RFQ 2031JW23Q00006_UCE Test Admin Centers Servics.pdf

REQUEST FOR QUOTATION (RFQ)

Solicitation ID Number 2031JW23Q00006

UNIFORM COMMISSION EXAMINATION (UCE) TEST ADMINISTRATION

CENTERS SUPPORT SERVICES

for

OFFICE OF THE COMPTROLLER OF THE CURRENCY’S (OCC’s) EXAMS &

EXAMINER DEVELOPMENT OFFICE

Issued:

Open-Market (Unrestricted)

North American Industry Classification System (NAICS) 611710 – Educational Support

Services

Conducted under Federal Acquisition Regulation (FAR) Part 12 and 13.5

Issued by:

OCC Acquisition Management Division, Mission Support Team

400 400 7th St SW, Washington, DC 20219

Table of Contents

A SOLICITATION

B. SUPPLIES/SERVICES AND PRICES

C. DESCRIPTION OF SERVICES (PERFORMANCE WORK STATEMENT)

D. PACKAGING AND MARKING

E. INSPECTION AND ACCEPTANCE

F. DELIVERIES AND PERFORMANCE

G. CONTRACT ADMINISTRATION DATA

H. SPECIAL CONTRACT REQUIREMENTS

I. CONTRACT PROVISIONS AND CLAUSES

J. LIST OF ATTACHMENTS

K. REPRESENTATIONS, CERTIFICATIONS, AND OTHER STATEMENTS OF OFFERORS OR

RESPONDENTS

L. INSTRUCTIONS, CONDITIONS, AND NOTICES TO QUOTERS (52.212-1 ADDENDUM)

M. EVALUATION FACTORS FOR AWARD

A SOLICITATION

A.1 SOLICITATION OVERVIEW

The Office of the Comptroller of the Currency (OCC), Office of Acquisition Management on behalf of the OCC’s

Exams & Examiner Development Office is seeking to acquire test centers to administer Uniform Commission

Examinations (UCEs) to OCC individuals to assess their skills and practical knowledge of potential National Bank

Examinations as Qualified Examiners. The solicitation, issued in accordance with FAR 12 for Acquisition of

Commercial Products and Commercial Services, using the procedures under FAR 13.5—Simplified Procedures for Certain Commercial Products and Commercial Services, will be to performed to establish a single-award contract for UCE Test Administration Centers support services. The Government will not be restricting this procurement; however, the awarded Contractor shall be registered in the System for Award Management (SAM) at time of solicitation close. The resulting contract shall be for a period not to exceed 60 months (5 years), excluding any extension of services.

A.2 CONTRACT TYPE

The resulting contract will be of a combined contract type, including firm-fixed-price (FFP) and time and materials (T&M) as noted by contract line item numbers (CLINs) below.

The Contractor shall perform and respond to the efforts required by the resulting contract on the basis of FFP-

T&M. The work shall be performed by the Contractor in accordance with all requirements contained within the request for quotation (RFQ). This RFQ contains many standardized Government clauses and provisions that refer to “proposal”, “offer” and “Offeror”; Quoters should interpret these references to mean “quotation”, “quote” and

“Quoter”, respectively. Quoters shall not interpret this as the Government requesting offers as only quotes are being requested. Any offer to create a binding contract will be proposed by the Government. The Contractor shall furnish all technical, management, labor, equipment, materials, licensing, and any other resource support necessary to adequately provide the services described in the RFQ, with particular consideration to Section C

Description of Services.

B. SUPPLIES/SERVICES AND PRICES

B.1 SUPPLIES/SERVICES PRICING TYPES

The pricing used under the resulting contract shall be applied according to the contract type established by the CLIN.

The Contractor shall provide services at FFP and T&M in performing the contract. The Contractor shall note the parent (base) CLINs 0004 thru 0006, and its subsequent child CLINs (option periods) are OPTIONAL CLINs for additional UCE Tests Administration, Test Accommodations, and Test Cancellations/No-Shows, within a given operating period.

These OPTIONAL CLINs shall only be billed as these CLINs are requested/required and performed. The resulting contract will consist of a 12-month base period and four 12-month option periods as identified in the tables below.

The option periods will be exercised at the discretion of the Government, consistent with FAR Clause 52.217-9

Option to Extend the Term of the Contract.

B.1.1 Base Period (Month 1 through Month 12)

CLIN Type Task Description Qty Unit/

Amount Unit Price Extended Price

0001 FFP

Data Automation & Programming (Ref.

PWS Section C.4.1)

1 EA

0002 FFP

Data Maintenance & Republishing (Ref.

PWS Section C.5.5)

12 MO

0003 T&M Test Delivery and Administration ("UCE

Test", Ref. PWS Section C.5.1.1)

120 NTE

0004 T&M

Test Delivery and Administration

(Optional; in addition to 120 "UCE Test", Ref. PWS Section C.5.1.5)

30 NTE

0005 T&M

Test Accommodations and

Administrations (Optional; Ref. PWS

Section C.5.1, items C.5.1.4 and C.5.1.5)

150 NTE

0006 T&M Cancellations and No-Shows (Optional;

Ref. PWS Section C.6)

150 NTE

0007 FFP

Security and Privacy Requirements (Ref.

PWS C.11)

12 MO

TOTAL COST FOR BASE PERIOD

B.1.2 Option Period One (Month 13 through Month 24)

Unit/

Amount Unit Price Extended Price

1001 FFP

Data Automation & Programming (Ref.

PWS Section C.4.1)

1 EA

1002 FFP

Data Maintenance & Republishing (Ref.

PWS Section C.5.5)

12 MO

1003 T&M Test Delivery and Administration ("UCE

Test", Ref. PWS Section C.5.1.1)

120 NTE

1004 T&M

Test Delivery and Administration

(Optional; in addition to 120 "UCE Test", Ref. PWS Section C.5.1.5)

30 NTE

1005 T&M

Test Accommodations and

Administrations (Optional; Ref. PWS

Section C.5.1, items C.5.1.4 and C.5.1.5)

150 NTE

1006 T&M Cancellations and No-Shows (Optional;

Ref. PWS Section C.6)

150 NTE

Unit/

Amount Unit Price Extended Price

1007 FFP

Security and Privacy Requirements (Ref.

PWS C.11)

TOTAL COST FOR OPTION PERIOD ONE

B.1.3 Option Period Two (Month 25 through Month 36)

Unit/

Amount Unit Price Extended Price

2001 FFP

Data Automation & Programming (Ref.

PWS Section C.4.1)

1 EA

2002 FFP

Data Maintenance & Republishing (Ref.

PWS Section C.5.5)

12 MO

2003 T&M Test Delivery and Administration ("UCE

Test", Ref. PWS Section C.5.1.1)

120 NTE

2004 T&M

Test Delivery and Administration

(Optional; in addition to 120 "UCE Test", Ref. PWS Section C.5.1.5)

30 NTE

2005 T&M

Test Accommodations and

Administrations (Optional; Ref. PWS

Section C.5.1, items C.5.1.4 and C.5.1.5)

150 NTE

2006 T&M Cancellations and No-Shows (Optional;

Ref. PWS Section C.6)

150 NTE

2007 FFP

Security and Privacy Requirements (Ref.

PWS C.11)

TOTAL COST FOR OPTION PERIOD TWO

B.1.4 Option Period Three (Month 37 through Month 48)

Unit/

Amount Unit Price Extended Price

3001 FFP

Data Automation & Programming (Ref.

PWS Section C.4.1)

1 EA

3002 FFP

Data Maintenance & Republishing (Ref.

PWS Section C.5.5)

12 MO

3003 T&M Test Delivery and Administration ("UCE

Test", Ref. PWS Section C.5.1.1)

120 NTE

3004 T&M

Test Delivery and Administration

(Optional; in addition to 120 "UCE Test", Ref. PWS Section C.5.1.5)

30 NTE

3005 T&M

Test Accommodations and

Administrations (Optional; Ref. PWS

Section C.5.1, items C.5.1.4 and C.5.1.5)

150 NTE

3006 T&M Cancellations and No-Shows (Optional;

Ref. PWS Section C.6)

150 NTE

3007 FFP

Security and Privacy Requirements (Ref.

PWS C.11)

TOTAL COST FOR OPTION PERIOD THREE

B.1.5 Option Period Four (Month 49 through Month 60)

Unit/

Amount Unit Price Extended Price

4001 FFP

Data Automation & Programming (Ref.

PWS Section C.4.1)

1 EA

4002 FFP

Data Maintenance & Republishing (Ref.

PWS Section C.5.5)

12 MO

4003 T&M Test Delivery and Administration ("UCE

Test", Ref. PWS Section C.5.1.1)

120 NTE

4004 T&M

Test Delivery and Administration

(Optional; in addition to 120 "UCE Test", Ref. PWS Section C.5.1.5)

30 NTE

4005 T&M

Test Accommodations and

Administrations (Optional; Ref. PWS

Section C.5.1, items C.5.1.4 and C.5.1.5)

150 NTE

4006 T&M Cancellations and No-Shows (Optional;

Ref. PWS Section C.6)

150 NTE

4007 FFP

Security and Privacy Requirements (Ref.

PWS C.11)

12 MO

TOTAL COST FOR OPTION PERIOD FOUR

TOTAL COST FOR BASE PLUS ALL OPTION PERIODS

B.1.6 6-Month Extension—if exercised (Month 61 through Month 66)

Unit/

Amount Unit Price Extended Price

4001a FFP Data Automation & Programming (Ref.

PWS Section C.4.1)

1 EA

4002a FFP Data Maintenance & Republishing (Ref.

PWS Section C.5.5)

12 MO

4003a T&M Test Delivery and Administration ("UCE

Test", Ref. PWS Section C.5.1.1)

120 NTE

4004a T&M

Test Delivery and Administration

(Optional; in addition to 120 "UCE Test", Ref. PWS Section C.5.1.5)

30 NTE

4005a T&M

Test Accommodations and

Administrations (Optional; Ref. PWS

Section C.5.1, items C.5.1.4 and C.5.1.5)

150 NTE

4006a T&M Cancellations and No-Shows (Optional;

Ref. PWS Section C.6)

150 NTE

4007a FFP Security and Privacy Requirements (Ref.

PWS C.11)

12 MO

TOTAL COST FOR OPTION PERIOD FOUR EXTENSION

TOTAL COST FOR ALL OPERATING PERIODS PLUS 6-MONTH EXTENSION)

C. DESCRIPTION OF SERVICES (PERFORMANCE WORK STATEMENT)

C.1 Background

The Office of the Comptroller of the Currency (OCC) charters, regulates, and supervises national banks and federal savings associations and licenses, regulates, and supervises federal branches and agencies of foreign banking organizations. The mission of the OCC is to ensure that national banks and federal savings associations operate in a safe and sound manner, provide fair access to financial services, treat customers fairly, and comply with applicable laws and regulations. Headquartered in Washington, DC, the OCC which is an independent bureau of the U.S. Department of the Treasury, has offices in 54 locations nationwide. The OCC charters, regulates and examines over 1,000 institutions, which are comprised of large banks, midsize banks, community banks, federal branches, and federal savings associations.

The Uniform Commission Examination (UCE) is an OCC certification program used to assess the skills and practical knowledge of potential National Bank Examiners. A commission from the Comptroller of the Currency signifies that a National Bank Examiner is qualified to perform examinations of National Banks, their affiliates, bank service corporations, and thrift institutions.

C.2 Scope

The Contractor shall:

C.2.1 Institute, maintain, and administer computer-based, multiple-choice tests for the UCE program. The UCE is comprised of one test described in section C.3, Uniform Commission

Examination Test.

C.2.2 Administer the UCE test at testing facilities as described in section C.5.1. To this end, the

Contractor shall have at least one testing facility within a 50-mile radius of at least 40 of the

54 OCC offices listed in Attachment D1.

C.2.3 Administer the UCE test to candidates during test periods specified by the Contracting

Officer’s Representative (COR). Each test period will be approximately 8 weeks long.

There will be three test periods during the base period of the contract, and during each 12-month option period, if exercised. The test periods typically fall in January to March, April to

June, and August to September (see Attachment D2). There may be an estimated maximum of 150 candidates tested in a given year. The Contractor shall allow candidates to register and take the UCE test during scheduled test periods.

C.3 Uniform Commission Examination Test

The following matrix identifies the components of the UCE Test:

Test

Category

Pools of Questions in each test

Approx. #

Questions in Pool

# Knowledge

Domains in

Pool

Questions

Given in

Test

Maximum

Test Taking

Time Allotted

Generalist

(GEN)

Safety & Soundness 700 14 225 4 ½ hours

• Test Category. The candidate test is described above. The GEN test is for employees seeking a commission in bank safety and soundness.

• Pools of Questions in the Test. The tests are comprised of one pool of questions.

• Approximate Number of Questions in the Pool. Listed above is the approximate number of questions in the pool. The exact number will be determined by the COR. The Contractor shall randomly select a certain quantity of these questions, but not all of them, for each candidate’s test administered.

• Number of Knowledge Domains in each Pool. The pool is comprised of fourteen (14) knowledge domains.

A specific number of questions from each knowledge domain shall be randomly selected for the test, noting the COR will determine the exact number of questions from each knowledge domain.

• Number of Questions to be Given in the Test. The GEN test is comprised of 225 questions.

• Maximum Time Allotted to Take Test. The test has a specified time limit: 4 ½ hours with a 15-minute hard break. If the candidate has not completed the test by the designated stop time, the Contractor’s computer system shall automatically end the test, saving the results.

C.4 Description of Required Services and Facilities

C.4.1 Data Automation and Programming Services

The Contractor shall provide all data automation, programming, and related services necessary to electronically administer randomly-selected, multiple choice examinations to OCC UCE candidates in accordance with the requirements specified herein. These services include the tasks that follow:

C.4.1.1 The Contractor shall design and develop a database for storing the test and test-related data.

• Within 15 calendar days of contract award, the COR will provide the Contractor with the following data: pool of test questions, knowledge domains, an exhibit, multiple choice responses, answers, grading schematic, and survey information.

• The exhibit (graphics, charts, tables) consists of data that is pertinent to specific test questions.

• The COR will provide all documents electronically, in any of the following formats: Microsoft Word, Microsoft Excel, or Adobe PDF.

C.4.1.2 The Contractor shall populate the database with data (e.g., exam questions, answers).

C.4.1.3 The Contractor shall provision, implement, and maintain the software application(s) necessary to perform the following functions in support of the examination:

• Registration of examination candidates

• Online delivery of the examination to candidates

• Scoring of the examination

• Collection of post-examination survey from candidates

• Reporting of examination results

• End each test within 4 ½ hours from start of the exam with retention of answers recorded/entered

C.4.1.4 The overall design and development of the databases and applications necessary to meet the requirements of this contract is left to the discretion of the Contractor. There are, however, certain requirements that the databases and applications must meet. These are as follows:

• The candidate’s name or code must be captured on the test

• A unique control number must be assigned to each test question

• The exhibit must be linked to the corresponding test question(s)

• Test questions must be randomly selected and must be drawn from the pools of questions and knowledge domains based on the number of questions from each knowledge domain as provided by the COR

• The test must be immediately scored and a preliminary pass/fail grade conveyed to the test candidate after either: 1) the candidate finishes and submits the test, or 2) the test is automatically terminated because the allotted test time expires

• The application must time each test and terminate the test once the allotted time is up

• The application must provide an on-screen tutorial explaining how the test works. This tutorial must be provided prior to the test beginning, and be available at all times during the test. The tutorial shall cover, explaining the multiple-choice test format, the procedure for answering the questions, the procedure for reviewing and changing answers, the procedure for submitting the completed test, the time limit, the pass/fail result, and other pertinent information

• The application must provide for a post-examination survey following the completion of the test. (Note: There shall be a maximum of 10 survey questions. All survey questions will be provided by the COR after contract award within 15 calendar days.

The survey shall be provided to the test candidate after the test candidate has been presented a passed/failed result)

• The Contractor must, at all times, provide for the protection and security of all test and test-related data and OCC personnel data

• The application must provide for all required reports (see section C.5.4)

• The user interface for the exams must be a Graphical User Interface (GUI) that is user friendly and highly intuitive. The interface must:

o allow candidates to scroll through test questions so questions may be answered in random order o allow candidates to jump to any question in the test o present each test question and its corresponding multiple-choice answers in its entirety on the same screen o allow candidates to “tag” questions so they can easily return to them o use a “radio-button” or similar style interface for selecting answers to questions o provide a timing indicator on the computer screen showing the remaining available test time, in hours, minutes and seconds o system speed must provide for 1 second or faster turn-around time for every keyboard or mouse action

• Conduct quality assurance activities to ensure that the tests are fully operational and usable by the test candidates. The COR will have the right to be present at the quality assurance activities

C.4.1.4 Delivery, inspection, and acceptance requirements.

• The Contractor shall complete the automation and programming requirements and have a fully operational, inspected, and accepted test delivery system within 90 calendar days of receipt of OCC’s test data.

• Within 15 calendar days after receipt of the OCC’s test data, the Contractor shall provide the COR with confirmation of accommodating the planned schedule

(Attachment D2). In developing and finalizing the project implementation schedule, the Contractor shall allow enough time to correct problems identified by the COR and still meet the 90-calendar day delivery deadline.

• The project implementation schedule shall show key project milestones and allow for periodic review and approval by the COR (within 7 calendar days of receipt)) of the following deliverables:

o the look, feel, and format of the tests, the post-examination survey all reports, and the tutorial;

o the methodology used for ensuring data and test security; and o the methodology used for ensuring exam questions are selected randomly and from the different knowledge domains.

• The Contractor’s proposed project implementation schedule shall allow for COR reviews and inspections (within 7 calendar days of receipt) early in the development process to ensure that problems can be identified and corrected as soon as possible.

• As a result of its reviews and inspections, and within reasonable limits, the COR shall have the right to require, at no additional cost, revisions to any of the deliverables listed above.

• The time the COR takes inspecting and approving the Contractor’s deliverables shall not be considered as part of the Contractor’s calendar day delivery schedule.

C.5 Test Delivery and Administration

The Contractor shall provide all facilities, services, and related support, such as reasonable accommodations necessary to register test candidates, deliver tests, and provide reports as specified in this Section. The requirements that must be met and the services and support that must be provided include, the following:

C.5.1 Test Center Requirements

C.5.1.1 Delivery, inspection, and acceptance requirements. The Contractor shall have a network of established, computer-based testing centers. As used herein “established” means facilities that are regularly used for electronic testing purposes. The Contractor shall have at least one testing facility within a 50-mile radius of at least 40 of the 54 OCC offices listed in

Attachment D1. The Contractor shall be able to provide a minimum of 120 tests, with the ability to administer and accommodate an additional 30 tests (up to 150 tests) each operating period.

The test centers shall be compliant with Americans with Disabilities Act, 42 U.S.C. Section

12101 et seq. (ADA).

C.5.1.2 The test centers shall be open during normal business hours for candidate testing. As used herein, “normal business hours” means between the hours of 9:00 AM and 5:00 PM locally, Monday through Friday, except legal Holidays. The OCC recognizes the following 11

Federal holidays: New Year’s Day, Martin Luther King, Jr.’s Day, President’s Day, Memorial Day, Juneteenth Independence Day, Independence Day, Labor Day, Columbus

Day, Veterans’ Day, Thanksgiving Day, and Christmas Day.

C.5.1.3 The Contractor’s facilities shall allow each test candidate to be tested in his/her own test carrel.

C.5.1.4 Test Center Accommodations (Optional CLIN, as required) – The Contractor shall provide testing accommodations, such as alternate methods of scheduling the test, location of the test, testing environment, software, equipment, flexible breaks, separate room, extra time and/or personal assistance (e.g., assistance for visually or hearing-impaired test takers). All reasonable accommodations will be pre-approved by the COR and discussed with the Contractor prior to registering or scheduling.

C.5.1.5 UCE Tests 121-150 Administered (Optional CLIN, as required) – In addition to the 120 tests to be administered over the course of a given operating period (12 months), the

Contractor shall also be able to administer and accommodate for an additional 30 tests in that operating period for a total up to 150 tests in a given year.

C.5.2 Registration of Test Candidates

C.5.2.1 Subject to the limitations specified throughout this section (C.5), the Contractor shall allow candidates to register and take the UCE test during normal business hours during a scheduled test period. The COR will determine the dates of each test period and notify the

Contractor once the dates are finalized. The OCC will notify the Contractor of the test dates within 15 calendars of the start of the base year and each subsequent option year, if exercised. Each test period will be approximately 8 weeks long.

C.5.2.2 At least 15 calendar days prior to the beginning of a test period, the COR will provide the

Contractor with a list of test candidates. The format of the list will be determined by the

COR with input from the Contractor. This list will provide the following information about each candidate:

• Full Name,

• OCC Employee ID number, and

• Identified test, including specified knowledge domains, to be electronically administered to the candidate

C.5.2.3 Within 5 calendar days after receiving the list of test candidates from the COR, the

Contractor shall:

• enter the beginning and ending dates of the test period, the names of the candidates, and the corresponding candidate information into its web-based system;

• notify its test centers of this information, as necessary; and

• notify the COR when the test candidates may register.

C.5.2.4 The Contractor shall provide the capability for test-takes to register online, via email, and by telephone. Registration online, via email and by fax shall be available 24/7. Registration by contacting the Contractor’s registrar by phone shall be available during normal business hours. Unless the Contractor accepts a shorter time period, candidates will be required to register at least 48 hours in advance of the desired test date. At the time of registration, each candidate will stipulate his/her test date, time, and test center. If the candidate does not know the nearest test center, the Contractor shall identify the nearest test center for the candidate. Once the candidate has registered, the Contractor shall, within 24 hours, provide the candidate with email confirmation of the date, time, and location of the test.

C.5.3 Delivery of Tests

C.5.3.1 The Contractor shall deliver and administer the test to the OCC test candidates at the approved test centers.

C.5.3.2 The Contractor’s test centers shall be ready to administer the test to any approved OCC test candidate who has met the 48-hour-advanced-notification requirement specified in paragraph C.5.2.4 above.

C.5.3.3 The Contractor shall provide qualified test center personnel to administer the test and monitor the test candidates while the test is being taken.

C.5.3.4 Before allowing any test candidate to take the test, the test center’s personnel shall verify the candidate’s identity. To verify their identity, candidates shall be required to produce government-issued photo identification (Driver’s License, Passport, Military ID). Other means of photo identification can be used if agreed to by the COR and Contractor. The

Contractor shall not allow any candidate that does not have the required identification to take the test.

C.5.3.5 Once the candidate’s identity has been verified, the test center’s personnel shall provide the test candidate with a brief description of the policies and procedures of the test center and shall then answer questions posed by the candidate that are of an administrative nature.

C.5.3.6 The test center’s personnel shall provide the test candidate with scratch paper and a pencil and/or pen. The candidate is not allowed to bring personal articles, such as coats, briefcases, purses, cell phone, paper, pen/pencils, and reference material, into the testing area. The candidate is allowed to bring in and use a calculator. The test center shall provide lockers for candidates to lock their personal items while taking the test.

C.5.3.7 The test center’s personnel shall escort the candidate to his/her test carrel and shall verify that the test program is on the screen and ready for the test candidate’s use.

C.5.3.8 The test center shall have a proctor monitor the testing session to ensure that the candidate is taking the test in a fair manner and that security of the test is not breached. If problems or irregularities are noted, the Contractor shall document them and notify the COR via email within 24 hours of the date the test was taken or the following Monday if the test was taken on Friday.

C.5.3.9 The test center’s proctor shall verify that the test candidate was present through the entire time the test was in progress. This may be accomplished by having the test candidate sign in before the test begins and sign out at the completion of the test, or by other means approved by the COR. Test candidates may leave the testing room to go to the bathroom at any time. The time on the test will continue to count down if bathroom break is taken during the test and not during the 15-minute break.

C.5.3.10 At the end of the test, the test center’s personnel shall collect the scratch paper and pencil/pen from the test candidate.

C.5.4 Reporting

C.5.4.1 The Contractor shall provide all reports in Microsoft Word or in other applications, as acceptable to the COR. The Contractor shall provide an electronic copy of all reports.

C.5.4.2 The following reports are required:

• Registration Report

Contents: This report shall show all candidates who have registered for the UCE test in a given test period. The report shall contain the following data:

o Name of each candidate enrolled to take a test o Test center location where each candidate will take test o Date candidate will take the test

Delivery requirement: The Contractor shall submit the registration report weekly during the test period to the COR.

• Cancellation/No Show Report

Contents: This report shall show a list of test candidates who registered to take the UCE but then cancelled or did not show up to take the examination. This report shall provide the following data:

o Candidate name;

o Date the test was scheduled to be taken;

o Amount of cancellation or no-show fee assessed, if any.

o Test center location

Delivery requirement: The Contractor shall submit the Cancellation/No Show Report to the COR on a monthly basis at the same time it submits its invoice to OCC.

• Test Results Summary Report

Contents: This report shall provide a summary of test results for all tests each day during the test period. The report shall provide the following data:

o The name of each test candidate who took the test o The test center location where test was taken o The test candidate’s test score and the pass/fail indicator o A record of each question that the candidate answered (or control number that identifies each question), the test candidate’s response to each question, and the correct answer to each question

Delivery requirement: The Contractor shall provide electronic access to the test results summary report in pdf format within 24 hours following the day on which a test was taken.

If a candidate tests on Friday, results will be provided on the following Monday.

• Year-End Aggregate Report

Contents: This report shall provide a detailed summary of each question asked and the responses to it. The report shall include the following information:

o Each question and the associated multiple-choice responses to each question, organized by knowledge domains, and a summary of the responses selected by all candidates to that question o A copy of each test candidate’s performance record (i.e., the questions that candidate received and that candidate’s response to each question).

Delivery requirement: The Contractor shall furnish the Year-End Aggregate Report in pdf and excel format within 30 calendar days of the last test period of the year.

• Post-Examination Survey Report

Contents: This report consists of each candidate’s written post-examination survey.

Delivery requirements: The Contractor shall furnish the test candidate’s post-examination survey within 48 hours of completion of the test.

C.5.5 Data Maintenance/Republishing Services

C.5.5.1 The OCC shall revalidate all of the test questions and answers on a semi-annual basis. The

OCC may, at that time, delete, revise and/or add up to a maximum of 30 percent of the questions.

C.5.5.2 The Contractor shall provide data maintenance services to include the following:

• Accept the OCC’s revised and/or new test questions, related exhibits, multiple choice responses, answers, and grading schematic in electronic format

• Load OCC’s revised and/or new data into the database

• Secure and encrypt the revised and/or new data

• Conduct quality assurance activities to ensure that the revised tests are fully operational and usable by the test candidates.

C.5.5.3 The data maintenance services, including quality assurance, shall be performed within 60 calendar days of receipt of the OCC’s revised test data. The length of time the deliverables, such as the draft of the test format, are in the possession of the COR for approval does not count towards the 60-calendar day period.

C.5.5.4 Intermediate deadlines for such deliveries as the draft of the revised test format shall be established by the COR and Contractor, but must be approved by the COR. The test format, GUI, shall be approved by the COR prior to the administration of the first revised/republished test in the first test period of the Option Period.

C.5.5.4 Notwithstanding the foregoing, the Contractor is responsible for meeting the 60-day deadline for the revising/republishing of the test data.

C.6 Cancellations and No-Shows

The Contractor shall be paid for the cancellation of a test as follows:

A test candidate may cancel his/her scheduled test date. There shall be no charge for the cancellation if it is made a minimum of 48 hours in advance of the scheduled test date. If the cancellation is made less than 48 hours of a scheduled test date, the cancellation fee applies.

The Contractor shall be paid in the event a test candidate did not show up to take a scheduled test.

C.7 Government-Furnished Data Destruction

Upon the conclusion of the contract, the Contractor shall destroy all tests, candidate information, answers, grading schematics, and related data. The Contractor shall provide the COR with written certification that all OCC data has been destroyed. OCC Security will need to approve the manner of the destruction.

C.8 Single Point of Contact/ Contract Administrator and Alternate

The Contractor shall provide a Single Point of Contact or Contract Administrator to serve as a single point of contact for the coordination of all contract activities. The designated individual shall be experienced in contract administration and in computer-based testing services.

The Contractor shall also designate an Alternate Contract Administrator in the event the Contract Administrator is absent. The Alternate Contract Administrator shall be experienced in the industry.

The Contractor shall notify the COR in writing of any intended replacement for the Contract Administrator or

Alternate Contract Administrator.

C.9 Performance Requirement Summary

C.9.1 Performance Requirement Summary Table

Required

Service Performance Standard

Acceptable

Quality Level

Monitoring

Method

Testing

Center

Locations

The Contractor shall have and maintain at least

40 testing facilities within a 50-mile radius of the

54 OCC offices as listed in Attachment D1 throughout the life of the contract.

100%

Review by COR prior to each testing cycle

Timeliness All Deliverables are submitted on time and milestones are completed as scheduled 95%

COR Validation of delivery dates and milestones

C.10 Information and Communication Technology Accessibility Requirements

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities. As such, the following requirements apply to this solicitation:

C.10.1 Products, platforms and services delivered as part of this work statement that are ICT, or contain

ICT, must conform to the Revised 508 Standards, which are located at 36 C.F.R. § 1194.1 &

Apps. A, C & D, and available at https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines.

C.10.2 E102 / 702.10 – Web Content Accessibility Guidelines (WCAG) success criteria level A & AA are incorporated as a requirement. The referenced WCAG criteria is available at http://www.w3.org/TR/WCAG20/.

C.10.3 A completed Accessibility Conformance Report (ACR) found at https://www.itic.org/policy/accessibility/vpat, using Voluntary Product Accessibility Template

(VPAT) Revised Section 508 Edition, Version 2.4, is required to assist the Government in determining that the ICT products or services support Section 508 accessibility standards.

E202 – No General Exceptions Authorized by OCC.

The following items are identified as containing ICT:

• Web-based Intranet and Internet Information and Applications

• Information, Documentation, and Support

Applicable Functional Performance Criteria:

All functional performance criteria apply when using an alternative design or technology that achieves substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in

Chapters 4-6 of the Revised 508 Standards, or when Chapters 4-6 do not address one or more functions of ICT.

Requirements for software and Web products, as applicable:

• E207 – WCAG Level A & AA Success Criteria

• E302 – Functional Performance Criteria

• E502 – Interoperability with Assistive Technology

• E503 – Application

Applicable requirements for electronic documents and/or support services:

• E205 – WCAG Level A & AA Success Criteria

• E302 – Functional Performance Criteria

• E602 – Support Documentation

• E603 – Support Services

C.11 Security and Privacy Requirements

C.11.1 Compliance with Applicable Laws, Regulations, and Standards

Secure User-to-Cloud Communications Standards. All user-to-cloud service communications

(e.g., via internet) must be encrypted with the latest industry standard browser protocol.

C.11.2 General Requirements https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.access-board.gov%2Fguidelines-and-standards%2Fcommunications-and-it%2Fabout-the-ict-refresh%2Ffinal-rule%2Ftext-of-the-standards-and-guidelines&data=02%7C01%7CSusan.OBrien%40occ.treas.gov%7C57ec31d2d17c479fdbf808d76d258caa%7Cfd30c7091bb849f19c7edd8840c989d0%7C0%7C0%7C637097880354836254&sdata=7JnwLP%2B6fbjpueFFj8jBQftTv5w3dE9NXJ2AwTTNC8Q%3D&reserved=0 https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.access-board.gov%2Fguidelines-and-standards%2Fcommunications-and-it%2Fabout-the-ict-refresh%2Ffinal-rule%2Ftext-of-the-standards-and-guidelines&data=02%7C01%7CSusan.OBrien%40occ.treas.gov%7C57ec31d2d17c479fdbf808d76d258caa%7Cfd30c7091bb849f19c7edd8840c989d0%7C0%7C0%7C637097880354836254&sdata=7JnwLP%2B6fbjpueFFj8jBQftTv5w3dE9NXJ2AwTTNC8Q%3D&reserved=0 https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.access-board.gov%2Fguidelines-and-standards%2Fcommunications-and-it%2Fabout-the-ict-refresh%2Ffinal-rule%2Ftext-of-the-standards-and-guidelines&data=02%7C01%7CSusan.OBrien%40occ.treas.gov%7C57ec31d2d17c479fdbf808d76d258caa%7Cfd30c7091bb849f19c7edd8840c989d0%7C0%7C0%7C637097880354836254&sdata=7JnwLP%2B6fbjpueFFj8jBQftTv5w3dE9NXJ2AwTTNC8Q%3D&reserved=0 https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.w3.org%2FTR%2FWCAG20%2F&data=02%7C01%7CSusan.OBrien%40occ.treas.gov%7C57ec31d2d17c479fdbf808d76d258caa%7Cfd30c7091bb849f19c7edd8840c989d0%7C0%7C0%7C637097880354846251&sdata=F90EWonF%2FMda%2Bkzn8LLuXgoeQPPwO3o9D2lmn5ZNAmA%3D&reserved=0 https://www.itic.org/policy/accessibility/vpat

Location. Information collected, used, stored, maintained, or otherwise processed by the

Contractor in the performance of this contract shall be accessed, transferred, stored or processed only within the United States. In addition, the maintenance and support operations of the

Contractor's technology and information must take place, and originate from, within the United

States.

The Contractor shall not host any portion of the information, information system, infrastructure, or environment in facilities outside the contiguous United States, Alaska, Hawaii, and other U.S.

Territories.

Authorization to Use, Store, or Share Sensitive Information. The Contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The Contractor shall also protect all government data, equipment, etc. by treating the information as sensitive. All information gathered or created under this contract shall be considered as Controlled but Unclassified (CUI) information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If Contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets.

Confidentiality. The Contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

Deliverables. The deliverables in this contract will be considered sensitive and shall not be shared with any other organization without prior approval from the OCC CO.

C.11.3 Security and Privacy Authorization

Authorization Boundary. The Contractor shall provide a diagram specific for the OCC, that clearly demarcates the information system authorization boundary and depicts all of its connections and components, including the means for monitoring and controlling communications at the external boundary and at key internal boundaries within the system. The Contractor shall address all components and managed interfaces of the information system authorized for operation (e.g., routers, firewalls). The diagram must include a predominant border drawn around all system components and services included in the authorization boundary.

If there are OCC-specific components (e.g., components developed or customized for the OCC, OCC-hosted components) and/or other components supporting this solution that are not in the scope of the Contractor's existing security documentation, then identify those components in the diagram as well, as part of a separate OCC-specific boundary since those are unique to OCC and shall be part of the OCC-specific security authorization. The diagram must be easy to read and understand. Formal names of components as they are known at the service provider organization in functional specifications, configuration guides, other documents and live configurations shall be named on the diagram and described. The Contractor shall provide a key for symbols used.

External Service Provider Compliance and Monitoring Background. The FISMA and OMB policies require that federal agencies using external service providers to process, store, or transmit federal information or operate information systems on behalf of the federal government, assure that such systems meet the information security protections commensurate with the information and system sensitivity. Federal agencies are responsible and accountable for the information security risk incurred by the use of information system services provided by external providers.

Such risk is addressed by incorporating the Risk Management Framework (RMF)1 and security requirements for external information systems and services as part of the terms and conditions of the contracts with external providers. Federal agencies can also require external providers to provide appropriate evidence to demonstrate that they have complied with protecting federal information. Prior to the implementation of the Contractor's system or services, the OCC ensures compliance with the RMF by issuing an Authorization to Operate (ATO) or Authorization to Use

(ATU), based on its review and analysis of the external provider's security documentation

(described in detail in the next section) and assessment of customer (OCC's) security responsibilities.

1NIST Special Publication 800-37, as amended, Risk Management Framework for Information

Systems and Organizations: A System Life Cycle Approach for Security and Privacy.

Non-Federal External Service Provider Security Documentation. Non-federal organizations with primarily non-federal customers have limitations with respect to complying with all federal requirements. As a result, the OCC obtains assurance through other industry standard security reviews, including Statement on Standards for Attestation Engagements (SSAE) No. 18.

C.11.3.1 Statement on Standards for Attestation Engagements (SSAE) No. 18 Requirements. The

Contractor shall provide the OCC with an SSAE 18 System and Organization Controls

(SOC) 2 Type 2 Report on an annual basis for services provided.

C.11.3.2 The preferred coverage period for the report is July 1 through June 30 with a bridge letter covering the 3 months to September 30.

C.11.3.3 For any gaps in the fiscal year coverage period (October 1- September 30), the OCC will work with the Contractor to complete the internal controls assessment by relying on the work performed by the Contractor's competent and objective internal audit function per

Statement on Auditing Standards No. 128, Using the Work of Internal Auditors.

C.11.3.4 The submission of the results of the SSAE 18 SOC 2 Type 2 Report shall be as instructed per this section (C.11.3).

C.11.3.5 If SOC 2 Type 2 reports are not available within the last 3 years, the Contractor shall inform the OCC to determine if there is a suitable alternative with similar level of information and detail.

C.11.3.6 If any portion of standard security objectives (e.g., contingency planning controls) were not in the scope of the independent auditors testing, then the Contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2 report. The

Contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

OCC Security Authorization to Use. The determination of whether to issue an OCC security authorization will be made by the OCC based on the identified risks to the OCC's data and operations. These risks include: (1) deficiencies noted in the Contractor's most recent SOC 2 Type 2 Report, (2) the gaps identified in the IT security and privacy control assessments performed specific to OCC customer responsibility implementations as designated in the CRM.

C.11.4 Configuration Management

Security Configuration Settings. The Contractor shall establish and enforce security configuration settings for information technology products employed in the UCE Test Administration Centers

Support Services.

Security Updates and Patches. The Contractor shall ensure that the UCE Test Administration

Centers Support Services are properly maintained and monitored, to include immediate response to critical security patches, routine maintenance windows to allow for system updates, and compliance with the defined configuration management and change control processes. All patches and system updates shall be properly tested in a development environment before being implemented in the production environment.

Least Functionality. The Contractor shall restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services for information technology products employed by the UCE Test Administration Centers Support Services.

C.11.5 Continuous Monitoring

Compliance Reviews and Audits. The Contractor shall permit and support compliance reviews and audits under applicable laws to allow the OCC to meet legal and compliance obligations and shall implement processes that allow visibility into the privacy and security controls employed and their effectiveness. The Contractor shall provide the OCC or authorized designated officials with information requested by auditors in a timely manner, consistent with the respective auditor's deadline, in support of security compliance reviews and various annual audits, e.g., FISMA, Financial Statement Audit, A-123.

In addition, the Contractor shall provide the OCC or authorized designated officials logical and physical access to the Contractor's facilities, installations, technical capabilities, operations, records, and databases pertinent to this contract within seven (7) calendar days upon request for these purposes.

Annual SOC 2 Type 2 Reviews. As mentioned in this Section C.11.3, "Security and Privacy

Authorization", under SSAE 18 requirements, the Contractor shall provide the annual SSAE 18

SOC 2 Type 2 report to the OCC for review in support of continuous monitoring activities. If any portion of standard security objectives (e.g., contingency planning controls) were not in the scope of the independent auditor's testing, then the Contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2 report. The Contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

C.11.6 Data Protection

Data Encryption. Where encryption is required, as specified by the OCC, the Contractor shall ensure that encryption is established and maintained for data at rest and in transit for the duration of the contract. The encryption employed shall be equivalent to those approved in Federal

Information Processing Standards (FIPS) Publication 140.

Need to Know. Sensitive information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The Contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected.

Such measures include controls listed in NIST SP 800-171, Protecting Controlled Unclassified

Information in Nonfederal Systems and Organizations, as amended, in the following areas: Access

Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel

Security, Physical Protection, Risk Assessment, Security Assessment, System and

Communications Protection, and System and Information Integrity.

Data Separation. Unless otherwise directed by the OCC and/or controls are implemented to ensure adequate separation, any storage of data shall be contained within the resources allocated by the

Contractor to support the OCC and may not be on systems that are shared with other commercial or government clients.

General Use of Personally Identifiable Information (PII). The Contractor shall not use any PII, including low-sensitivity PII (e.g., E-mail Groups and Lists), for any purpose other than those activities necessary to the performance of this contract.

Use of PII Specific to this Contract's Scope of Work. The scope of work for this contract has specific business driven and functional requirements that involve PII. The contractor, contractor employees, and subcontractors must physically secure PII when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss. PII is no longer needed or required to be retained under applicable government records retention policies, it must be destroyed through means that will make the sensitive PII irretrievable. The contractor shall only use PII obtained under this contract for purposes of the contract and shall not collect or use such information for any other purpose without the prior written approval of the contracting officer. At expiration or termination of this contract, the contractor shall turn over all sensitive PII obtained under the contract that is in its possession to the government.

In accordance with OMB M-17-12 Preparing for and Responding to a Breach of Personally

Identifiable Information, the contractor and subcontractor(s) shall:

1. Properly encrypt PII in accordance with OMB Circular A-130 and standards per the "Data

Encryption" subsection above.

2. Complete regular training on how to identify and report a breach;

3. Maintain capabilities to determine what Federal information was or could have been accessed and by whom, construct a timeline of user activity, determine methods and techniques used to access Federal information, and identify the initial…