontractors will follow and remain compliant at all times with the Federal Acquisition Regulation (FAR), Privacy Act of 1974 (5 U.S.C. 552a - the Act), Federal Information Security Modernization Act of 2014 (Public Law 107-347) (FISMA).

20.1.2 FIPS. The Contractor and all of its respective subcontractors will follow FIPS, National Institute of Standards and Technology (NIST) standards and guidelines, and other laws, mandates, or Executive Orders pertaining to the protection of sensitive information and information systems.

20.1.3 OCC Policies and Procedures. The OCC understands that there are limitations in applying agency-specific policies to systems and environments shared with other organizations or customers. The requirements in this OCC Policies and Procedures subsection applies to all activities specifically performed for the OCC by the Contractor (e.g., professional services to develop or customize a component for the OCC). The intent of this section is to require contractor compliance with OCC policies and procedures for those activities, tasks, and deliverables specifically and uniquely performed and/or completed for the OCC by the Contractor that is not a typical service or component of the existing contractor system/solution. This section also applies to contractors with access and use of OCC information resources (i.e., OCC network, systems, laptops, other IT equipment, and/or OCC information).

The Contractor and all of its respective subcontractors will comply with all OCC security and privacy policies and standards in effect at the time of the award of the contract, as well as those requirements that may be added during the contract.

The Contractor/service provider will conform to OCC administrative regulations, policies, and procedures, as listed in section [cite corresponding location in contracting document], in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. The Contractor will work with OCC internal organizations, as needed, to ensure that policies, procedures, configuration control, and product life-cycle requirements are fulfilled to the satisfaction of OCC Information and Technology Services (ITS).

20.1.4 National Institute of Standards and Technology (NIST) SP 800-171. The Contractor and its respective subcontractors will ensure all components of contractor systems and organizations that process, store, and/or transmit OCC controlled unclassified information (CUI) or that provide protection for such components comply with the security requirements in NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.

20.2 General Requirements

20.2.1 Location. Information collected, used, stored, maintained, or otherwise processed by the Contractor in the performance of this contract will be accessed, transferred, stored or processed only within the United States. In addition, the maintenance and support operations of the Contractor's technology and information must take place, and originate from, within the United States.

20.2.2 Authorization to Use, Store, or Share Sensitive Information. The Contractor is responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The Contractor will also protect all government data, equipment, etc. by treating the information as sensitive. All information gathered or created under this contract will be considered CUI. It is anticipated that this information will be gathered, created, and stored within the primary work location. If Contractor personnel must remove any information from the primary work area, they will protect it to the same extent they would their proprietary data and/or company trade secrets.

20.2.3 Confidentiality. The Contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

20.2.4 Non-Disclosure Agreement. Each individual who has access to sensitive OCC data and/or the OCC network, systems, applications, laptops, or other OCC information resources that may process, store or transmit sensitive OCC data under this contract will execute a Non-Disclosure Agreement before being allowed such access (Attachment B).

20.2.5 Deliverables. The deliverables in this contract will be considered CUI and will not be shared with any other organization without prior written approval from the CO and/or the COR.

20.3 Continuous Monitoring

Compliance Reviews and Audits. The Contractor will permit and support compliance reviews and audits under applicable laws to allow the OCC to meet legal and compliance obligations and will implement processes that allow visibility into the privacy and security controls employed and their effectiveness. The Contractor will provide the OCC or authorized designated officials with information requested by auditors in a timely manner, consistent with the respective auditor's deadline, in support of security compliance reviews and various annual audits, e.g., FISMA, Financial Statement Audit, A-123, etc.

20.4 Data Protection

20.4.1 General Use of Controlled Unclassified Information (CUI). The Contractor will not use any CUI or CUI subcategories, including, Personally Identifiable Information (PII) or low-sensitivity PII (e.g., E-mail Groups and Lists), for any purpose other than those activities necessary to the performance of this contract.

20.4.2 Use of PII Specific to this Contract's Scope of Work. The scope of work for this contract has specific business driven and functional requirements that involve PII. The Contractor, contractor employees, and subcontractors must physically secure PII when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss. PII is no longer needed or required to be retained under applicable government records retention policies, it must be destroyed through means that will make the sensitive PII irretrievable. The Contractor will only use PII obtained under this contract for purposes of the contract and will not collect or use such information for any other purpose without the prior written approval of the contracting officer. At expiration or termination of this contract, the Contractor will turn over all sensitive PII obtained under the contract that is in its possession to the government.

20.4.3 In accordance with OMB M-17-12 Preparing for and Responding to a Breach of Personally Identifiable Information, the Contractor and subcontractor(s) will:

20.4.3.1 Properly encrypt PII in accordance with OMB Circular A-130 and standards per the "Data Encryption" subsection above.

20.4.3.2 Complete regular training on how to identify and report a breach;

20.4.3.3 Maintain capabilities to determine what Federal information was or could have been accessed and by whom, construct a timeline of user activity, determine methods and techniques used to access Federal information, and identify the initial attack vector;

20.4.3.4 Allow for an inspection, investigation, forensic analysis, and any other action necessary to assist with responding to a breach;

20.4.3.5 Adhere to notification and reporting requirements specified in Section G. "Incident Response" to effectively report and manage a suspected or confirmed breach as soon as possible (within 1 hour) and without unreasonable delay, consistent with the OCC's Incident Response Plan and US-CERT notification guidelines. Please note that a report of a breach will not, by itself, be interpreted as evidence that the Contractor or its subcontractor failed to provide adequate safeguards for PII.

20.4.4 Use of Contractor Equipment. Use of contractor-owned laptops or other equipment (e.g., media storage devices, servers, etc.) to process, transmit, or store OCC information or to access the OCC network or other OCC information resources without OCC's formal approval is prohibited. This restriction does not apply to the use of non-OCC laptops or PCs to use OCC-approved virtual desktop infrastructure to remotely access the OCC network.

20.4.5 Contractor Equipment Approval. To obtain OCC's approval to process, store, or transmit OCC CUI on contractor equipment, the Contractor will provide written assurance of compliance with NIST SP 800-171 (as amended), Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, requirements for all contractor system and organization components that will process, store or transmit OCC CUI.

20.5 Incident Response

20.5.1 Notification. The Contractor must report all information security incidents that potentially or actually cause the compromise of OCC information, even if the Contractor believes the security incident may be limited, small, or insignificant with respect to OCC data or systems. The OCC will determine when the Contractor's reported security incident requires additional focus and attention.

20.5.1.1 Within one hour from the time the Contractor validates that an information security incident has occurred, the Contractor must report the security incident information to the OCC Cyber Defense Center (CDC): Computer.Security@occ.treas.gov, (202) 649-7930, regardless of day or time.

20.5.1.2 The Contractor must provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC with the following text in the subject line of the email: “Supplementary Information/Report related to previously reported incident # [insert number].”

20.5.1.3 Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

20.5.1.4 When notifying the OCC CDC, copy the Contracting Officer if possible or, if reporting by phone or Contracting Officer's email is not immediately available, contact the Contracting Officer immediately after reporting the incident to the OCC CDC.

20.5.2 Information, System and Tool Availability. The Contractor will make available any information, systems and tools necessary for the OCC to respond to incidents in a manner consistent with NIST SP 800-61, as amended. In the case of a reported security incident, the Contractor will provide the OCC with access to the contractor's system and/or facilities within 72 hours of the OCC's request.

20.6 Information Ownership

20.6.1 Government Access. The government will retain unrestricted rights to government data. The OCC retains ownership of any user created/loaded data and deliverables (e.g., documents, applications, custom code, diagrams, workflows, data sets, etc.) hosted on contractor's equipment, systems, infrastructure, etc., as well as maintains the right to request full copies of these at any time.

20.6.2 Removal of OCC Data. The Contractor acknowledges the OCC's exclusive right of ownership of the information and is required to transfer, return, and/or delete all agency data collected, processed, stored or maintained by the Contractor on behalf of OCC upon termination of services, and will provide written certification and supporting documentation attesting to the transfer, return and/or deletion of agency information or data generated, collected, processed, maintained, or stored by the Contractor and any subcontractors, per instructions the "Security and Privacy Vendor Deliverables" section (Attachment A).

20.6.3 Documents and Deliverables. The preliminary and final OCC-specific deliverables and all associated working papers are the property of the U.S. Government. The Contractor will not release any information without the written consent of the Contracting Officer. All work papers, preliminary and final deliverables must be submitted to the COR at the conclusion of the contract in an acceptable and usable format, which may include the original format.

20.6.4 eDiscovery. The Contractor must ensure data preservation requirements (i.e., halt destruction and maintain data the Contractor may not otherwise have to maintain) related to litigation holds are met. The Contractor will also ensure that metadata associated with litigation holds are preserved. Metadata is electronically-stored information that describes the history, tracking, or management of an electronic document. It is created automatically when a user creates, modifies, accesses, or takes other actions with respect to an electronic document.

20.6.5 The Contractor will provide immediate access to all government data and government-related data impacting government data for review or scan, or conduct of a forensic evaluation, and physical access to any contractor facility with government data.

20.7 System Access

Government Right to Terminate Access. The OCC, at its discretion, may suspend or terminate the access to any systems and/or facilities when an information security incident or other electronic access violation, use or misuse issue gives cause for such action. The suspension or termination may last until such time as OCC determines that the situation has been corrected or no longer exists.

20.8 Training Requirements

20.8.1 Security Awareness Training. All contractor personnel with access to OCC data and systems must complete OCC-provided mandatory security and privacy training prior to gaining such access. Non-compliance may result in revocation of system access.

20.8.2 Role-Based Training. The Contractor will ensure that IT personnel supporting this contract complete eight (8) hours of role-based specialized IT security training on an annual basis. The Contractor must identify the IT personnel and their respective IT role[footnoteRef:3] that they serve in support of this contract. The Contractor will provide the list of List of IT Personnel on this Contract and Respective Role and the Completion Report for Role-Based IT Security Training per directions in the "Security and Privacy Vendor Deliverables" section. [3: IT Personnel include systems engineers; software developers; systems security engineers; privacy engineers; system, network, and database administrators; personnel conducting configuration management activities; personnel performing verification and validation activities; personnel with access to system-level software; personnel with contingency planning and incident response duties; personnel with privacy management responsibilities; personnel with access to personally identifiable information; and system security officers]

Attachment A Certificate of Data Return and Destruction

Upon receipt of a Case Closure Request from the OCC, all copies of the data and any derivative files provided to the Data Recipient by the OCC must be returned to the OCC, as specified in the Case Closure Request. Data must be destroyed using industry best practices and in such a way that no recovery or reconstruction is possible. No data files, or parts of files, are to be retained when the files are returned or destroyed, unless expressly authorized in writing by the data provider.

I _____________________________ an authorized representative of _____________________________ (Name of the Data Custodian) (company name) hereby certify that the following data files from the OCC, in their entirety, have been submitted for destruction. In addition, all electronic files have been deleted from the Contractor’s systems: All back-up tapes will automatically rewrite in days and all copies of the files will cease to exist in any production or non-production environment.

I certify that the data described above have been returned or deleted from _________________________ (company name) systems in compliance with CONTRACT NUMBER.

Attachment B

CONDITIONAL ACCESS TO SENSITIVE BUT UNCLASSIFIED INFORMATION

NON-DISCLOSURE AGREEMENT

I, ______________________, hereby consent to the terms in this Agreement in consideration of my being granted conditional access to certain United States Government documents or material containing sensitive but unclassified information.

I understand and agree to the following terms and conditions:

1. By being granted conditional access to sensitive but unclassified information, the United States Government has placed special confidence and trust in me and I am obligated to protect this information from unauthorized use or disclosure, in accordance with the terms of this Agreement.

2. As used in this Agreement, sensitive but unclassified information is any information, the loss, misuse, or unauthorized access to or unauthorized disclosure or modification of which could adversely affect the national interest or the conduct of Federal programs including information covered by 18 U.S.C. § 1905 and 1906, or the proprietary interests of national banks or their customers or the privacy to which individuals are entitled under Title 5 U.S.C. § 552a, but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense or foreign policy.

3. I am being granted conditional access contingent upon my execution of this Agreement for the sole purpose of work performed under Contract # CONTRACT NUMBER. This approval will permit me conditional access to certain information, including but not limited to, documents, memoranda, reports and/or to attend meetings in which such information is discussed or otherwise made available to me. This Agreement will not allow me access to materials which the Office of the Comptroller of the Currency (OCC) has predetermined, in its sole discretion, is inappropriate for disclosure pursuant to this Agreement. This may include sensitive but unclassified information provided to the OCC by other agencies of the United States Government.

4. I will never divulge any sensitive but unclassified information which is provided to me pursuant to this Agreement to any person, unless I have been advised in writing by the OCC that the individual is authorized to receive it. Unless expressly authorized by the OCC, I will not use any sensitive but unclassified information for any commercial or other purpose other than that for which access to such information is provided under Contract # CONTRACT NUMBER. I agree that I must seek and obtain the prior written approval of the OCC for any proposed disclosure or use.

Additionally, I will submit to the OCC for security review, prior to any submission for publication, any book, article, column or other written work for general publication that is based upon any knowledge I obtained during the course of my work on Contract # CONTRACT NUMBER in order for the OCC to ensure that no sensitive but unclassified information is disclosed.

5. I hereby assign to the United States Government all royalties, remunerations, and emoluments that have resulted, will result or may result from any disclosure, publication, or revelation of sensitive but unclassified information not consistent with the terms of this Agreement.

6. If I am permitted, at the sole discretion of the OCC, to review any official documents containing sensitive but unclassified information, such review will be conducted at a secure facility or under circumstances which will maintain the security protection of such material. I will not be permitted to and will not make any copies of documents or parts of documents to which conditional access is granted to me. Any notes taken during the course of such access will remain at the OCC to be placed in secure storage unless it is determined by OCC officials that the notes contain no sensitive but unclassified information. If I wish to have the notes released to me, OCC officials will review the notes for purposes of deleting any sensitive but unclassified information to create a redacted copy of the notes. If I do not wish a review of any notes that I make, those notes will remain sealed in secure storage at the OCC.

7. If I violate the terms and conditions of this Agreement, I understand that the unauthorized disclosure of sensitive but unclassified information could compromise the mission and security of the OCC.

8. If I violate the terms and conditions of this Agreement, such violation may result in the cancellation of my conditional access to sensitive but unclassified information. This may serve as a basis for denying me conditional access to OCC information, both classified and sensitive but unclassified, in the future. If I violate the terms and conditions of this Agreement, the United States may institute a civil action for damages or any other appropriate relief. The willful disclosure of information to which I have agreed therein not to divulge may constitute a criminal offense.

9. Unless and until I am provided a written release by the OCC from this Agreement or any portions of it, all conditions and obligations contained in this Agreement apply both during my period of conditional access, which will terminate at the conclusion of my work on Contract # CONTRACT NUMBER, and at all times thereafter.

10. Each provision of this Agreement is severable. If a court should find any provision of this Agreement to be unenforceable, all other provisions will remain…